MGT_Master_Agreement.pdf

MASTER AGREEMENT

MA20220112‐05

Information Security Services

PARTIES

State of Idaho Division of Purchasing “DOP” In conjunction with NASPO ValuePoint and

MGT of America Consulting, LLC “Contractor”

AGREEMENT

1. Overview This contract is for information security services. Specifically, Category 3 Breach Coach Services.

2. Order of Precedence

2.1 Any Order placed under this Master Agreement shall consist of the following documents:

(1) A Participating Entity’s Participating Addendum (“PA”);

(2) NASPO ValuePoint Master Agreement;

(3) A Purchase Order issued against the Master Agreement;

(4) The RFP, including all Exhibits and Amendments; and

(5) Contractor’s response to the Solicitation.

2.2 These documents shall be read to be consistent and complementary. Any conflict among these documents shall be resolved by giving priority to these documents in the order listed above.

Contractor terms and conditions that apply to this Master Agreement are only those that are expressly accepted by the Lead State and must be in writing and attached to this Master

Agreement as an Exhibit or Attachment.

3. Effective Date and Term

This Master Agreement is effective February 23, 2022 or upon final executed signatures, whichever is later. In no event will this Agreement be effective until executed by DOP. The initial term of this Master

Agreement shall be two (2) years.

4. Attachments

The following documents are attached to and incorporated into this Master Agreement:

(1) Attachment 1 – RFP Documents including all exhibits, amendments, and clarifications

(2) Attachment 2 – Contractor’s Technical Proposal including all attachments and clarifications

(3) Attachment 3 – Contractor’s Cost Proposal

MGT of America Consulting, LLC Division of Purchasing

Chelsea Robillard, State Purchasing Manager

Date Date

A. Trey Traviesa, Chairman and CEO

01.14.22

Master Agreement – Attachment 1

STATE OF IDAHO

DIVISION OF PURCHASING

In conjunction with

REQUEST FOR PROPOSALS (RFP) RFP20200339

INFORMATION SECURITY SERVICES

Issue Date: January 23, 2020

Table of Contents

RFP Administrative Information

Section 1 NASPO ValuePoint Solicitation ‐ General Information

Section 2 Solicitation Requirements, Information and Instructions to Offerors

Section 3 Evaluation and Award

Section 4 Mandatory Administrative Response Requirements

Section 5 Technical Response Requirements

Section 6 Cost Proposal

Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions

Attachment B: Scope of Work

Attachment C: Cost Proposal Form

Attachments D – M: Additional Participating States’ Terms and Conditions

Attachment 1 – Offeror Questions

Attachment 2 – Pre‐Proposal Conference Call Registration Form

Attachment 3 – Modification and Exception Form

Attachment 4 – Company Information and Proposal Checklist

Attachment 5 – Offeror Certification Form

Attachment 6 – Lead State Solicitation Instructions to Vendors

Attachment 7 – Lead State Standard Terms and Conditions

RFP ADMINISTRATIVE INFORMATION

RFP Title: Information Security Services

RFP Project Description:

(See Section 1.1)

The state of Idaho, in conjunction with NASPO ValuePoint is seeking Contractor(s) to provide a suite of information security services including Risk Assessment and Mitigation, Event and Incident Management, Breach Coach, and Notification and Credit Monitoring Services.

Lead State Contract Administrator:

(See Section 1.2)

Jason Urquhart, Lead Purchasing Officer Idaho Division of Purchasing jason.urquhart@adm.idaho.gov Phone: (208) 332‐1608

Submit electronically via IPRO:

(See Section 2.10)

Electronic Submission https://purchasing.idaho.gov/information‐for‐vendors/

Pre‐Proposal Conference Call:

Friday, February 7, 2020, 1:30 p.m. Mountain time

Submit a completed Attachment 2 – Pre‐Proposal Conference Call Registration Form to the Lead State Contract Administrator no later than 5 p.m. Mountain Time Wednesday February 6, 2020. Call‐in information will be provided after receipt of the completed attachment.

Deadline to Receive Questions:

(See sections 1.3 and 2.1)

Friday, February 14, 2020, 11:59:59 p.m. Mountain time (The Q&A Submission Close Date shown in IPRO is void.)

Deadline to Receive Questions, Second Round of Written Questions and Answers:

(See sections 1.3 and 2.1)

Wednesday, April 15, 2020, 11:59:59 p.m. Mountain time (Use Attachment 1 – Offeror Questions to submit your Round 2 questions.)

RFP Closing Date and Time: (See section 1.3) See IPRO Header Document

Proposal Opening Date and Time: 1 p.m. Mountain time the following business day after closing

Initial Term of Master Agreement and Renewals, Extensions and Amendments:

(See Attachment A, Section 3.)

Two (2) years. Upon mutual, written agreement, the Master Agreement may be renewed, extended or amended. The anticipated total Master Agreement term is five (5) years.

TAKE NOTE OF THE 0.25% NASPO VALUEPOINT ADMINISTRATIVE FEE DETAILED IN SECTION 6 OF THE NASPO VALUEPOINT STANDARD TERMS AND CONDITIONS, WHICH MUST BE INCORPORATED INTO YOUR BASE PRICE. OTHER STATES MAY NEGOTIATE ADDITIONAL ADMINISTRATIVE FEES IN THEIR PARTICIPATING ADDENDA FOLLOWING AWARD

OF A MASTER AGREEMENT.

REQUEST FOR PROPOSAL

Information Security Services

Sollicitation # (RFP20200339)

Section 1: NASPO ValuePoint Sollicitation ‐ General Information

1.1. Purpose

The state of Idaho, Division of Purchasing (Lead State) is requesting Proposals for information security services in furtherance of the NASPO ValuePoint Cooperative Purchasing Program. The purpose of this Request for Proposal (RFP) is to establish Master Agreements with qualified Offerors to provide services related to these four (4) Categories of services for all Participating States: (1) Risk Assessment and Mitigation Services; (2) Event and Incident Management Services; (3) Breach Coach Services; and, (4) Notification and Credit Monitoring Services.

The objective of this RFP is to obtain best value, and in some cases achieve more favorable pricing, than is obtainable by an individual state or local government entity because of the collective volume of potential purchases by numerous state and local government entities. The Master Agreement(s) resulting from this procurement may be used by state governments (including departments, agencies, and institutions), institutions of higher education, political subdivisions (i.e., colleges, school districts, counties, cities, etc.), the District of Columbia, territories of the United States, and other eligible entities subject to approval of the individual chief procurement official and compliance with local statutory and regulatory provisions. The initial term of the master agreement shall be two (2) years with renewal provisions as outlined in Section 3 of the NASPO ValuePoint Master Terms and conditions (Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions).

Offerors may submit a Proposal to provide the services required for one (1) or more Categories.

Offerors are not required to offer services in all Categories but must offer all services within each Category proposed.

It is anticipated that this RFP may result in Master Agreement awards to multiple Contractors in the Lead State’s discretion.

This RFP is designed to provide interested Offerors with sufficient information to submit Proposals meeting minimum requirements but is not intended to limit a Proposal's content or exclude any relevant or essential data. Offerors are encouraged to expand upon the specifications to add service and value consistent with state requirements.

The primary purpose of this solicitation is to select an Offeror(s) who can offer the services for all members participating in the NASPO ValuePoint Cooperative Purchasing Program; therefore, Offeror must submit a Proposal for the Categories it intends to provide for all members (nationwide).

The Lead State/Sourcing Team, with the assistance as deemed advisable of the relevant

Participating State (or relevant group of Participating States), may evaluate and select an Offeror for award in more limited geographical areas (e.g. a single state) where judged to be in the best interests of the State or States involved.

1.2. Lead State, Solicitation Number and Lead State Contract Administrator The State of Idaho, Division of Purchasing is the Lead State and issuing office for this document and all subsequent addenda relating to it. The reference number for the transaction is Solicitation # RFP20200339. This number must be referred to on all Proposals, correspondence, and documentation relating to the RFP.

The Lead State Contract Administrator identified below is the Single Point of Contact during this procurement process. Offerors and interested persons shall direct to the Lead State Contract Administrator all questions concerning the procurement process, technical requirements of this RFP, contractual requirements, requests for brand approval, changes, and clarifications, the award process, and any other questions that may arise related to this solicitation and the resulting Master Agreement. The Lead State Contract Administrator designated by the State of Idaho is:

Jason Urquhart, Lead Purchasing Officer Idaho Division of Purchasing 304 N 8th Street, Room 403 Boise, Idaho 83702 jason.urquhart@adm.idaho.gov Phone: (208) 332‐1608

1.3 Schedule of Events

Solicitation Release: January 23, 2020 Pre‐Proposal Conference Call: February 7, 2020, 1:30 p.m.

Question Deadline: February 14, 2020, 11:59:59 p.m.

Second Round of Written Questions and Answers Deadline:

April 15, 2020, 11:59:59 p.m.

Anticipated Closing Date and Time: June 8, 2020, 5 p.m.

Anticipated Award Timeframe: September 2020

All times are Mountain time unless indicated otherwise.

1.4. Definitions

The following definitions apply to this solicitation. Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions also contains definitions of terms used in this solicitation.

There are also definitions contained in Attachment 7 ‐ Lead State Standard Terms and Conditions.

Active Participant: Every Eligible Person that voluntarily elects to activate their participation by agreeing to use the Credit Monitoring Services.

Adequate Security: Security commensurate with the risk and the magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information.

Breach or Data Breach: A security incident in which sensitive, protected or confidential Data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. (This definition is to be considered to be a baseline definition. Participating Entities may further define this term within their individual Participating Addenda.)

Breach Response Specialist: A specialized role in responding to a Data Breach or other cyber incident.

Computer Security Incident Response Team (CSIRT): A capability set up for the purpose of assisting in responding to computer security‐related incidents; also called a Computer Incident Response Team (CIRT) or a CIRC (Computer Incident Response Center, Computer Incident Response Capability).

Data: All information developed, documented, derived, stored, installed or furnished by the Purchasing Entity under a Participating Addendum, including all information related to records owned by or in the possession of the Purchasing Entity. (Data may include PII.)

Eligible Person: Every individual or business that meets the criteria established by a Participating Entity to qualify for the Notification and Credit Monitoring Services. The Participating Entity will have sole discretion to determine who qualifies as an Eligible Person.

Event: Any observable occurrence in a network or system.

Incident or Cyber Security Incident: A violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices in order to affect a system, application, or network’s integrity or availability and/or the unauthorized access or attempted access to a system or systems. Also referred to as Security Incident or Cyber Incident.

Incident Handling: The mitigation of violations of security policies and recommended practices.

Incident Manager: The individual who manages the process to restore normal service operation as quickly as possible to minimize the impact to business operations. Responsible for planning and coordinating all the activities required to perform, monitor, and report on the process.

Lead State: The State conducting this cooperative procurement, evaluation, and award.

Personally‐Identifiable Information or PII: Information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.

Threat: The potential source of an adverse event; the possibility of a malicious attempt to damage or disrupt a computer network or system.

Triggering Event: A Breach or suspected Breach of PII, or any other circumstance which results in a Participating Entity activating Notification and Credit Monitoring Services under the Master Agreement (through a Participating Addendum).

Vulnerability: A weakness in a system, application, or network that is subject to exploitation or misuse.

1.5. NASPO ValuePoint Background Information

NASPO ValuePoint (formerly known as WSCA‐NASPO) is a cooperative purchasing program of all fifty (50) states, the District of Columbia and the territories of the United States. The Program is facilitated by the NASPO Cooperative Purchasing Organization LLC, a nonprofit subsidiary of the National Association of State Procurement Officials (NASPO), doing business as NASPO ValuePoint. NASPO is a non‐profit association dedicated to strengthening the procurement community through education, research, and communication. It is made up of the directors of the central purchasing offices in each of the 50 states, the District of Columbia and the territories of the United States. NASPO ValuePoint facilitates administration of the cooperative group contracting consortium of state chief procurement officials for the benefit of state departments, institutions, agencies, and political subdivisions and other eligible entities (i.e., colleges, school districts, counties, cities, some nonprofit organizations, etc.) for all states, the District of Columbia, and territories of the United States. For more information consult the following websites www.naspovaluepoint.org and www.naspo.org.

1.6. Participating States

In addition to the Lead State conducting this solicitation, the following Participating States have requested to be named in this RFP as potential users of the resulting Master Agreement: Alaska, California, Hawaii, Idaho, Illinois, Maine, Montana, Oregon, Rhode Island, South Dakota, Texas, Utah and Washington. Other entities may become Participating Entities after award of the Master Agreement. Some States may have included special or unique terms and conditions for their state that will govern their state Participating Addendum. These terms and conditions are being provided as a courtesy to Offerors to indicate which additional terms and conditions may be incorporated into the state Participating Addendum after award of the Master Agreement. The Lead State will not address questions or concerns or negotiate other States’ terms and conditions.

The Participating States shall negotiate these terms and conditions directly with the supplier.

State‐specific terms and conditions are included in Attachments D‐M.

1.7. Anticipated Usage

This is a new Master Agreement for the Lead State and NASPO ValuePoint for all Categories except Category 4, Notification and Credit Monitoring Services; therefore, the only usage data available is for Category 4, Notification and Credit Monitoring Services. The information may be made available as part of a response to a written question (see section 1.3, Question Deadline).

No minimum or maximum level of sales volume is guaranteed or implied in awarded agreements made under this RFP.

Section 2: Solicitation Requirements, Information and Instructions to Offerors

2.1 RFP QUESTION AND ANSWER PROCESS

2.1.1 All questions, including those about the Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions, and Attachment 7 ‐ Lead State Standard Terms and Conditions must be submitted in writing using Attachment 1 ‐ Offeror Questions, and sent via email to the Lead State Contract Administrator by the question deadline date and time shown in Section 1.3 (Schedule of Events). Official answers to all written questions will be posted to Idaho’s eProcurement system, IPRO, as an addendum to the RFP. Answers will be posted to IPRO as soon as possible.

2.1.2 The Lead State may refuse to answer questions received after the Question/Answer deadline.

2.1.3 The identity of potential Offerors will not be published with the answers, but the text of questions will be restated, so Offerors are cautioned about including context in questions that may reveal the source of questions.

2.1.4 Please note that the Lead State will not consider any requests to consider terms and conditions that:

1. Waive the sovereign immunity of the state of Idaho;

2. Subject the state of Idaho or its agencies to the jurisdiction of the courts of other states;

3. Limit the time in which the state of Idaho or its agencies may bring a legal claim to a period shorter than that provided in Idaho law;

4. Impose a payment obligation, including a rate of interest for late payments, less favorable than the obligations set forth in § 67‐2302, Idaho Code;

5. Require the state of Idaho or its agencies to accept arbitration or to waive right to a jury trial;

6. Require indemnification not specifically authorized by the Idaho legislature or subject to appropriation pursuant to § 67‐9215, Idaho Code, and § 59‐1016, Idaho Code; or,

7. Hold individual users (employees or officers of the state of Idaho) personally liable.

2.1.5 Additionally, please note that the Lead State will not sign Offeror‐generated documents, Contractor‐generated documents or third‐party generated documents.

2.2 RFP Addenda

Formal changes to this RFP including but not limited to contractual terms and procurement requirements shall only be changed via formal written addenda issued by the Lead State.

The Lead State accepts no responsibility for a prospective Offeror not receiving solicitation documents and/or revisions to the solicitation. It is the responsibility of the prospective Offeror to monitor IPRO to obtain RFP addenda or other information relating to the RFP.

2.3 Pre‐Proposal Conference Call

A pre‐proposal conference call will be held on the date shown in the RFP Administrative Information. All interested parties are invited to participate by an established call in number.

Those choosing to participate must pre‐register with the Lead State Contract Administrator using Attachment 2 ‐ Pre‐Proposal Conference Call Registration Form, to receive meeting details. Attendance at the conference is optional and is at the participant’s own expense. Any oral answers given by the Lead State, other sourcing team members or representatives of NASPO ValuePoint during the pre‐proposal conference call are unofficial and will not be binding on the Lead State, other sourcing team members or NASPO ValuePoint.

2.4 Proposal Due Date

Proposals must be received by the posted Closing date and time as described in the IPRO header document (“End Date”). Proposals received after the deadline will not be accepted.

2.5 Cancellation of Procurement

This RFP may be canceled at any time prior to award of the Master Agreement(s) if the Lead State determines such action to be in the collective best interests of Participating States. (See Paragraph 20 of Attachment 6 ‐ Solicitation Instructions to Vendors.)

2.6 Governing Laws and Regulations

This procurement is conducted by the Lead State in accordance with the State Procurement Act, found in Idaho Code, IDAPA (administrative rules), and other policies, available at:

https://purchasing.idaho.gov/governing‐laws‐and‐policies/.

This procurement shall be governed by the regulations and laws of the Lead State. Venue for any administrative or judicial action relating to this procurement, evaluation, and award shall be in Ada County, Idaho. The provisions governing choice of law and venue for issues arising after award and during contract performance are specified in section 35 of Attachment A:

NASPO ValuePoint Master Agreement Terms and Conditions.

2.7 Firm Offers

Responses to this RFP, including proposed costs, will be considered firm for one hundred eighty

(180) calendar days after the proposal opening date.

2.8 Right to Accept All or Portion of Proposal

Unless otherwise specified in the solicitation, the Lead State may accept any item or combination of items as specified in the solicitation or of any Proposal (see Paragraph 20 of Attachment 6 ‐ Solicitation Instructions to Vendors).

2.9 Proposal Content and Format Requirements

Table of Contents. Include a Table of Contents in the Technical Proposal identifying the contents of each section, including page numbers of major sections.

Proposals should follow the numerical order of the RFP, identifying Proposal sections with the corresponding numbers and headings used in this RFP. In your response, restate the RFP section, followed with your response for each mandatory (M), mandatory evaluated (ME), or evaluated (E) section. Offerors are encouraged to use a different color font, bold text, italics, or other indicator to clearly distinguish the RFP section from the Offeror’s response.

Proposals must be detailed and concise. The format is designed to ensure a complete submission of information necessary for an equitable analysis and evaluation of submitted Proposals. There is no intent to limit the content of Proposals; however, see section 2.10.3.3 below.

Do not use embedded documents or links in your Proposal. The Lead State is not responsible for embedded links or documents that are invalid, broken, or do not open due to security requirements or compatibility issues with the Lead State’s systems.

2.10 Proposal Submission Instructions

2.10.1 Proposals may be submitted electronically via IPRO.

2.10.2 While it is not mandatory to submit your Proposal electronically via IPRO, all

Offerors participating in a Solicitation issued through IPRO must establish an account in the IPRO system as it is necessary in order to process and/or award the resulting Master Agreement(s). Establishing an account is free and only takes a few minutes.

2.10.3 Electronically Submitted Proposals

In an effort to limit the risk of spreading COVID‐19 through contact between DOP personnel and vendors/mail carriers/couriers, DOP will not accept manual submissions for this Solicitation. Only electronic submissions will be accepted. Proposals must be submitted electronically via IPRO. Do not fax or e‐mail your Proposal. Your Proposal must be submitted by the date and time specified on the IPRO header document.

2.10.3.1 Electronically submitted Proposals must be submitted through

IPRO, at IPRO LOGIN. When submitting through IPRO, enter your cost in IPRO as “$0,” and UPLOAD YOUR TECHNICAL PROPOSAL, COST PROPOSAL, SIGNATURE PAGE (attached in IPRO), AND ALL OTHER REQUIRED SUBMITTAL ITEMS separately. Word or Excel format is required (the only exceptions are for the Signature Page, financials, brochures or other information only available in an alternate format).

2.10.3.1.1 The Technical Proposal consists of Section 5.1, Business, Organization and Staffing, Section 5.2, Scope of Work and Section 5.3 Customer Service Response Requirements and Contract Manager Requirements.

2.10.3.2 If submitting via IPRO, be advised that the Offeror for Proposal evaluation and award purposes is the entity profile under which the Proposal is submitted in IPRO, which must be the same legal entity presented in the uploaded response materials. If the entity identified in the uploaded response materials differs from the entity under which you submit your Proposal in IPRO, the information provided in the uploaded response materials prevails.

2.10.3.3 Offerors are further advised to upload response materials with descriptive file names, organized and consolidated in a manner which allows evaluators to efficiently navigate the Offeror’s response. We request that Offerors upload only two (2) documents: one document being the Technical Proposal and the other document being the Cost Proposal. Please note that regardless of the number of documents uploaded, IPRO will only allow a grand total file size, all documents combined of 80 Mb. If you attempt to upload a grand total of greater than 80 Mb, IPRO will not accept any documents, and IPRO will not warn or advise you that your documents didn’t upload.

2.10.3.4 If your Proposal contains trade secret information which you have identified, you must also submit a redacted copy of the Technical Proposal (in electronic format, with the word “redacted” in the file name) with all trade secret information removed or blacked out; as well as a separate document containing a complete list (per the instructions in section 2.12, Confidential and Proprietary Information) of all trade secret information which was removed or blacked out in the redacted copy.

2.10.4 Offerors are solely responsible for ensuring that their Proposals are received by the Lead State in accordance with these solicitation requirements, before the Closing Date and Time, and at the place specified in the RFP Administrative Information section of this RFP. The Lead State shall not be responsible for any delays in mail or by common carriers or by transmission errors or delays or mistaken delivery. Proposal deliveries made to another location other than to the address identified in the RFP Administrative Information section will be considered non‐responsive unless re‐delivery is made to the address identified in the RFP Administrative Information before the Closing Date and Time. Proposals may NOT be submitted by facsimile or email.

2.12 Confidential or Proprietary Information

Paragraph 28 of Attachment 6 ‐ Solicitation Instructions to Vendors describes trade secrets to “include a formula, pattern, compilation, program, computer program, device, method, technique or process that derives economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by other persons and is subject to the efforts that are reasonable under the circumstances to maintain its secrecy.” In addition to marking each page of the document with a trade secret notation (as applicable; and as provided in Paragraph 28 of Attachment 6 ‐ Solicitation Instructions to Vendors), Offerors must also:

Identify with particularity the precise text, illustration, or other information contained within each page marked “trade secret” (it is not sufficient to simply mark the entire page). The specific information you deem “trade secret” within each noted page must be highlighted, italicized, identified by asterisks, contained within a text border, or otherwise clearly delineated from other text/information and specifically identified as a “trade secret.”

Provide a separate document entitled “List of Redacted Trade Secret Information” which provides a succinct list of all trade secret information noted in your Proposal; listed in the order it appears in your submittal documents, identified by Page#, Section#/Paragraph#, Title of Section/Paragraph, specific portions of text/illustrations; or in a manner otherwise sufficient to allow the state’s procurement personnel to determine the precise text/material subject to the notation.

2.13 Vendor Proposed Modifications and Exceptions to Requirements, Terms, and Conditions

2.13.1 Vendors are strongly encouraged to submit any proposed modifications to the requirements, terms or conditions of the RFP on Attachment 1 ‐ Offeror Questions prior to the deadline for submitting questions. Questions regarding these requirements must contain the following:

1. The rationale for the specific requirement being unacceptable to the party submitting the question (define the deficiency).

2. Recommended verbiage for the State’s consideration that is consistent in content, context, and form with the State’s requirement that is being questioned.

3. Explanation of how the State’s acceptance of the recommended verbiage is fair and equitable to both the State and to the party submitting the question.

2.13.2 In the event that a Proposal contains modifications or exceptions to any solicitation requirements, terms, or conditions, which are not addressed during the Question and Answer period, they must be identified and submitted on Attachment 3 ‐ Modification and Exception Form and must contain the same information outlined in Section 2.13.1, above. The Lead State will not consider any modifications or exceptions that are not identified specifically on Attachment 3 ‐ Modification and Exception Form.

2.13.3 The Lead State has sole discretion to determine if the modifications or exceptions submitted by an Offeror would result in a material change or otherwise threaten the integrity of the procurement process. Pursuant to IDAPA 38.05.01.084.03.e, the Lead State may only negotiate non‐material modifications or exceptions. Modifications or exceptions which the Lead State determines to be material, or which otherwise threaten the integrity of the procurement process, will not be accepted or negotiated. In the event that the Offeror has conditioned its Proposal on the Lead State’s acceptance or negotiation of its proposed modifications or exceptions, and the modifications or exceptions are deemed material, the Offeror will be given the opportunity to retract the proposed modifications or exceptions from its Proposal. Failure to do so will result in the Offeror’s Proposal being found non‐responsive, after which it will receive no further consideration.

2.13.4 Non‐material modifications or exceptions may be negotiated with the apparent successful Offeror, at the discretion of the Lead State; however, the Lead State shall have the right to reject any and all such modifications and/or exceptions, and to instruct the Offeror to amend its Proposal and remove the modifications and/or exceptions. Failure to do so may result in the Lead State finding the Proposal non‐responsive.

2.13.5 If the Lead State doesn’t specifically accept in writing prior to award of the Master Agreement modifications and exceptions proposed by the Offeror, then none of the proposed modifications and exceptions shall be considered to be incorporated into the Master Agreement.

2.13.6 Except as otherwise provided in the solicitation document the State will not consider modifications or exceptions to the requirements, terms, or conditions which are proposed after the RFP closing date.

2.14 Alternate Proposals

Alternate Proposals are not allowed.

2.15 Requirements, Terms and Conditions Mandatory

All requirements, terms and conditions within this RFP, including all Attachments, Exhibits and Appendices are mandatory unless otherwise identified within the RFP.

Section 3: Evaluation and Award

3.1 Right to Waive Minor Irregularities

Offerors are directed to IDAPA 38.05.01.074.03.a, as well as IDAPA 38.05.01.091.05, which allow the designated State official to waive minor informalities as well as minor deviations. The State also reserves the right to seek clarification on any M, ME or E requirement.

3.2 Evaluation Codes

(M) Mandatory Specification or Requirement ‐ failure to respond to any (M) section, or to comply with any mandatory specification or requirement, will render Offeror’s Proposal non‐ responsive and no further evaluation will occur.

(ME) Mandatory and Evaluated Specification ‐ failure to respond to any (ME) section, or to comply with any mandatory specification or requirement in an (ME) section, will render Offeror’s Proposal non‐responsive and no further evaluation will occur. Offeror must respond to these sections as directed; points will be awarded based on predetermined criteria.

(E) Evaluated Specification ‐ a response is desired and will be evaluated. If Offeror cannot meet the requirement, or chooses not to respond for any reason, zero (0) points will be awarded for the section. If Offeror responds, points will be awarded based on predetermined criteria.

3.3 Initial Review of Proposals

All Proposals will be reviewed first to ensure that they meet the Mandatory Submission Requirements of the RFP as addressed in Sections noted with an (M) or (ME). Any Proposal not meeting the Mandatory Submission Requirements may be found non‐responsive.

The Technical Proposal will be evaluated first as either “pass” or “fail,” based on compliance with those requirements listed in the RFP with an (M) or (ME). All Proposals which are determined to be responsive will continue in the evaluation process outlined in this section.

3.4 Evaluation Process

3.4.1 Technical Proposals will be evaluated and scored by one or more Proposal Evaluation Committee(s).

3.4.2 The evaluation of Technical Proposals will be conducted on a per Category basis;

therefore, each Category’s evaluation of Technical Proposals will be separated as follows:

3.4.2.1 Category 1 – Risk Assessment and Mitigation Services

The scores for the evaluation of Technical Proposals for Proposals in which the Offeror proposes to provide Category 1 – Risk Assessment and Mitigation Services will be normalized as follows:

The Technical Proposal with the highest total raw Technical Proposal evaluation score (the raw scores for section 5.1, Business, Organization and Staffing and section 5.2, Scope of Work [only the portion related to Category 1 – Risk Assessment and Mitigation Services] combined) will receive all available Technical Proposal evaluation points: 600 points. Other Proposals will be assigned a portion of the maximum available Technical Proposal evaluation points, using the formula:

600 X total raw Technical Proposal evaluation score of the Technical Proposal being evaluated highest total raw Technical Proposal evaluation score

3.4.2.2 Category 2 – Incident Response Services

The scores evaluation of Technical Proposals for Proposals in which the Offeror proposes to provide Category 2 – Incident Response Services will be normalized as follows:

The Technical Proposal with the highest total raw Technical Proposal evaluation score (the raw scores for section 5.1, Business, Organization and Staffing and section 5.2, Scope of Work [only the portion related to Category 2 – Incident Response Services] combined) will receive all available Technical Proposal evaluation points: 600 points.

Other Proposals will be assigned a portion of the maximum available Technical Proposal evaluation points, using the formula:

600 X total raw Technical Proposal evaluation score of the Technical Proposal being evaluated highest total raw Technical Proposal evaluation score

3.4.2.3 Category 3 – Breach Coach Services

The scores evaluation of Technical Proposals for Proposals in which the Offeror proposes to provide Category 3 – Breach Coach Services will be normalized as follows:

The Technical Proposal with the highest total raw Technical Proposal evaluation score (the raw scores for section 5.1, Business, Organization and Staffing and section 5.2, Scope of Work [only the portion related to Category 3 – Breach Coach Services] combined) will receive all available Technical Proposal evaluation points: 600 points.

Other Proposals will be assigned a portion of the maximum available Technical Proposal evaluation points, using the formula:

600 X total raw Technical Proposal evaluation score of the Technical Proposal being evaluated highest total raw Technical Proposal evaluation score

3.4.2.4 Category 4 – Notification and Credit Monitoring Services

The scores evaluation of Technical Proposals for Proposals in which the Offeror proposes to provide Category 4 – Notification and Credit Monitoring Services will be

The Technical Proposal with the highest total raw Technical Proposal evaluation score (the raw scores for section 5.1, Business, Organization and Staffing and section 5.2, Scope of Work [only the portion related to Category 3 – Breach Coach Services] combined) receive all available Technical Proposal evaluation points: 600 points. Other Proposals will be assigned a portion of the maximum available Technical Proposal evaluation points, using the formula:

600 X total raw Technical Proposal evaluation score of the Technical Proposal being evaluated highest total raw Technical Proposal evaluation score

3.4.3 Proposals that have a Technical Proposal that has received a minimum of seventy percent (70%) of the Total possible Technical Proposal evaluation points (see section 3.4.5) will be considered at this point to be “potentially acceptable” pursuant to IDAPA 38.05.01.083.01.b.

Cost Proposals will be opened only after the evaluation of Technical Proposals has been completed, and the only Cost Proposals that will be opened will be those for Proposals that at this point are considered to be “potentially acceptable”.

The evaluation of Cost Proposals will be on a per Category basis; therefore, each Category’s evaluation of Cost Proposals will be separated as follows:

3.4.3.1 Category 1 – Risk Assessment and Mitigation Services

The scores for the evaluation of Cost Proposals for Proposals in which the Offeror proposes to provide Category 1 – Risk Assessment and Mitigation Services will be normalized as follows:

The Cost Proposal with the lowest Hourly Rate proposed for Category 1 – Risk Assessment and Mitigation Services will receive all available Cost Proposal evaluation points: 400 points. Other Proposals will be assigned a portion of the maximum available Cost Proposal evaluation points using the formula:

400 X lowest Hourly Rate

Hourly Rate being evaluated

3.4.3.2 Category 2 – Incident Response Services

proposes to provide Category 2 – Incident Response Services will be normalized as follows:

The Cost Proposal with the lowest Hourly Rate proposed for Category 2 – Incident Response Services will receive all available Cost Proposal evaluation points: 400 points.

Other Proposals will be assigned a portion of the maximum available Cost Proposal evaluation points using the formula:

3.4.3.3 Category 3 – Breach Coach Services

proposes to provide Category 3 – Breach Coach Services will be normalized as follows:

The Cost Proposal with the lowest Hourly Rate proposed for Category 3 – Breach Coach Services will receive all available Cost Proposal evaluation points: 400 points. Other Proposals will be assigned a portion of the maximum available Cost Proposal evaluation points using the formula:

3.4.3.4 Category 4 – Notification and Credit Monitoring Services proposes to provide Category 4 – Notification and Credit Monitoring Services will be

3.4.3.4.1 For Cost per Notification (see Attachment C‐4 ‐ Costs for Category 4 – Notification and Credit Monitoring Services), the Cost Proposal with the lowest Average Unit Price proposed will receive 80 points. Other Proposals will be assigned a portion of the 80 points using the formula:

80 X lowest Average Unit Price

Average Unit Price being evaluated

3.4.3.4.2 For General Call Center (see Attachment C‐4 ‐ Costs for Category 4 – Notification and Credit Monitoring Services), the Cost Proposal with the lowest Average Unit Price proposed will receive 80 points. Other Proposals will be assigned a portion of the 80 points using the formula:

80 X lowest Average Unit Price

Average Unit Price being evaluated

3.4.3.4.3 For One Year Single‐Bureau Credit Monitoring/Identity Theft Protection (see Attachment C‐4 ‐ Costs for Category 4 – Notification and Credit Monitoring Services), the Cost Proposal with the lowest Average Unit Price proposed will receive 80 points. Other Proposals will be assigned a portion of the 80 points using the formula:

80 X lowest Average Unit Price

Average Unit Price being evaluated

3.4.3.4.4 For One Year Triple‐Bureau Credit Monitoring/Identity Theft Protection

(see Attachment C‐4 ‐ Costs for Category 4 – Notification and Credit Monitoring Services), the Cost Proposal with the lowest Average Unit Price proposed will receive 80 points. Other Proposals will be assigned a portion of the 80 points using the formula:

80 X lowest Average Unit Price

Average Unit Price being evaluated

3.4.3.4.5 For “Codes Only” Reduced Scope Service (see Attachment C‐4 ‐ Costs for Category 4 – Notification and Credit Monitoring Services), the Cost Proposal with the lowest proposed Fee per PIN Issued will receive 80 points. Other Proposals will be assigned a portion of the 80 points using the formula:

80 X lowest Fee per PIN Issued

Fee per PIN Issued being evaluated

3.4.3.4.6 The results for 3.4.3.4.1 through 3.4.3.4.5 will be added together for a total‐normalized‐points result for Category 4 – Notification and Credit Monitoring Services.

3.4.4 Proposals for which Cost Proposals have been opened and evaluated will, if not deemed non‐responsive up to this point, will be considered to be “acceptable” pursuant to IDAPA 38.05.01.083.01.a.

3.4.5 Based on the above, the following is a table showing the allocation of Technical Proposal evaluation points and Cost Proposal evaluation points per Category:

Category 1 Category 2 Category 3 Category 4

Section 5.1, Business, Organization and

Staffing / 5.3 Customer Service Response Requirements and Contract Manager

Requirements* 250 points 250 points 250 points 250 points

Section 5.2, Scope of Work* 350 points 350 points 350 points 350 points

Total possible Technical Proposal evaluation points 600 points 600 points 600 points 600 points

Total possible Cost Proposal evaluation points* 400 points 400 points 400 points 400 points

* The points shown are possible for each Category proposed but are not cumulative across Categories.

3.4.6 Evaluation Criteria

Technical Proposal includes:

Mandatory Administrative Response Requirements (Section 4) Pass/Fail

Business, Organization and Staffing (section 5.1) and Customer Service Response Requirements and Contract Manager Requirements (section 5.3) 250 points

Scope of Work (section 5.2) 350 points

Cost Proposal (Attachment C: Cost Proposal Form) 400 points

TOTAL POINTS 1,000 points

3.5 Best and Final Offer (BAFO) and Other Proposal Discussions Proposal discussions with individual Offerors (including the utilization of one or more BAFOs) may be conducted in accordance with IDAPA 38.05.01.083 and .084, as determined by the state to be in its best interest. NOTE: Offerors should submit their best Proposals initially as there is no guarantee that the State will conduct any discussions.

3.6 Responsibility

Pursuant to IDAPA 38.05.01.081, the Lead State Contract Administrator may, in the Lead State’s sole discretion, conduct a review to determine if the apparent high point Offeror is (or, Offerors are) responsible. As part of the responsibility review, the Lead State Contract Administrator may require the apparent high point Offeror(s) to provide financial reports to the satisfaction of the State and may also seek to obtain completed reference questionnaires from Offeror’s(s’) references to the satisfaction of the State. Nothing herein shall prevent the State from using other means to determine Offeror’s(s’) responsibility.

With its Proposal, Offeror is requested (but not required) to provide a list of at least three (3) references that are individuals, companies or government agencies to whom the Offeror has provided services similar in nature and scope to those described in this RFP and provided within the last three (3) years from the date this RFP was posted to IPRO. The list should provide each reference’s company or government entity name, address, phone number, fax number and a current email address.

3.7 Award of Master Agreement(s)

Award shall be made by Category to the responsive responsible Offeror(s) with the highest number of total normalized points for the Technical Proposal evaluation and the Cost Proposal evaluation combined. The Lead State anticipates and may elect to award multiple Master Agreements per Category in accordance with Idaho Code § 67‐9211. If an Offeror receives less than five hundred (500) points in a given Category, the Offeror will not be eligible to receive an award for that Category. If the Lead State chooses to award multiple Master Agreements, awards shall be prioritized according to the highest scoring Proposals in each Category.

Notwithstanding Paragraph 13 of Attachment 6 ‐ Solicitation Instructions to Vendors, award of

Master Agreement(s) will be made without regard to any preference for Idaho suppliers.

Participating Entities, including the state of Idaho, may take local preferences into consideration when determining if they will enter into a Participating Addendum with a Contractor to which a Master Agreement has been awarded.

3.8 Notice of Intent to Award

After a final selection(s) is made, the Lead State will issue letters of intent‐to‐award to all responsive responsible Offerors.

3.9 Appeal Processes

Offerors are directed to Idaho Code Section 67‐9232, available at https://legislature.idaho.gov/statutesrules/idstat/title67/t67ch92/sect67‐9232/ for available appeal processes.

3.10 Terms and Conditions Governing Solicitation and Resulting Agreements

3.10.1 Solicitation. The solicitation consists of this RFP document, including all Attachments and Exhibits. In the event of any conflict, up to contract award, Attachment 6 ‐ Solicitation Instructions to Vendors shall take precedence over other terms and conditions, unless an exception is explicitly taken.

3.10.2 Master Agreement. The Master Agreement(s) awarded from this RFP will consist of the RFP document, including all Attachments and Exhibits, and the winning Offeror’s Proposal, in that order of precedence. In the event of any conflict, Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions will take precedence over Attachment 6 ‐ Solicitation Instructions to Vendors and Attachment 7 ‐ Lead State Standard Terms and Conditions.

3.10.3 Participating Addenda. Participating Entities, including the state of Idaho, may negotiate additional and/or different terms and conditions in a Participating Addendum, which will take precedence over the terms of the Master Agreement in the event of conflict.

Participating Entities may not negotiate the addition of services not contemplated by this RFP.

Section 4: Mandatory Administrative Response Requirements

4.1 (M) Signature Page All Proposals must be submitted with a state supplied Signature Page, attached separately in IPRO. For electronically submitted Proposals, submit a completed, scanned signature page.

4.2 (M) Include Completed Attachments The Technical Proposal must include a completed Attachment 4 – Company Information and Proposal Checklist and a completed Attachment 5 – Offeror Certification Form.

4.3 (M) Acknowledgement of Amendments If the RFP is amended, the Offeror must acknowledge each amendment with a signature on the acknowledgement form provided with each amendment. Failure to return a signed copy of each amendment acknowledgement form with the Proposal may result in the Proposal being found non‐responsive. IDAPA 38.05.01.52

4.4 (M) NASPO ValuePoint Master Agreement Statement of Compliance Offeror must include a statement in their Proposal that they have read and understand all of the terms and conditions as shown in the Master Agreement (Attachment A).

The NASPO ValuePoint Master Agreement(s) resulting from this RFP will constitute the final agreement except for negotiated terms and conditions specific to a Participating Entity’s Participating Addendum.

The Master Agreement will include, but not be limited to, the NASPO ValuePoint Standard Terms and Conditions in Attachment A and Lead State specific terms and conditions required to execute a master agreement, the Attachment B: Scope of Work and selected portions of the Offeror’s Proposal.

This section highlights particular terms and conditions of Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions, although Offeror will be bound to all the terms and conditions when executing a Master Agreement as shown in Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions.

4.5 (M) Insurance To be eligible for award, the Offeror agrees to acquire insurance from an insurance carrier or carriers licensed to conduct business in each Participating Entity’s state at the prescribed levels set forth in Section 21 of Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions. Describe your insurance or plans to obtain insurance satisfying the requirements in Section 21.

4.6 (M) NASPO ValuePoint Administrative Fee and Reporting Requirements To be eligible for award, the Offeror agrees to pay a NASPO ValuePoint administrative fee as specified in Section 6 of Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions. Moreover, specific summary and detailed usage reporting requirements are prescribed by Section 7 of Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions.

Offeror shall identify the person responsible for providing the mandatory usage reports. This information must be kept current during the contract period. The Contractor will be required to provide reporting contact within fifteen (15) business days of Master Agreement execution.

4.7 RESERVED

4.8 (M) Promotion of the NASPO ValuePoint Master Agreement Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions includes program provisions governing participation in the cooperative, reporting and payment of administrative fees, and marketing/education relating to the NASPO ValuePoint Cooperative Procurement Program. Technical and management evaluation factors may include evaluation of: the likely effectiveness of the Offeror’s promotion of the Master Agreement; the Offeror’s understanding of and approach to administration of and reporting under the Master Agreement; the risk that Offeror’s contractual obligations to other procurement cooperatives’ may impede achievement of the objectives of the ValuePoint cooperative procurement program, in which case awards could be…