PRF73 Q and A Final 11.22.19.xlsx
XLSX spreadsheet 19 KB Posted
- Contract number
- PRF73
- Issued by
- Massachusetts
About this file
The document is a Question and Answer (Q&A) file for PRF73, a statewide contract for Cyber and Data Security services issued by the Commonwealth of Massachusetts. The file contains communications between potential vendors such as Berry, Dunn, McNeil & Parker LLC, Carahsoft Technology Corporation, Guidehouse LLP, MCI Communications Services (Verizon), and JANUS Software, and the state's procurement management team (PMT) regarding the contract's specifications and requirements.
The contract covers cybersecurity services including audit, compliance, incident response, and Payment Card Industry (PCI) compliance services, with an open enrollment process that allows new vendors to submit bids over a five-year period. Key contract features include providing services for multiple simultaneous engagements across state departments, municipalities, local governments, and state authorities. The contract has specific compliance framework requirements spanning standards like NIST, HIPAA, ISO 27001, and others. There is a mandatory supplier diversity component requiring bidders to commit to spending a percentage of contract sales with certified minority, women-owned, veteran-owned, and other diverse businesses. The contract will address various cybersecurity needs such as secure mobile infrastructure, threat detection, and security event management, with potential additional points awarded for value-added services like operating a 24/7 Security Operations Center.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Contract%20User%20Guide%20PRF73DesignatedCTR_12.18.24.pdf | ||
| PRF73 eppform_1.docx | DOCX document | |
| StandardContractForm.docx | DOCX document | |
| Contract User Guide PRF73DesignatedCTR_12.18.24..docx | DOCX document | |
| Contractor Authorized Signatory Listing~1.docx | DOCX document | |
| PRF73 RFR PCI Data security and IR Cost Response Template 11.1.19.docx | DOCX document | |
| prompt-pay-frm~17.doc | DOC document | |
| sdp-plan-form-1-commitment~32.docx | DOCX document | |
| PRF73_PCI_Quote_Form_SOW~1.doc | DOC document | |
| PRF73 RFR Amended 11.4.19.docx | DOCX document | |
| StandardContractForm_Instructions.pdf | ||
| newmass-w9~18.doc | DOC document |
Show all 12
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
PRF73 Q&A
| Question # | Created Date | User Created | Question Subject | Question | Answers |
| 1 | 11/8/19 | Maret Freeman/Berry, Dunn, McNeil & Parker LLC (not on cc) | Procurement Scope and Description | Will this statewide contract take precedence over ITS-74 and the cybersecurity services offered under that contract? Could the PMT offer any guidance on how PRF-73 and ITS-74 will be used by state agencies and eligible entities? | PRF73 is specifically a Cyber and Data Security contract. However, there is some overlap between PRF73 and ITS74 with regard to cybersecurity and we will leave it up to Eligible Entities to determine which Statewide Contract is most appropriate. PRF73 will take precedence for audit, compliance, incident response and payment card industry (PCI) compliance services. |
| 2 | 11/8/19 | Maret Freeman/Berry, Dunn, McNeil & Parker LLC (not on cc) | RFR Response Template, A-5 | Are ?concurrent material engagements? any project or contract that we are currently providing similar services through, or any project or contract that a consultant who might be assigned work under PRF-73 is assigned to? | Yes. We need to ensure that the bidder has the ability to provide services for multiple simultaneous engagements to Eligible Entities. A-5. "Provide a listing of the Bidder’s concurrent material engagements, as well as its current outstanding proposals or bids that could impact the available resources or the provision of concurrent service to multiple Eligible Entities across the Commonwealth. Bidder must be able to certify that the key personnel assigned to this contract will be assigned to Eligible Entity engagements and that the Bidder has the capacity and resources to provide concurrent services to multiple Eligible Entities across the Commonwealth. Bidders must identify in this section if the Bidder seeks to provide services primarily to state department Eligible Entities, or municipalities and local government, or state authorities or to all Eligible Entities." |
| 3 | 11/8/19 | Maret Freeman/Berry, Dunn, McNeil & Parker LLC (not on cc) | A. 9.b. Adding Contractors | Will the open enrollment procurement process include requesting and evaluating new proposals? The 5 year minimum requirements may prevent us from proposing on some categories in the initial RFR, but we will have the experience required in subsequent years. | Yes. Open enrollment will allow new vendors to submit future bids for evaluation. It will also allow current vendors to submit bids for categories they are currently not authorized for. PCI- minimum will be 5 years. Non-PCI vendors demonstrating, exceptional skills may receive consideration. |
| 4 | 11/15/19 | Colby Bender/Carahsoft Technology Corporation | PCI COUNCIL APPROVED QUALITY SECURITY ASSESSORS (QSAS) AND RELATED QSA CONSULTING SERVICES. | What additional compliance frameworks outside of PCI does the commonwealth have to align to? | It will depend on each department's standard Data Security Standards (NIST, FERPA, HIPAA, OMB, HITRUST, COPPA, COBIT/ITIL, ISO 27001/27002, SOC, SOC1, SOC2, CIS). |
| 5 | 11/15/19 | Colby Bender/Carahsoft Technology Corporation | PCI COUNCIL APPROVED QUALITY SECURITY ASSESSORS (QSAS) AND RELATED QSA CONSULTING SERVICES. | Will the commonwealth provide authorization from any third party hosting providers for security testing? | A firm may complete performance with the use of subcontractors, provided that the selected Statewide Contractor remains fully responsible for managing and ensuring qualify performance under the Contract. All subcontractor work will be billed through the Bidder as Primary Contractor under the Primary Contractor’s Tax ID. The Commonwealth will not entertain “joint” bids. Eligible Entities may contract solely with Contractors approved under the Statewide Contract and may not enter into direct relationships with named subcontractors. |
| 6 | 11/15/19 | Colby Bender/Carahsoft Technology Corporation | III. Non-PCI Cyber and Data Security, Audit, Compliance, Cyber Readiness Services | Can you please expand on the expected deliverable for "secure mobile infrastructure"? | To secure any mobile devices such as cell phones, tablets and laptops and certify that they are free from infection. |
| 7 | 11/15/19 | Colby Bender/Carahsoft Technology Corporation | PCI COUNCIL APPROVED QUALITY SECURITY ASSESSORS (QSAS) AND RELATED QSA CONSULTING SERVICES. | How many specific merchant IDs does the commonwealth have? | Under the statewide Card Processing and Payment Solutions contracts, the Commonwealth of Massachusetts has approximately 357 direct MIDs and 45 MIDs under a Payfac. Other Eligible Entities that do not leverage the statewide payments contracts may also have MIDs. |
| 8 | 11/15/19 | Colby Bender/Carahsoft Technology Corporation | PCI COUNCIL APPROVED QUALITY SECURITY ASSESSORS (QSAS) AND RELATED QSA CONSULTING SERVICES. | What are the different merchant levels within the commonwealth? | There are a small number of Level 1 merchants. The majority of merchants are Level 3 and 4. |
| 9 | 11/15/19 | Colby Bender/Carahsoft Technology Corporation | PCI COUNCIL APPROVED QUALITY SECURITY ASSESSORS (QSAS) AND RELATED QSA CONSULTING SERVICES. | How many entities within the commonwealth are required to complete a ROC annually? | Presently, three. |
| 10 | 11/15/19 | Colby Bender/Carahsoft Technology Corporation | PCI COUNCIL APPROVED QUALITY SECURITY ASSESSORS (QSAS) AND RELATED QSA CONSULTING SERVICES. | How many entities within the commonwealth complete an SAQ annually? | The joint CTR/ITD Payment Collection Data Security Policy (issued in 2013) requires all entities accepting electronic payments to complete a SAQ or ROC annually. Under the Statewide eRevenue contracts, approximately 90 programs are in production and 7 in development at this time. Most higher education institutions have PCI compliance requirements but do not leverage the statewide card processing and payment solutions contracts. |
| 11 | 11/15/19 | Nini Donovan/Guidehouse LLP | Key personnel | In Section B-4, f), are the certifications in reference to our key personnel highlighted in the bid, or of the personnel in our entire company? Should the response be stated as the number of personnel with the certification, a listing of personnel with the certification, or in another format? | Both are relevant but must for key personnel |
| 12 | 11/15/19 | Nini Donovan/Guidehouse LLP | Forms | Vendors are required to electronically submit an ?Additional Environmentally Preferable Products/Practices?. Is there a form associated with this or will a PDF of how the vendor plans to be environmentally conscious suffice? | See Attached PRF73 EPP Form. |
| 13 | 11/15/19 | Nini Donovan/Guidehouse LLP | Forms | In a few places, it states that a wet signature is needed for a few forms after the contract is executed but in the table on page 32 of the RFP, it states a wet signature is required. Can you confirm wet signatures will only be needed once the contract is won? | Confirmed. |
| 14 | 11/15/19 | Nini Donovan/Guidehouse LLP | RFR | On page 8 of the response template, it states ?Details on the specific services and performance details should be included under PART C ? WORK PLAN.? There wasn?t a work plan cited, can you provide more details on this? | Please disregard this reference to Part C Work Plan as this section was removed from the RFR Response Template." |
| 15 | 11/15/19 | Karen Perella/MCI Communications Services Inc. d/b/a Verizon Business Services | Contact & Signature Process | Please confirm if the Forms that require Wet Ink Signature (referenced in PRF73 RFR Amended 11.4.19 J. Required Forms, G. Contract Management Requirements iii., and Appendix 3) are to be signed and submitted with the RFP response as PDF ecopies or not until after the contract has been awarded. | Forms with Wet Ink Signature will be submitted after Award. |
| 16 | 11/15/19 | Patricia Fisher/JANUS Software, Inc. (d/b/a JANUS Associates) | RFR Response Template Part A, Page 21 of 37, Item B-6 b) Scanning Services Types, Item 10 | This section makes reference to attaching samples of "other incident response materials." Is this an error? | This is not in error. The PMT requests to evaluate the samples of end products that potential Eligible Entities will receive from successful bidders. These samples will be kept confidential and will not be posted as public. |
| 17 | 11/15/19 | Patricia Fisher/JANUS Software, Inc. (d/b/a JANUS Associates) | RFR Response Template Part A, Page 22 of 37, Item B-6 e) Qualifications, Item 2 | What do you mean by "Identify if Bidder provides an on-line monitoring/reporting system."? | This is referring to the ability for Eligible Entities to log on and have access to reports or other information related to services. Some have portals or online systems for activity. |
| 18 | 11/15/19 | Patricia Fisher/JANUS Software, Inc. (d/b/a JANUS Associates) | RFR Response Template Part A, Page 22 of 37, Item B-6 e) Qualifications, Item 4 | What to you mean by "Identify if Bidder is able to allow web-based access for central monitoring of compliance status for all Commonwealth merchants provided to CTR."? | PCI compliance - each merchant will have direct reporting to the merchant. CTR also wants reporting for all State Department Merchants. |
| 19 | 11/15/19 | Karen Perella/MCI Communications Services Inc. d/b/a Verizon Business Services | Forms | Can you please post the form: Additional Environmentally Preferable Products/Practices | See Attached PRF73 EPP Form. |
| 20 | 11/15/19 | Karen Perella/MCI Communications Services Inc. d/b/a Verizon Business Services | Please advise if there are mandatory requirements regarding supplier diversity | All bidders are required to make a significant financial commitment to partner with certified M/WBEs, M/WNPOs, VBEs, and/or SDVOBEs, DOBEs and/or LGBTBEs certified or verified by the Supplier Diversity Office (SDO). Bidders must identify a commitment in the form of a specific percentage of sales made under the resulting contract that will be spent with an SDP Partner(s) on a Massachusetts fiscal year basis, using SDP Plan Form #1 – SDP Plan Commitment. This percentage commitment will extend for the life of any resulting contract. |
This requirement extends to all bidders regardless of their certification status, and no bidder will be awarded a Contract unless and until the above requirement is met. Bidders may not list themselves or affiliates as SDP Partners. In order to ensure compliance with this section and encourage bidder participation, SDP Plans will be evaluated at 10% or more of the total evaluation score. Bidders that have questions regarding this form or what businesses to partner with may contact the Supplier Diversity Office (SDO) by phone at 617-502-8851 or by email at sdp@mass.gov.
21 11/15/19 Nini Donovan/Guidehouse LLP RFR On page 19 and 20 of the Response Template, you state the requirement for 24/7 threat detection capabilities (B-5 b) 2.) and Security Information and Event Management Tools (B-5 b) 10.). Will preference be given to bidders who operate a 24/7 Security Operations Center (SOC)? Additional points may be awarded for services above what is listed. It is advantageous for any approved vendors on contract to have value added services. Ultimately, Eligible Entities will decide which authorized vendors they will engage and factors such as price and value added services will help with that determination.
File details come from the government source that posted it. Updated .