State of Missouri

OFFICE OF ADMINISTRATION

INFORMATION TECHNOLOGY SERVICES DIVISION

Request for Quotation (RFQ) for Motor Pool Management System

TARGET DATE AND TIME: July 8, 2025 AT 2:00 PM CENTRAL TIME Response may be submitted electronically through MissouriBUYS, powered by MOVERS, at https://missouribuys.mo.gov but may respond by email to the procurement officer listed below.

RFQ CONTACT INFORMATION:

PROCUREMENT OFFICER: Michelle Schuman

PHONE NO.: (573) 751-8830

EMAIL: Michelle.Schuman@oa.mo.gov See “RFQ Questions” in Section 1 for appropriate communications during the procurement process.

DELIVER SUPPLIES/SERVICES FREE ON BOARD (FOB) DESTINATION TO THE FOLLOWING ADDRESS:

Missouri Office of Administration Division of General Services 4720 Scruggs Station Road Jefferson City, MO 65109

ATTENTION:

1. After reviewing the Request for Quotation (RFQ), the vendor must complete and return Exhibit A, Bid Signature Page and all other necessary exhibits.

2. Due to lead times for obtaining the information needed to complete the various Business Compliance Exhibits herein as explained in the RFQ’s Vendor Response Exhibits, vendors are encouraged to IMMEDIATELY begin securing these verifications.

3. The vendor must be registered in MissouriBUYS, powered by MOVERS in a “Prospective” or “Spend Authorized” registration status to submit a response. The vendor must achieve “Approved” registration status in MissouriBUYS (WebProcure/Proactis) and “Spend Authorized” registration status in MissouriBUYS, powered by MOVERS to be considered for a contract award. Reference Section 5.

RFQ Organization:

RFQ Vendor Response Exhibits (Return these exhibits with the bid)

BUSINESS COMPLIANCE EXHIBITS

INTRODUCTION AND BACKGROUND INFORMATION SECTION

Introduction:

Purpose: This document constitutes a request for quotation for the provision of a cloud-based motor pool management system, as set forth herein by the Office of Administration – Information Technology Services Division, on behalf of the Office of Administration – General Services Division (hereinafter referred to as “department”).

Titles: Titles of paragraphs used herein are for the purpose of facilitating reference only and shall not be construed to infer a contractual construction of language.

RFQ Questions:

Procurement officer is Single Point of Contact for Solicitation: Vendors and their agents (including subcontractors, employees, consultants, or anyone else acting on their behalf) must direct all of their questions or comments regarding the RFQ, the evaluation, etc., to the procurement officer indicated on the first page of this RFQ. It is preferred that questions be emailed to the procurement officer.

Except as noted herein, vendors and their agents are instructed not to contact any other state employee regarding any of these matters during the solicitation and evaluation process. Inappropriate contacts are grounds for suspension and/or exclusion from specific procurements. Vendors can be sanctioned for unauthorized contact with any evaluator under 1 Code of State Regulation (CSR) 40-1.060(8)(G) and (H) available at http://www.sos.mo.gov/adrules/csr/csr.asp.

Vendor is Responsible for Asking Questions About the RFQ: It is the vendor’s responsibility to ask questions, request changes or clarifications, or otherwise advise the department if the vendor believes that any language, specifications, or requirements are: (1) ambiguous, (2) contradictory or arbitrary, (3) violate any state or federal law or regulation, (4) restrict or limit the requirements to a single source, or (5) restrict or limit the vendor’s ability to submit a response.

Vendor Question Deadline: Every attempt shall be made to ensure that the vendor receives an adequate and prompt response. However, in order to maintain a fair and equitable procurement process, all vendors will be advised, via the issuance of an amendment to the RFQ, of any relevant or pertinent information related to the procurement. All questions and issues should be submitted no later than five (5) calendar days prior to the bid end date and time of the bids. If not received prior to five (5) calendar days before the bid end date and time, the department may not be able to fully research and consider the respective questions or issues.

State’s Response to Vendor Questions: Upon the department’s consideration of questions and issues, if the department determines that changes are necessary, the resulting changes will be included in a subsequently issued RFQ amendment(s); absence of such response indicates that the questions and issues were considered but deemed unnecessary for a RFQ amendment. All vendors will be advised of any change to the RFQ’s language, specifications, or requirements by a formal amendment to the RFQ. There will be no posted written records of the questions/communications (i.e., formal question/answer document).

RFQ is State’s Only Official Position: The only official position of the State of Missouri shall be that which is contained in the RFQ and any amendments thereto.

Amendments:

If the Department determines that changes to the RFQ are necessary, the resulting changes will be included in a subsequently issued RFQ amendment(s) prior to the bid end date and time.

Glossary of Terms and Acronyms:

Whenever the following terms and acronyms appear in the RFQ document or any amendment thereto, the definitions or meanings described below shall apply.

General Glossary, Acronyms, and Abbreviations:

Agency and/or State Agency/Department means the statutory unit of state government in the State of Missouri for which the equipment, supplies, and/or services are being purchased. The department is also responsible for payment, unless otherwise specified herein. Note: The terms “department”, “state agency”, “state”, and “State of Missouri” are used interchangeably throughout the document and have the same meaning.

Amendment means a written, official modification to a solicitation or contract.

Attachment applies to all documents which are included with an RFQ to incorporate any informational data or requirements related to the performance requirements and/or specifications.

Procurement officer means the procurement staff member of the department.

Code of State Regulation (CSR) contains the current administrative rules of executive agencies of Missouri government. The regulations are arranged by department rather than by subject.

Contract means a legal and binding agreement between two or more competent parties, for a consideration for the procurement of equipment, supplies, and/or services.

Contractor means a supplier, bidder, person, or organization who is a successful vendor as a result of an RFQ and who enters into a contract.

Exhibit applies to forms which are included with an RFQ for the vendor to complete and submit with their response prior to the specified end date and time.

May means that a certain feature, component, or action is permissible, but not required.

Must means that a certain feature, component, or action is a mandatory condition.

Party refers to either the State of Missouri or the contractor as an entity that may enter into a contract pursuant to the terms herein.

Pricing Page(s) applies to the form(s) on which the vendor must state the price(s) applicable for the equipment, supplies, and/or services required in the RFQ. The pricing pages must be completed and submitted by the vendor with the response prior to the specified response end date and time.

Bid Target Date and Time and similar expressions mean the deadline required by the RFQ for the receipt of bids.

MOVERS Missouri Vital Enterprise Resource System - The Missouri ERP solution. This will be the new financial and human resource system to replace SAM II.

Purchase Order means the authorized document issued by the department to the contractor indicating descriptions, quantities, and agreed prices for products and/or services.

Reasonable, Necessary or Proper as used herein shall be interpreted solely by the State of Missouri.

Request For Quotation (RFQ) means the solicitation document issued by the department to potential vendors for the purchase of equipment, supplies, and/or services as described in the document. The definition includes the following sections: Introduction and Background Information; Scope of Work; Terms and Conditions (“terms and conditions” and “Terms and Conditions” are used interchangeably throughout the RFQ); General Contractual Requirements; and Vendor Submission, Evaluation, and Award Information Section; and the RFQ Vendor Response Exhibits, Attachments, and Amendments of the RFQ.

RSMo (Revised Statutes of Missouri) refers to the body of laws enacted by the Legislature which govern the operations of all agencies of the State of Missouri. Chapter 34 of the statutes is the primary chapter governing the operations of the department.

SAM II the State of Missouri's integrated financial, HR, and payroll system, incorporating functions like accounts payable, HR, and payroll processing for all state departments and agencies.

Shall has the same meaning as the word must.

Should means that a certain feature, component and/or action is desirable but not mandatory.

State collectively referring to the state government and/or the agencies thereof.

Supplier has the same meaning as the word, vendor.

Vendor means the supplier, bidder, person, or organization that responds to an RFQ by submitting a bid with prices to provide the equipment, supplies, and/or services as required in the RFQ document.

Accuracy of Background Information:

Although an attempt has been made to provide accurate and up-to-date information, the State of Missouri does not warrant or represent that the background information provided herein reflects all relationships or existing conditions related to this RFQ.

****END OF INTRODUCTION AND BACKGROUND INFORMATION SECTION****

SCOPE OF WORK SECTION

General Requirements:

The contractor shall provide a motor pool management system for the Division of General Services in accordance with the provisions and requirements stated herein and to the sole satisfaction of the department.

The Office of Administration Division of General Services (GS) requires a web-based, automated reservation control solution that dispatches fuel cards and keys for the state motor pool. This solution will automate the process to check in and check out vehicles. The solution must be an asset-centric enterprise fleet management software. The solution must offer the ability to capture and manage unlimited vehicle attributes and data.

The purpose of this RFQ is to implement an automated motor pool solution designed to reduce State Fleet’s asset costs by providing ways to track and manage motor pool reservations and driver qualifications, reduce personnel requirements for dispatching vehicles, and other asset-related information. The main function of the solution is to reduce asset costs through quick analysis of asset utilization, odometer data, and maintenance information. The solution will include hardware, software, and services, as specified herein.

Technical Requirements:

The automated motor pool solution shall consist of software and accompanying hardware with following core competencies and shall efficiently enable State Fleet to:

Operate in a cloud-based (Internet) environment.

Integrate and automate reservation, fuel card, and key dispatching capabilities for unattended operation of motor pool, and dispatch in and dispatch out of vehicles.

Manage vehicle profiles.

Manage fleet user profiles.

Distribute and centralize management of vehicles and fleet users across multiple sites with ability to manage its vehicles and users without having access to other sites’ vehicles and users unless authorized to do so.

Manage inter-relationships between users and vehicles.

Capture vehicle utilization data by types of usage.

Define vehicles and users by access groups, thereby preventing users from receiving a vehicle for which the user is not allowed to use based on State Fleet’s policies and rules.

Direct end-user involvement to reduce the burden on fleet services personnel by allowing users to make their own online reservations and to report mileage and other information for assigned vehicles.

Automated confirmation emails to users concerning the status of motor pool reservations.

Email reminders to users concerning near-due or overdue vehicle maintenance.

Enable online reporting of individual trips by drivers to eliminate paper-based reporting, inaccuracies of OA-required reporting, and provide instant availability of trip reports in case of audit.

Automatically update motor pool dashboards to push fleet data/metrics to a graphical display thereby relieving fleet staff from having to manually mine the data.

Access the solution’s hour-by-hour fleet utilization graph on the dashboard.

Access the solution’s Day-by-day fleet utilization reports.

Access the solution’s Vehicle-by-vehicle fleet utilization reports.

Access the solution’s Vehicle aging reports by miles and time.

Access the solution’s reporting across all modules at the location, single site, multi-site, and enterprise levels.

Access the solution’s user email tools allowing administrators to easily contact unique users.

Automatically verify that user is active employee authorized to use state vehicle with HR data integration.

Verify that user has a valid driver’s license with Department of Revenue data integration.

1) Daily Human Resources import file to validate that driver is an active employee.

2) Daily Department of Revenue Drivers’ License import file to validate that active employee (driver) has valid license and to initiate notification when status is other than ‘valid’.

3) System prevents dispatching of reservation and vehicle with driver whose license status is not ‘valid.’

Eliminate double-booking of vehicles.

Eliminate booking of vehicles that are blocked for maintenance or out of service.

Collect vehicle odometer readings with telematics integration.

Have online interaction with users: make reservation requests, confirmation of reservations; changes to reservations (modifications, cancellations, etc.).

Automate billing requirements with export file formatted to support SAMII and MOVERS.

1) In addition to the below current interfaces, the awarded vendor shall delete and add individual vehicle data either by an interface or scheduled uploads.

2) Below are examples from the Current Process for Interfaces with SAMII & other files that will also be required by the awarded vendor. The details regarding these interfaces will be provided upon award.

1. One-Way Billing Export SAMII: Motor Pool only, the new system will exclude Work Orders

2. One-Way Department of Revenue Interface: To check status of Employee License

3. One-Way Human Resource and Licensee Data Import File: Drivers' license status check. The system interfaces with Department of Revenue's Missouri Driver License System on a nightly basis to check license status. Vendor File - for SAMII Customer numbers

4. Agency and Organization interface: The system interfaces with SAMII and in the future with MOVERS (Oracle) with the agency and organization reference file on an annual basis to pull in Chart of Accounts (COA) Agency and Organization.:

5. Inter-Agency Customer Account interface: The system interfaces with SAMII and in the future with MOVERS (Oracle) with the customer account reference file on a nightly basis to pull in active customer accounts.

Access Management Requirements:

Services shall support SAML or OICD Connection for integration with the State’s identity and access management (IAM) tool single sign-on and multi-factor authentication.

Services that support both Workforce (State of Missouri Employees) will have separate URLs, connections, and database tables for managing roles and permissions for workforce user and citizens.

Workforce user information source of truth is the State of Missouri’s Active Directory.

IAM tool will authenticate the user to service specific roles and permissions for each user is managed independently by the application.

Citizen user information source of truth is IAM tool, for non PII data (first name, last name, email, phone number, and address).

No PII will be stored in the users IAM Profile.

Display the following information to the user at the time of check-out before the key and fuel card are released:

Reservation confirmation number Scheduled leaving date and time Scheduled returning date and time Current leaving date and time Vehicle type (e.g. SUV, Crossover, Light Duty Truck, Van, Sedan) Parking space Current odometer Vehicle’s year, color, make, model Fuel level License tag Optional equipment on the vehicle Vehicle’s conditions such as fuel tank level, last service, last car wash Provide the capability of a printed trip ticket at the automated motor pool solution system upon check-out with the same information listed above.

Automated telematics integration to capture accurate odometers without human intervention.

Allow the user to cancel a reservation at the kiosk.

Provide the option to allow an authorized user to return the keys and fuel card to a vehicle.

Provide the ability for the user to provide comments about the vehicle, the reservation, etc. to the administrator from the kiosk.

Access the user’s reservations, once the user logs in, which shall be immediately available for dispatching and key and fuel card disbursement.

Reduce or eliminate paper-based forms and processes.

Determine correct number of vehicles to accomplish mission.

Determine correct composition of vehicles to accomplish mission.

Provide accurate projections of future vehicle usage.

Provide accurate reports of past vehicle usage.

Eliminate double-booking of vehicles, thereby reducing the frustration of users and staff and the extra work to procure additional vehicles.

Automate the scheduling and tracking of vehicle inspections.

Track vehicle damages to the offending individual and charge back to the offending organization or individual.

Provide pertinent reports in a timely manner

1) Vehicle Usage Report:

1. Daily/Weekly/Monthly vehicle usage summary by location, by user, by type of vehicle.

2. Mileage reports tracking total miles driven per vehicle (Ad hoc).

3. Vehicle reservation details including dates, times, purpose of travel, destination and driver information (Ad hoc).

4. Over/Underutilized vehicles (Ad hoc).

2) Maintenance Reports:

1. Vehicles scheduled for maintenance including scheduled maintenance dates (Ad hoc).

2. Vehicles projected for maintenance in less than a month (Ad hoc).

Provide all levels of the organization with accurate, up-to-the-minute information.

Software Requirements:

A web-based, automated reservation control solution that dispatches fuel cards and keys for the state motor pool. This solution will automate the process to check in and check out vehicles.

Kiosk software for the kiosk(s) to provide security and user interface management.

Motor Pool/Car Sharing module for at least 120 vehicles, initially, with the potential to add incrementally as needed. The motor pool module should allow users to quickly and effortlessly reserve vehicles 24 hours a day via the Internet. The module must have a calendar screen that graphically displays the status of the vehicles and reservations to provide the manager with an overview of the fleet. The module must have utilization reports to assist in right-sizing the motor pools.

Hardware Requirements:

The vendor shall provide the motor pool control solution. The vendor shall also provide at least 120 sets of fuel cards and keys, initially, with the potential to add incrementally as needed. Next to the motor pool control solution, there must be one all-in-one, wall-mounted, touchscreen kiosk that will act as a user-friendly interface for the drivers.

Services Requirements:

Site set-up: Provide State Fleet with templates to collect data for vehicles, users, departments, account codes, etc. Create a website dedicated to the State of Missouri. Vendor must have a process of uploading new data from an external source such as a spreadsheet or database into the motor pool management system to update vehicle information, user details, customer accounts, or other relevant data within the motor pool management solution. Vendor will import that data and work with State Fleet personnel to configure the site appropriately.

Training: Using web-conferencing tools, vendor will instruct up to 8 State Fleet representatives on the administrative operation of the application.

Hosting: The automated reservation software will be hosted by the vendor. Vendor will be responsible for providing the hardware platform, operating system, SQL software and the local administrative support for the operating system, the SQL software, the hardware, and data backup. Vendor will also supply the SSL certificates and provide personnel that can apply any software updates.

Comprehensive Technical Support for Software and Fuel Card and Key Motor Pool Hardware: Vendor will provide e-mail and telephone support. Support is offered Monday through Friday 7:00 a.m. to 7:00 p.m. Eastern Standard Time, exclusive of federal holidays, with an eight (8) hour response time. All support requests to vendor personnel will be directed through one of the following State Fleet contacts: FleetManagement@oa.mo.gov or an authorized Fleet Management team members (names and contact information to be provided upon award).

Software Maintenance: Vendor will provide State Fleet with any patches, updates, releases, and versions of the application modules (including appropriate documentation) for which the State Fleet has purchased and is licensed.

Performance Requirements:

Estimated Quantities: The quantities indicated in this RFQ are estimates that pertain to the total aggregate quantities that may be ordered throughout the stated contract period. The estimates do not indicate single order amounts unless otherwise stated. Unless otherwise specified herein, the State of Missouri makes no guarantees about single order quantities or total aggregate order quantities.

Substitutions: The contractor shall not substitute any item(s) that has been awarded to the contractor without the prior written approval of the Department.

In the event an item becomes unavailable, the contractor shall provide a suitable substitute item. The contractor’s failure to provide an acceptable substitute may result in cancellation or termination of the contract.

Any item substitution must be a replacement of the contracted item with a product of equal or better capabilities and quality, and with equal or lower pricing. The contractor shall understand that the state reserves the right to allow the substitution of any new or different product/system offered by the contractor. The Department shall be the final authority as to acceptability of any proposed substitution.

Any item substitution shall require a formal contract amendment authorized by the Department prior to the state acquiring the substitute item under the contract.

The state may choose not to compel an item substitution in the event requiring a substitution would be deemed unreasonable in the sole opinion of the State of Missouri. The contractor shall not be relieved of substituting a product in the event of manufacturer discontinuation or other reason simply for reasons of unprofitability to the contractor.

Replacement of Damaged Product: The contractor shall repair or replace any item or components received in damaged condition at no cost to the State of Missouri. This includes all delivery/transportation costs for returning non-functional items to the contractor for replacement.

Requirements Traceability Matrix (RTM): The contractor shall identify and document business requirements and traceability of requirements to the implemented solution. The contractor shall provide a Requirements Traceability Matrix (RTM), Attachment 1, for the state agency review and approval using approved state agency templates.

Project Management: The contractor shall provide and maintain a Project Management Plan and Project Schedule through the life of the contract by providing detailed milestones, tasks, and resource assignments for the project. Before commencing project work, the contractor shall obtain the Project Management Plan approval from the Office of Administration, General Services, Fleet Project Director, the Missouri Information Technology Services Division, Enterprise Information Technology Technical Review Team, and the Project Manager. The contractor shall provide weekly updates of tasks completed and comparisons of actual project progress to planned, reflecting the delivery, review, approval, and acceptance of deliverables as milestones in the Project Management Plan. A Weekly ITSD Project Status Report, Attachment 2, is attached for use during the weekly status meeting.

The Project Management Plan shall serve as the definition and foundation of the goals and objectives, the work to be completed, and the project management approach, including:

The goals, objectives, and success criteria;

The implementation and project scope;

The resource management approach, includes key stakeholders and project team members;

The planned project work and schedule are based on a work breakdown structure to define the high-level project phases, milestones, tasks, dependencies, durations, resources, and deliverables.

Disaster Recovery:

Planning Requirements

The contractor must create and maintain a comprehensive Disaster Recovery Plan for the contractor’s environments.

Testing Requirements

The contractor must provide a solution to conduct regular tests to ensure a successful restoration. Regular checking of backups and restore procedures must ensure a smooth recovery.

The contractor must successfully test the Disaster Recovery Plan annually.

Execution Requirements

The contractor must notify the state of situations that may escalate to disasters based on parameters defined in the Disaster Recovery Plan.

The contractor must execute the Disaster Recovery Plan including the restoration of normal services in accordance with the contractor’s documentation.

The contractor must conduct a post-disaster root cause analysis to identify the cause of the disaster, and to identify actions to eliminate or mitigate future occurrences. The contractor must share its root cause analysis upon request from the state. The documentation provided regarding the contractor’s post-disaster root cause analysis will be considered pursuant to the Missouri Sunshine Law.

Cloud:

Solution Hosting Requirements:

Cloud Hosting Services: The contractor shall provision its solution project initiation and provide continuous service for the pre-production (development) and production infrastructure required for the management and operation of the solution and other applications and technology enabler tools included in the contract. The contractor shall provide a platform with sufficient capacity to handle the state’s needs and maintained all service levels pursuant to the committed Service Level Agreement (SLA) provided by the contractor during the term of the contract.

The solution platform provided by the contractor shall include all needed hardware, storage for data and attachments, system software, relational database management system software, development tools, and responsibility for any third-party licenses for all production and non-production technical environments for the solution (including all desirable and/or third-party software) during the project implementation and once the solution has been implemented and utilized in production.

The State is seeking a cloud- or contractor-hosted solution. The contractor-hosted solution must be hosted in on of the following environments:

Contractor’s data centers;

Contractor provided data centers of a qualified third-party provider; or State provided data centers of a qualified third-party provider.

The solution must be hosted in an environment that is either currently SOC 2 Type 2 compliant or will be SOC 2 Type compliant by the time the solution goes live and in production for the state or Federal Risk and Authorization management Program (FedRAMP) Moderate impact level certified or will be FedRAMP Moderate impact level certified by the time the solution goes live and in production for the state. The solution’s hosting environment must maintain SOC 2 Type compliance or FedRAMP Moderate impact level certified while the solution is in production and utilized by the state.

The contractor must provide the state, upon request, with a copy of an audit report to support the hosting environment’s compliance with SOC 2 Type 2 or FedRAMP Moderate impact level. The SOC 2 Type 2 or FedRAMP Moderate impact level audit report will be held confidential by the state pursuant to section 610.021 (14) and (21), RSMo.

The contractor must furnish to the state, upon request, the results of all periodic and ad hoc security scans, penetration tests, and other security assessments conducted in compliance with NIST 800-53 or similar standards.

The contractor must employ a proven, security-aware software methodology (e.g. Microsoft Security Development Lifecycle).

The contractor shall provide communications from the hosting site to the public internet for state accessibility. The state will provide internet access for the state’s locations and state’s authorized users unless otherwise agreed to by the parties. The hosting site must not be located outside the continental United States.

The solution should be hosted in the Cloud by Amazon Web Services, Microsoft Azure, or Google Cloud. These three providers are identified in the Leaders Quadrant in the July 2023 “Magic Quadrant for Cloud Infrastructure, Worldwide” published by Gartner. Solutions not utilizing Amazon Web Services, Microsoft Azure or Google Cloud are allowed as long as they meet or exceed all mandatory solution Hosting Services requirements and specifications identified herein.

Information Ownership Requirements:

All cloud and hosting services must adhere to the following Information Ownership standards and specifications:

The state shall be the sole owner of all information input into the system by the state, along with all information derived as a result of the state’s data input.

The contractor’s personnel and subcontractor personnel shall not access state information in the solution except as required to provide the service, to provide technical support for the service, verify service break-fix, or in response to the state’s instructions.

The contractor’s personnel and subcontractor personnel shall be bound by a non-disclosure agreement protecting the state information.

Cyber Security: All suppliers offering Information Technology Services to the State of Missouri must comply with the standards below. These standards apply whether the solution is managed by the State of Missouri or Supplier managed (e.g., either cloud or on premise).

Policies and Procedures:

All supplier Information Technology systems or services offered to the State of Missouri must comply with NIST 800-53 or ISO27001 standards as well as any regulatory requirements to which the systems or services of the State of Missouri must comply.

Additionally, the supplier must internally adopt and comply with NIST 800.53 or ISO27001 standards. The supplier must demonstrate this to the State of Missouri by providing a list of titles of the cyber security policies currently in use. If the supplier has achieved a SOC 2 Type 2 Certification, ISO27001/2 Certification, or FedRamp/StateRamp certification, then that may also be submitted as evidence.

All supplier solutions must meet regulatory federal and state requirements as required by the solution.

Access Management:

In addition to the supplier’s Internal Access Management complying to NIST 800.53 controls, the supplier must provide multi-factor authentication for their employee remote access to all internal and cloud based systems.

Network Architecture:

All supplier solutions must provide industry-best practice protection against cyber threats, including the use of advanced tools such as Advanced Firewall stacks, Web Application Firewalls, Intrusion Prevention appliances, advanced end-point protection agents, and advanced threat correlation and incident response systems.

All supplier applications must be mitigated against the OWASP top 10 vulnerabilities.

All solutions must meet vulnerability and patch management/mitigation requirements.

The supplier must encrypt all State of Missouri sensitive information stored on servers (at rest) and while in transit.

System log retention must meet State of Missouri regulatory requirements.

The supplier must provide a solution for monitoring log data in order to meet State of Missouri regulatory requirements.

Security Clearance Background Checks:

At least ten (10) business days prior to each individual contractor providing services under this contract, the contractor shall require the employee to submit to a fingerprint-based background check/criminal records screening (“background check”) through the Missouri State Highway Patrol. For out of state submissions, this is out of the state’s control and may take up to six (6) weeks for approval.

Information on how to obtain a background check is available on the Missouri State Highway Patrol’s website at: http://www.mshp.dps.missouri.gov/MSHPWeb/PatrolDivisions/CRID/crimRecChk.html.

The contractor should contact the Office of Administration, Information Technology Services Division (ITSD) Enterprise project Management Office (EPMO) for the correct forms and information required for requesting a background check.

The contractor shall be responsible for all costs associated with background checks of its employees.

Prior to proceeding with the background check process, the contractor shall obtain from each employee a signed Missouri Applicant Fingerprint Privacy Notice, Contractor Agreement form. The contractor shall submit the signed forms to: ITSD.Contractor@oa.mo.gov.

Any contract award shall be contingent upon the contractor’s submission of the required forms within the above referenced timeframe. Failure to submit these forms on time may result in the withdrawal of the award.

The contractor understands and shall notify its employees that the Office of Administration, (ITSD-EPMO) participates in the Missouri Rap Back and National Rap Back programs pursuant to section 43.540, RSMo; as such, Missouri State Highway Patrol, Central Records Repository, and the Federal Bureau of Investigation will retain the fingerprints submitted by each of the contractor’s employees, and those fingerprints will be searched against other fingerprints on file, including latent fingerprints. While retained, an employee’s fingerprints may continue to be compared against other fingerprints submitted or retained by the Federal Bureau of Investigation, including latent fingerprints.

The contractor understands and shall notify its employees that the Missouri State Highway Patrol will provide the results of the employee’s background check directly to the ITSD-EPMO. The ITSD-EPMO shall not release the results of a background check to the contractor or provide the contractor any information obtained from a background check, either verbally or in writing.

After the results of the fingerprint-based checks become available, the Office of Administration, ITSD-EPMO, shall conduct an individualized assessment of each employee’s results, considering the nature of the position, including the access the employee would have, the seriousness of the offense, and how long ago the offense was committed. Available information about the employee’s behavior, including conduct underlying any arrest Before providing services to the state agency, the contractor shall obtain background checks, in accordance with Section 43.540, RSMo from the Missouri State Highway Patrol and Federal Bureau of Investigations, or equivalent if staff are located out of state, on each of the contractor and subcontractor staff assigned to the contract, and recurring on an annual basis and as requested by the state agency.

The contractor shall be responsible for all costs associated with obtaining the required background checks.

Upon award, the contractor must provide a list of proposed resources along with their resumes.

The contractor shall understand and agree that the state agency reserves the right to require the removal of any staff working on this contract. The state agency will provide written notification of contractor staff performance-related issues to the contractor. The contractor shall either immediately cure performance-related problems or provide a prompt replacement.

Warranty Requirements:

All products and equipment should carry a minimum industry standard manufacturer’s warranty that includes materials and labor.

Maintenance/Support Requirements:

The Maximum Tolerable Downtime (MTD) shall be <24 hours, with a Recovery Time Objective of at most 16-24 hours.

The vendor shall configure and support the application and hardware.

The vendor shall provide and manage security updates for the application and hardware.

Office of Administration Fleet will provide and manage User Accounts.

Installation Requirements:

The state will be responsible for installing the hardware and providing connectivity. The installation will be performed with OA/ITSD and OA/FMDC assistance. The vendor shall provide guidance to facilitate the state’s support of the online hardware.

The key box and KIOSK shall be installed on an interior wall of the building at the entrance to the OA Carpool Fleet Lot located at 4720 SCRUGGS STATION ROAD, JEFFERSON CITY, MO 65109. The contractor shall provide detailed information and specifications as to how their equipment is to be installed.

Installation Content Requirements:

Detailed Instructions: Provide detailed written, visual, and data instructions in the guide, including step-by-step instructions for each phase of the installation process.

Clear Visuals: Provide illustrations to support the written instructions, making the guide easier to understand.

Troubleshooting: Include a section dedicated to common installation problems and their solutions, helping to minimize downtime.

Safety Precautions: Include safety protocols and outline any specific requirements for handling equipment or materials.

Component Identification: Provide clear identification of all components, including requirements for handling equipment or materials.

Maintenance Procedures: Include guidance on routine maintenance and preventative measures, ensuring the long-term performance of the installed system.

Warranty Information: Include Guidance on routine maintenance and preventative measures, ensuring the long-term performance of the installed system.

Glossary: Include a glossary of terms relevant to the installation process.

Installation Format and Delivery:

Digital: Provide guide in a digital format (e.g., PDF).

File Format: PDF and Word document are an acceptable file format for digital guides.

Language: Required language for the guide is English.

Delivery Method: The guide should be delivered as an electronic download one month prior to scheduled hardware and software installation.

Accessibility: Consider accessibility requirements for individuals with disabilities and ensure the guide is designed to be user-friendly.

Installation Usage and Post-Installation:

Post-Installation Support: Define provider support after the installation is complete, including any access to the installation guide for future reference.

Provide updates and revisions to the guide as needed to reflect changes in the system or technology.

Training: Supplier must provide On-site training and/or Web-based training for System Admin Users. Supplier may provide additional options for Web-conferencing training and/or Online training for users.

On-site training during implementation for system admin users (fewer than 10).

Web-based training during implementation for system admin users (fewer than 10).

Using web-conferencing tools, vendor will instruct up to 8 State Fleet representatives on the administrative operation of the application.

Online training for users (drivers). Provide ongoing training resources/online workshops/users’ guide.

State Data:

State Data Location: All data associated with the solution/service shall only be hosted, stored, and accessed within the United States.

Ownership: The state’s electronic data or information submitted by the state or its authorized users with authorized access to the solution/service shall be considered “State Data” for ownership purposes of the contract, as the state serves as either the owner or curator of the data submitted in the solution/service. “State Data” shall include: (a) the state’s data collected, used, processed, stored, or generated as the result of the Services; (b) personally identifiable information (“PII”) collected, used, processed, stored, or generated as the result of the services, including, without limitation, any information that identifies an individual, such as an individual’s social security number or other government-issued identification number, date of birth, address, telephone number, biometric data, mother’s maiden name, email address, credit card information, or an individual’s name in combination with any other of the elements listed herein; and (c) protected health information (“PHI”) as that term is defined under the Privacy Rule, 45 Code of Federal Regulations (CFR) §160.103. State data is and shall remain the sole and exclusive property of the state and all right, title, and interest in the same is reserved by the state.

“State Data” stored in the software and services being provided as a result of the contract shall also be known and treated by the contractor as confidential information in accordance with the contract, applicable contractor’s documentation, and applicable law.

Contractor Use of State Data: The contractor shall: (a) keep and maintain state data in strict confidence, using such degree of care as is appropriate and consistent with its obligations as further described in the contract and applicable law to avoid unauthorized access, use, disclosure, or loss; (b) use and disclose state data solely and exclusively for the purpose of providing the services, such use and disclosure being in accordance with the contract, any applicable Statement of Work, and applicable law; (c) not use, sell, rent, transfer, distribute, or otherwise disclose or make available state data for contractor’s own purposes or for the benefit of anyone other than the state without the state’s prior written consent; and, (d) not provide state data to any third party without the express written permission of the state. “…for the purpose of providing the services” as referenced above includes the right of the contractor to use state data to prevent or address service or technical problems, and verify service improvements, in accordance with the contract and the solution’s documentation, or in accordance with the state’s instructions.

Records: The contractor must maintain financial and accounting records and evidence pertaining to the contract in accordance with accepted standard accounting principles or International Financial Reporting Standards (IFRS).

Once annually, or otherwise as reasonably required by the state, the contractor shall make all such records, books, and other documents relevant to the contract available to the state, its designees, and the Missouri State Auditor in a commercially reasonable format acceptable to the state at all reasonable times during the term of the contract and for three (3) years after the cancellation, expiration, or termination of the contract or for any longer period of time required by law. The state will provide a minimum of fourteen (14) calendar days’ notice and will coordinate with the contractor regarding the scope of the audit.

The contractor shall permit the Missouri State Auditor’s Office, federal auditors and authorized representatives of the State of Missouri to perform an independent audit or examine, copy, or investigate any of the contractor’s records, procedures, books, documents, papers, and records recording receipts and disbursements of any of the funds paid to the contractor only for services performed under the contract. Failure to retain adequate documentation for any service billed may result in recovery of payments for services not adequately documented. Any audit exception noted by auditors shall not be paid by the state and shall be the sole responsibility of the contractor. However, the contractor may contest any such exception by any legal procedure.

The state shall not designate any individual, entity, or firm to conduct the audit that is a competitor of the contractor. Any audit conducted or records reviewed under this provision shall be limited to services provided to State of Missouri and shall not require the contractor to disclose information pertaining to any other customer or client of the contractor.

The services required herein are not intended to be an audit, examination, attestation, special report or agreed-upon procedures engagements as those services are defined in the American Institute of Certified Public Accounts (AICPA) literature applicable to such engagements conducted by independent auditors. Accordingly, these services shall not result in the issuance of a written communication to third parties by the contractor directly reporting on financial data or internal control or expressing a conclusion or any other form of assurance. The contractor shall maintain a copy of the work products for documentation purposes for the AICPA.

Electronic Funds Transfer, Invoicing, and Payment Requirements:

Electronic Funds Transfer (EFT): The State of Missouri will submit contract payments to the contractor at the remittance address listed in the contractor’s MissouriBUYS (WebProcure/Proactis) vendor registration. However, the contractor understands and agrees the state reserves the right to make contract payments to the contractor through electronic funds transfer (EFT). Therefore, prior to any payments becoming due under the contract, the contractor must verify and update, if applicable, their vendor registration with their current remittance address and ACH-EFT payment information at https://MissouriBUYS.mo.gov.

Invoicing: The contractor shall submit invoices for Support and Maintenance annually and Hosting Fees monthly. The contractor shall perform the services prior to invoicing the department.

Invoice Detail Billing: Vendor shall provide Invoice Detail by Customer Account to provide totals as well as individual reservation. Individual reservation information should include rental trip number, pickup/return date and time, driver name, destination, billable days, billable miles, additional charges, adjustments and total trip charges.

The contractor shall invoice the department on the contractor’s original descriptive business invoice form and submit the invoice to the address on the front page of this document / the following address:

Office of Administration Information Technology Services Division P.O. Box 809 Jefferson City, MO 65102

The contractor shall use uniquely identifiable invoice numbers to distinguish an invoice from a previously submitted invoice and shall include on the invoice the remittance address listed in the contractor’s MissouriBUYS (WebProcure/Proactis) vendor registration.

Each contractor invoice must be on the contractor’s original descriptive business invoice form and must contain a unique invoice number and the remittance address included in the contractor’s MissouriBUYS (WebProcure/Proactis) vendor registration. The invoice number will be listed on the state’s EFT addendum record to enable the contractor to properly apply state payments to invoices. The contractor must comply with all other invoicing requirements stated in the RFQ.

The statewide financial management system has been designed to capture certain receipt and payment information. For each purchase order received, an invoice must be submitted that references the purchase order number and should be itemized in accordance with items listed on the purchase order. Failure to comply with this requirement may delay processing of invoices for payment.

The contractor shall not invoice federal or state taxes unless otherwise required under law or regulation.

Payment:

Payments are due upon receipt of a valid invoice, payable in 30 calendar days. All invoices for equipment, supplies, and/or services purchased by the State of Missouri shall be subject to late payment charges as provided in section 34.055, RSMo.

The State of Missouri does not pay state or federal taxes unless otherwise required under law or regulation.

The State of Missouri assumes no obligation for equipment,…