PORFP Security Scorecard LABOR-FY2027-001 Final.pdf

Purchase Order Request for Proposals (PORFP) COTS Software Master Contract

Revised 090624 1

Section 1 –General Information

PORFP Number:

(eMMA BPM Number)

BPM057993

PORFP Type:

(Select one category from the drop-down list)

Fixed Price

Functional Area/s (FA) for this PORFP:

FA I – COTS Software FA II – Installation and Training Services FA III – Manufacturer's Software Maintenance

Note: FA II may not be purchased alone and may not exceed 49% of the PORFP value.

Manufacturer Name

(Enter one manufacturer only per PORFP)

Security Scorecard

Agencies must enter only one manufacturer and direct the PORFP only to those COTS Software Master Contractors authorized for that manufacturer. If the manufacturer is unknown, agencies may direct the PORFP to all Master Contractors.

Designated Small Business Reserve?(SBR):

No

PORFP Issue Date:

mm/dd/yyyy

7/16/2026 PROPOSAL DUE

DATE AND TIME:

7/27/2026 ; 9:00am

Place of Performance: Maryland Department of Labor 100 S. Charles Street, Tower I, Ste. 5000 Baltimore, MD 21201

Special Instructions: LIMITED TO MASTER CONTRACTORS Only Master Contractors that are awarded a contract under the Commercial Off-the-Shelf Software (COTS 2012), 060B2490021, are eligible to submit a bid in response to this secondary competition Purchase Order Request for Proposal (PORFP). A current Master Contractor under the named contract may submit an LOA with their bid to be considered for the award.

BID SUBMISSION INSTRUCTIONS

Purchase Order Request for Proposal (PORFP) responses will only be accepted through the State's eMaryland Marketplace Advantage (eMMA) e-Procurement system.

Instructions on how to submit proposals electronically can be found at, under Vendor Instruction:

https://mdprocurement.freshdesk.com/support/solutions

Purchase Order Request for Proposal (PORFP) responses will be https://mdprocurement.freshdesk.com/support/solutions

Revised 090624 2 accepted through e-mail to the Agency Point of Contact listed in Section 2.

1. All bids must be password protected by the bidder prior to submission.

2. Bidders must e-mail the password-protected bid to the Agency Point of Contact listed in Section 2.

3. DO NOT SEND PASSWORDS WITH BID E-MAIL.

4. The password must be e-mailed separately from the bid after the bid due date.

Questions Due (Closing) Date and Time:

7/21/2026 at 12:00 PM EDT Questions must be submitted in writing with the subject line, "Question for PORFP # BPM057993," and be submitted in writing via e-mail to the Agency Point of Contact listed in Section 2 no later than the date and time specified.

SPECIAL REQUIREMENTS

1. The Department reserves the right to purchase more or less than the specified quantity to the extent limited by funding.

Charges that are multiple years shall be provided at a per-year price.

2. Purchase new and unused software.

3. The Master Contractor shall not impose a restocking fee if an item is returned due to damage or incorrect product shipped.

4. The Master Contractor must provide the estimated ship date/lead time for each item listed in the PORFP.

5. Please allow for pricing provided in response to this PORFP to be valid for at least 90 days after the set due date above.

6. The Master Contractor must be an authorized reseller for the Manufacturer named in Section 1. The state reserves the right to request a Letter of Authorization (LOA) from the Manufacturer or Distributor.

7. The Master Contractor must include a screenshot of the Manufacturer's Suggested Retail Price (MSRP) with the bid.

8. Bids must be received by the due date and time listed in the solicitation. Bids that are not received by the due date and time will not be accepted.

9. A "No Bid" form must be completed and submitted by the bid due date and time if your firm elects not to bid.

10. Master Contractors must ensure that the proposed COTS software is virus free.

Revised 090624 3

11. Master Contractors shall furnish all agreements and terms and conditions the Master Contractor expects the State to sign or to be subject to in connection with or in order to use the products or to be provided under this PORFP. This includes physical copies of all agreements referenced and incorporated in primary documents, including but not limited to any software licensing agreement for any software proposed to be licensed to the State (e.g., EULA, Enterprise License Agreements, Professional Service agreement, Master Agreement) and any Acceptable Use Policy (AUP). The State is not bound to an agreement or any terms and conditions not provided in a Master Contractor’s Proposal and no action of the State, including but not limited to the use of any such software, shall be deemed to constitute acceptance of any such agreements or terms and conditions and any such agreement, terms or conditions are void ab initio and unenforceable against the State.

12. Software-as-a-Service (SaaS) Products and contracts are subject to the Additional Terms and Conditions specified in Attachment Y - Data Use Agreement.

Security Requirements (if applicable):

N/A

Invoicing Instructions:

Send invoices via email to Accounts Payable at dllr.accountspayable@maryland.gov.

An invoice not satisfying the requirements of a Proper Invoice (as defined at COMAR 21.06.09.01 and .02) cannot be processed for payment. To be considered a Proper Invoice, invoices must include the following information without error:

1) Contractor name and address;

2) Remittance address;

3) Federal taxpayer identification (FEIN) number, social security number, as appropriate;

4) Invoice period (i.e., the time period during which services covered by invoice were performed);

5) Invoice date;

6) Invoice number;

7) State-assigned Contract number;

8) State-assigned (Blanket) Purchase Order number(s);

9) Goods or services provided;

10) Amount due; and

11) Any additional documentation required by regulation or the Contract.

For items of work for which there is one-time pricing, those items shall be billed within 30 days of acceptance.

For items of work for which there is annual pricing, items shall be billed annually. The first year's invoice shall be billed within 30 days of contract start. Each additional year shall be billed on the anniversary of the first year's invoice.

mailto:dllr.accountspayable@maryland.gov

Revised 090624 4

Section 2 – Agency Point of Contact (POC) Information

Agency / Division Name: Maryland Department of Labor (MD Labor) / Office of Financial Regulation

Agency POC Name: Marvin Ramiro Agency POC Phone Number:

410-767-2874

Agency POC E-mail Address:

marvin.ramiro1@maryland.

gov

Agency POC Fax:

N/A

Agency POC Mailing Address:

100 S. Charles St, Tower I, Ste. 5000, Baltimore, MD 21201

Section 3 – Delivery Address / Work Site POC Information (if different from above)

Agency On-site Contact Name:

Michelle Denoncourt Agency On-site Phone Number:

410-230-

Agency On-site E-mail Address:

michelle.denoncourt@maryl and.gov

Agency On-site Fax:

N/A

Agency On-site Address: 100 S. Charles St, Tower I, Ste. 5000, Baltimore, MD 21201

Section 4 – Scope of Work

FA I – COTS Software

(Provide product specifications below. If some or all specifications are unknown, Master Contractors may propose products based on a detailed description in the

Business Need / Required Functionality field*) *Business Need / Required Functionality

The Maryland Department of Labor requires a SecurityScorecard subscription to support continuous third-party cybersecurity risk monitoring and management. The solution will provide MD Labor with visibility into the external security posture of vendors and other third parties within its portfolio, including security ratings, continuous monitoring, risk identification, and related third-party risk management capabilities. The procurement is required to maintain continuity of the existing SecurityScorecard services.

Product Name

Product

Description

Version

Release

Quantity of

Licenses

Due Date mm/dd/yyyy

1. SSCPLAT+1 Monitoring for Self+ up to X domains (swappable up to 10 times in any 12 months)Security Scorecard -

SSCPLAT+1

5 8/14/2026 – 8/13/2027

2. AVD AVD -

ENHANCEDILLUMIN

ATIONSecurity Scorecard - AVD

1 8/14/2026 – 8/13/2027

Revised 090624 5

3. SSCPLAT+1

Monitoring for Self+ up to X domains (swappable up to 10 times in any 12 months)Security Scorecard -

SSCPLAT+

57 8/14/2026 – 8/13/2027

4. SSCPLAT+1 Monitoring for Self+ up to X domains (swappable up to 10 times in any 12 months)Security Scorecard -

SSCPLAT+1

57 8/14/2027 – 8/13/2028

5. SSCPLAT+1 Monitoring for Self+ up to X domains (swappable up to 10 times in any 12 months)Security Scorecard -

SSCPLAT+1

5 8/14/2027 – 8/13/2028

6. AVD AVD -

ENHANCEDILLUMIN

ATIONSecurity Scorecard - AVD

1 8/14/2027 – 8/13/2028

FA II – Installation and Training Services (Provide a detailed description of required services and deliverables)

Installation / Training Services

Deliverables

Start Date mm/dd/yyyy

End Date

1.

2.

3.

(insert additional rows as needed)

FA III - Manufacturer's Software Warranty / Maintenance (Provide a detailed description of warranty / maintenance requirements and deliverables)

Warranty / Maintenance

Requirements

Deliverables

Start Date

End Date

1.

2.

3.

(insert additional rows as needed)

Section 5 – Evaluation Criteria

1. Conformance to scope of work

Revised 090624 6

2. Price

3.

(insert additional rows as needed)

Basis for Award Recommendation The agency Point of Contact listed in Section 2 will recommend the award to a responsive and responsible Master Contractor that provides the most advantageous offer considering the price and evaluation factors above. The agency Point of Contact will initiate and deliver a PO to the selected Master Contractor.

All awards from this PORFP shall comply with the requirements of COMAR 21.05.13.06.

NO BID NOTICE/VENDOR FEEDBACK FORM

To help us improve the quality of State solicitations and to make our procurement process more responsive and business-friendly, please provide comments and suggestions regarding this solicitation. Please return your comments with your response. If you have chosen not to respond to this solicitation, please e-mail or fax this completed form to the attention of the Agency Point of Contact listed in Section 2.

Title: Commercial Off-the-Shelf Software 2012 (COTS 2012) Solicitation No: 060B2490021

PORFP:

1. If you have chosen not to respond to this solicitation, please indicate the reason(s) below:

� Other commitments preclude our participation at this time.

� The subject of the solicitation is not something we ordinarily provide.

� We are inexperienced in the work/commodities required.

� Specifications are unclear, too restrictive, etc. (Explain in REMARKS section)

� The scope of work is beyond our present capacity.

� Doing business with the State is simply too complicated. (Explain in REMARKS section)

� We cannot be competitive. (Explain in REMARKS section)

� The time allotted for the completion of the Bid is insufficient.

� Prior State of Maryland contract experience was unprofitable or otherwise unsatisfactory. (Explain in REMARKS section)

� Other: _________________________________________________________

2. If you have submitted a response to this solicitation, but wish to offer suggestions or express concerns, please use the REMARKS section below.

REMARKS: _________________________________________________________________

Offeror Name: ________________________________ Date: _______________________

Contact Person: _________________________________ Phone (____) _____ - ________

Address: _________________________________________________________________

E-mail Address:____________________________________________________________