PRF73 RFR Amended 11.4.19.docx

REQUEST FOR RESPONSE

STATEWIDE CONTRACT FOR CYBER AND DATA SECURITY, AUDIT, COMPLIANCE, INCIDENT RESPONSE AND PAYMENT CARD INDUSTRY (PCI) COMPLIANCE SERVICES RFR # PRF73DESIGNATEDCTR / COMMBUYS Bid# ______

COMMONWEALTH OF MASSACHUSETTS

OPERATIONAL SERVICES DIVISION

Request for Response (RFR)

Document Title: STATEWIDE CONTRACT FOR CYBER AND DATA SECURITY, AUDIT, COMPLIANCE, INCIDENT RESPONSE AND PAYMENT CARD INDUSTRY (PCI) COMPLIANCE SERVICES

Agency Document Number: PRF73DESIGNATEDCTR

COMMBUYS Bid#: Bid# BD-20-1080-OSD03-SRC02-45433 COMMBUYS Bid#: BD-20-1080-OSD03-SRC02-45583

November 1, 2019 Amended November 4, 2019

Please Note: This is a single document associated with a complete Bid (also referred to as Solicitation) that can be found on www.COMMBUYS.com. All Bidders are responsible for reviewing and adhering to all information, forms and requirements for the entire Bid, which are all incorporated into the Bid. Bidders may also contact the COMMBUYS Helpdesk at COMMBUYS@state.ma.us or the COMMBUYS Helpline at 1-888-MA-STATE. The Helpline is staffed from 8:00 AM to 5:00 PM Monday through Friday Eastern Standard or Daylight time, as applicable, except on federal, state and Suffolk county holidays.

Bidders with disabilities or hardships that seek reasonable accommodation, which may include the receipt of RFR information in an alternative format, must communicate such requests in writing to the contact person. Requests for accommodation will be addressed on a case by case basis. A Bidder requesting accommodation must submit a written statement which describes the Bidder’s disability and the requested accommodation to the contact person for the RFR. The SST (PMT) reserves the right to reject unreasonable requests.

[TABLE OF CONTENTS]

Contents

A. Introduction and Bid Overview

1. Description or Purpose of Procurement The Commonwealth of Massachusetts Office of the Comptroller, as designated through the Operational Services Division (OSD) is issuing a re-bid of a (CTR) Statewide Contract for Data Management, Security and Compliance Audits Including Payment Card Industry (PCI) Data Security Standards (DSS) that ends June 30, 2020. This RFR will replace PRF56DesignatedOSC00 which will effectively sunset at PRF73DesignatedCTR’s start date of January 10, 2020.

This RFR PRF73DesignatedCTR is an Open Enrollment RFR which seeks qualified Bidders for a Statewide Contract for Cyber and Data Security, Audit, Compliance, Incident Response and Payment Card Industry (PCI) Compliance Services. Bidders selected under this Statewide Contract will perform a full suite of cyber and data security services, including but not limited to: data management and internal controls audits, risk assessments, disaster recovery plans, business continuity compliance, quality assurance, compliance reviews, audits and testing and scanning for information and data management systems (paper or electronic), internal and external security compliance, cyber and data security compliance validation and testing, PCI compliance, categorization, encryption and physical and electronic security of records, Personally Identifiable Information (PII), sensitive and confidential information storage and administration, E-discovery, data breach investigations, forensic audits, assistance with cyber and data incidents, containment, mitigation and remediation, and any other audits and compliance reviews related to data management systems and security.

2. Estimated Procurement Calendar

Times are Eastern Standard/Daylight Savings (US), as displayed on the COMMBUYS system clock displayed to Bidders after logging in. If there is a conflict between the dates in this Procurement Calendar and dates in the Bid’s Header, the dates in the Bid’s Header on COMMBUYS shall prevail. Bidders are responsible for checking the Bid record, including Bid Q&A, on COMMBUYS for Procurement Calendar updates.

3. Submission of Bid Questions The “Bid Q&A” function in COMMBUYS allows Bidders to ask written questions and receive written answers regarding this Bid. All questions must be submitted through the Bid Q&A found on COMMBUYS (See “Locating Bid Q&A,” below). Questions must be asked prior to the Deadline stated in the Estimated Procurement Calendar. The Procurement Management Team (PMT) reserves the right not to respond to late questions. Bidder are responsible for verifying that their questions are recorded in COMMBUYS and appear on the Bid Q&A page.

Questions submitted to the PMT outside of COMMBUYS will not be answered.

Content entered must be suitable for public viewing. Bidders must not include inappropriate content, including but not limited to, information that could be considered personal, security sensitive, inflammatory, incorrect, or collusory. The PMT reserves the right to edit or delete any inappropriate content.

All answers are final when posted. Any subsequent revisions to previously provided answers will be dated.

Bidders and awarded Contractors are required to view the COMMBUYS requirements associated with this bid are responsible for compliance with those requirements.

4. Locating Bid Q&A Log into COMMBUYS, locate the Bid, acknowledge receipt of the Bid, and scroll down to the bottom of the Bid Header page. The “Bid Q&A” button allows Bidders access to the Bid Q&A page.

5. Bid Amendment Deadline The PMT reserves the right to make amendments to the Bid after initial publication. It is each Bidder’s responsibility to check COMMBUYS for any amendments, addenda or modifications to this Bid, and any Bid Q&A records related to this Bid. The PMT and the Commonwealth accept no responsibility and will provide no accommodation to Bidders who submit a Quote based on an out-of-date Bid or on information received from a source other than COMMBUYS.

6. Late Bids will not be Considered Bid responses must be received in full by the posted due date and time. Proposals received after the deadline will be late and ineligible for consideration and deemed as non-responsive. Each offeror must submit all required bid response forms electronically through COMMBUYS. When submitting a quote electronically through COMMBUYS, please allow sufficient time to complete the online forms and upload documents. The solicitation will end at the closing time listed in the RFR. If you are in the middle of uploading your proposal at the closing time, the system will stop the process and your quote will not be completed and received by the system.

7. Applicable Procurement Law:

8. Acquisition Method:

The acquisition method(s) to acquire goods and/or services from this Bid are identified below.

9. Anticipated Contract Awards:

Check One (“X”):

a. Estimated Number of Awards CTR seeks multiple firms to be responsible to perform the required Consulting and emergency services under the contract for the duration of the procurement. A firm may complete performance with the use of subcontractors, provided that the selected Statewide Contractor remains fully responsible for managing and ensuring qualify performance under the Contract.

All subcontractor work will be billed through the Bidder as Primary Contractor under the Primary Contractor’s Tax ID. The Commonwealth will not entertain “joint” bids. Eligible Entities may contract solely with Contractors approved under the Statewide Contract and may not enter into direct relationships with named subcontractors.

Contract renewals will be offered at the sole discretion of CTR. At a minimum, offers to renew will be contingent upon satisfactory contractor performance, compliance with reporting requirements, and adequate sales volume; CTR reserves the right to reduce the number of awarded contractors for the duration of the agreement.

b. Adding Contractors after initial Contract Award If, over the life of the Contract, the PMT determines that additional Contractors should be added in order to meet the requirements of the Commonwealth, these may first be drawn from qualified companies which responded to this Bid but were not awarded contracts and/or the Bid may be reopened to obtain additional Quotes.

This open enrollment procurement will be opened for one (1) month (on or about October 1st to on or about October 31st) each year throughout the life of the contract to add new vendors.

Since this RFR will be an open enrollment procurement, the Comptroller reserves the right to re-open the QSV, ASV, General Data Security and the CTR Emergency Incident Response categories at any time to qualify additional Contractors, to reassess current and new contractors, and may align the end dates of contracts to ensure continued uninterrupted performance during any re-opening of the open enrollment process.

The PMT also reserves the right to suspend the review of additional submissions for specific regions or close the Bid for new Quotes entirely if it deems that the number of Contractors awarded at that point adequately meets the needs of eligible entities. If, subsequent to such a decision, the PMT determines that additional Contractors should be added, these may first be drawn from qualified companies which responded to this Bid but were not awarded contracts. If necessary to meet the requirements of the Commonwealth, the Bid may be reopened to obtain additional Quotes.

10. Performance and payment time frames which exceed Contract duration An agreement for service entered into before the final contract end date may extend up to 24 months beyond the final contract end date. No new agreements for services may be made beyond the final contract end date if a new procurement and Statewide Contract is in place

11. Entities Eligible to Use the Resulting Contract Statewide Contract – Open for Use by All Eligible Entities. Any Contract(s) resulting from this Bid will be open for use by the following entities:

1. Cities, towns, districts, counties and other political subdivisions;

2. Executive, Legislative and Judicial Branches, including all Departments and elected offices therein;

3. Independent public authorities, commissions and quasi-public agencies;

4. Local public libraries, public school districts and charter schools;

5. Public hospitals owned by the Commonwealth;

6. Public institutions of higher education;

7. Public purchasing cooperatives;

8. Non-profit, UFR-certified organizations that are doing business with the Commonwealth;

9. Other states and territories with no prior approval by the State Purchasing Agent; and

10. Other entities when designated in writing by the State Purchasing Agent.

Each eligible entity is responsible for executing its own purchase orders and paying its own invoices for goods and/or services acquired from this Contract. Contractors will be responsible for marketing their goods and/or services to Commonwealth Agencies and other eligible entities.

12. Anticipated Contract Duration The initial duration of this Statewide Contract is five (5) years, through January 10, 2025, subject to continued successful performance. CTR reserves the right to negotiate any part of the RFR or contract to ensure continued best value for the Commonwealth, including scope and fees. In addition, the contract may be extended under the same terms and conditions as needed for any period necessary to transition to a new procurement.

Under this RFR, CTR will have one (1) additional five (5) year option to renew, through January 10, 2030, subject to appropriation, and continued successful performance and the satisfactory renegotiation of each subsequent year’s performance specifications.

Given the nature of the services, CTR also reserves the right to extend Contracts and renew Contractors to ensure continued uninterrupted performance during any re-opening of the open enrollment process.

13. Estimated Value of the Contract Since this is a rate contract the maximum obligation for services provided under this RFR is unknown and it will depend upon the, Statement of Work (SOW) Plan approved by an Eligible Entity.

The Commonwealth makes no guarantee that any commodities or services will be purchased from any Contract resulting from this Bid.

B. Procurement Scope and Description The Commonwealth of Massachusetts and the PRF73 Procurement Management Team (PMT) are soliciting Bidders for the acquisition of cyber and data security, audit, compliance, incident response and payment card industry (PCI) compliance services. The resulting Contract will be the primary Statewide Contract used by Executive Agencies of the Commonwealth for the goods and services covered by the Contract. The Statewide Contract will also be available for use by other eligible entities listed above. Each Commonwealth Agency and eligible entity is responsible for executing its own purchase orders and paying its own invoices for goods and/or services acquired from this Statewide Contract. Contractors will be responsible for marketing their goods and/or services to Commonwealth Agencies and other eligible entities.

BIDDERS MAY BID ON ANY OR ALL OF THE SPECIALTIES LISTED BELOW. Bidders will be qualified separately in the following specialties:

I. PCI Council Approved Quality Security Assessors (QSAs) and related QSA Consulting Services. Only Approved QSAs can perform PCI Compliance validation.

II. PCI Council Approved Scanning Vendors (ASVs) and other Scanning and Compliance and Vulnerability Testing and Security Compliance Scans and Testing. Only Approved ASVs can perform PCI Compliance validation.

III. Non-PCI Cyber and Data Security, Audit, Compliance, Cyber Readiness Services. Full range of audit, compliance reviews and related consulting services for non-PCI related cyber and data security, validation, physical and electronic security of records, PII and confidential information, compliance with ITD Enterprise Data Security and other enterprise or Eligible Entity data security policies, G.L. c, 93H and c. 93I PII security statutes, or other audits and compliance reviews related to data management systems, and security or Personally Identifiable Information (PII) and other types of confidential and sensitive information.

Proactive consulting services to provide support with compliance with industry compliance standards, cyber readiness protections to prevent data breaches, unauthorized data access, cyberattack vulnerabilities, risk assessments, risk management, vulnerability assessments, internal controls and quality assurance audits, building internal controls for data categorization, data management, security of data at rest, in use and in transit; audits of data security policies and procedures, network and system security management, business continuity plans, disaster recovery plans, compliance audits, on-site and on-line audit and assessment capabilities, provision and coordination of scanning testing, penetration testing and other vulnerability testing for networks, websites, internal and third party applications; vendor security and data security management; secure mobile infrastructure;, a suite of training options or recommendations for cyber awareness; simulations and employee testing; training and other support services related to secure data and network management. Goals of proactive services are to align data security and compliance with business goals, promote fiscal responsibility and build a culture of security awareness.

IV. Emergency and Incident Cybersecurity, Containment, Mitigation, Remediation, Audit and Validation Services. Under this category Contractors are pre-qualified as capable of performing Emergency Cybersecurity Incident Responses for suspected or known cybersecurity attacks, system or network data breaches or other incidents, and post-incident services after a Department has contained and remediated the incident to audit and validate that the remediation is sufficient so that the Commonwealth’s systems and other resources are not compromised.

This category includes any post breach or incident support services with regard to Commonwealth Systems to contain, remediate and return to full operations, including emergency incident response services, forensic investigations, containment, remediation, implementation support for disaster recovery or business continuity plans, and other post incident support services. Cyber incidents include any external cyber malicious source. Data incidents include any type of incident involving data management or compromise including internal access, release or malicious events. Contractors prequalified under this section must be prepared to engage within 24-48 hours, 7 days a week from a requesting state Department, and implement an Incident Response Protocol (included as part of this procurement, with more detail as negotiated in a Statement of Work (SOW).

Cyber and data incidents requiring engagements under this category by state Departments must be coordinated with (CTR) to ensure that Enterprise Systems are not at risk.

V. Non-PCI Scanning Services. Full suite of scanning and testing services for any cyber or data security compliance, data processing system, application, network or other infrastructure for ongoing maintenance, audit, or incident response needs.

Background information – PCI-DSS Compliance and Cyber and Data Security PCI-DSS compliance is a mandatory program of the major credit card associations (e.g., MasterCard and VISA) to create common industry security requirements for cardholder data. All Commonwealth Eligible Entities that process, transmit, or store cardholder data are required to adhere to certain Data Security Standards (DSS) mandated by the credit card associations, and to provide compliance certifications to their acquiring merchant banks.

PCI-DSS help merchant Eligible Entities improve the safekeeping of cardholder information by tightening overall security standards and information management to:

· Minimize vulnerabilities;

· Reduce the chance of breaches, fraud, and financial loss;

· Ensure the security of the Commonwealth's public facing e-commerce applications; and

· Reduce the scope of audit requirements by reducing the scope of potential data breaches or system and protocol vulnerabilities.

The Commonwealth, pursuant to G.L. c. 93H and 93I and other state and federal data security and privacy standards, has the responsibility to safeguard data deemed Personally Identifiable Information (PII), in addition to protections mandated by other state and federal statutes and regulations for other types of confidential and sensitive data. In addition, given the substantial cost and disruption to the provision of critical state services, the Commonwealth seeks to provide resources to State Departments and other Eligible Entities to protect infrastructure and maintain business continuity by the prevention of cyber and data incidents, and emergency containment and remediation support in the event of an incident.

Therefore, this Statewide Contract seeks to qualify contractors that can assist Eligible Entities with a full and comprehensive industry standard suite of services to assist with the audit and testing of systems and protocols to ensure that all sensitive data, confidential data, and PII, as identified under G.L. c. 93H, c. 93I, PCI-DSS, and other state and federal laws and regulations is properly safeguarded to prevent data breaches, and to provide consulting services to assist with protection of public infrastructure and business continuity and mitigation and remediation of vulnerabilities and data breaches or other incidents.

C. Bidder Qualifications

1. Qualifications for each Category Bidders are given the opportunity to demonstrate their qualifications within the RFR Response Template (For Roman Numerals I-V please refer to section B of the RFR Response Template). The following are the Minimum Required Qualifications for Bidder for each Specialty:

I. PCI COUNCIL APPROVED QUALITY SECURITY ASSESSORS (QSAS) AND RELATED QSA CONSULTING SERVICES. Qualified Security Assessor (QSA) companies are independent security organizations that have been qualified by the PCI Security Standards Council to validate an entity’s adherence to PCI DSS https://www.pcisecuritystandards.org/documents/QSA_Qualification_Requirements_v3_0.pdf. QSA Employees are individuals who are employed by a QSA Company and have satisfied and continue to satisfy all QSA Requirements.

Bidders and key personnel must provide evidence of Qualified Security Assessor (QSA) approved by the PCI Security Standards Council: https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors as of the date of this RFR to perform on-site PCI Data Security Assessments for a Level 1, 2, 3, or 4 merchant; and Level 1, 2, or 3 service providers. Firms may not be currently in remediation.

(1) A minimum level of at least five (5) years experience providing the same type of full suite of QSA, consulting and remediation services to entities of similar size and complexity as the Commonwealth, with additional points or consideration to well established firms with more extensive experience.

(2) A minimum requirement of performance of services to at least four (4) government entities (local/state/federal) with similar PCI needs or complexity as the Commonwealth and a clear understanding of work with a government entity.

(3) Significant experience with payment processing and direct payment processing system audit and a clear understanding of the payment processing needs unique to government entities.

(4) Significant experience with evaluating and providing assessments in the cardholder data environment of large scale and diversified or decentralized merchants, as well as the ability to assess areas of internal risks for these type of organizations such as insider fraud, unattended devises, social engineering, third party hosting risks, data leakage prevention, and other related risks, and provide emerging technology and PCI scope reduction trends.

(5) Demonstrated ability to efficiently and effectively develop PCI DSS scope assessments and price engagements reasonable for the size and complexity of the engagement, with a willingness to negotiate scope and pricing relative to the funding available for a merchant Department without compromising the duty to identify PCI risks, remediation and recommendations.

II. PCI COUNCIL APPROVED SCANNING VENDORS (ASVS) AND OTHER SCANNING AND COMPLIANCE AND VULNERABILITY TESTING AND SECURITY COMPLIANCE SCANS AND TESTING. Bidders selected in this category must have exceptional experience and expertise in providing a full suite of scanning and security testing services to identify vulnerabilities and test remediation efforts.

a. Bidders must provide evidence of certified Approved Scanning Vendor (ASV) status approved by the PCI Security Standards Council: https://www.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors as of the date of this RFR to perform network scans for all merchants and service providers with externally-facing IP addresses. ASV may not be currently in remediation. A company in remediation has not met all of the current ASV Qualification Requirements. PCI SSC will flag a company in remediation by listing their company name and email in red text.

b. A minimum level of at least five (5) years experience providing the same type of full suite ASV and related services to entities of similar size and complexity as the Commonwealth, with additional points or consideration to well established firms with more extensive experience with government entities.

c. A minimum requirement of performance of services to at least four (4) government entities (local/state/federal) with similar PCI needs or complexity as the Commonwealth and a clear understanding of work with a government entity.

d. Significant experience with payment processing and direct payment processing system audit and a clear understanding of the payment processing needs unique to government entities.

i. Significant experience with evaluating and providing assessments the cardholder data environment of large scale and diversified or decentralized merchants, as well as the ability to assess areas of internal risks for these type of organizations such as insider fraud, unattended devises, social engineering, third party hosting risks, data leakage prevention, and other related risks.

ii. Demonstrated ability to efficiently and effectively develop ASV scope assessments and price engagements reasonable for the size and complexity of the engagement, with a willingness to negotiate scope and pricing relative to the funding available for a merchant Department without compromising the duty to identify PCI risks, remediation and recommendations, and provide emerging technology and PCI scope reductions trends.

III. Non-PCI Cyber and Data Security, Audit, Compliance, Cyber Readiness Services.

A minimum level of at least five (5) years’ experience providing a full suite of cyber and data security audit, compliance and Cyber readiness services to entities of similar size and complexity as the Commonwealth, with additional points or consideration to well established firms with more extensive experience.

IV. Emergency Cybersecurity Incident Containment, Remediation, Audit and Validation Services: The following are the Minimum Required Qualifications for Bidders for Emergency Cybersecurity Incident Audits:

a. A minimum level of at least 5 (five) years’ experience providing the same type of full suite of incident response services to entities of similar size and complexity as the Commonwealth, with additional points or consideration to well established firms with more extensive experience.

V. Non-PCI Scanning Services. Qualified Bidders in this category must be able to furnish an extensive suite of scanning and vulnerability scans and testing services that may be provided separately, or as part of other Non-PCI related services including but not limited to:

a. Industry standard suite of scanning and testing services, including: server hardening scans, penetration scans, vulnerability scans, local and third party application scans, web application scans and vulnerability assessments, mobile device security scans/reviews, network scans/port scans/traffic monitoring/packet scanning, virus and malware scans, and other available scans or testing of data system, network, data repository (local, hosted or cloud) vulnerabilities

b. A minimum level of at least five (5) years’ experience providing a full suite of scanning services to entities of similar size and complexity as the Commonwealth, with additional points or consideration to well established firms with more extensive experience.

2. Financial Stability, Bankruptcy, Litigation and Contract Defaults Bidders should refer to section A-4 of the RFR Response Template for the following requested status

a. Penalties and Bankruptcy

b. Litigation

c. Civil Penalties

d. Suspensions of any permit or authority to do business

e. Debarment from public bidding

f. Defaults

g. Other Adverse Situations or Potential Conflicts

3. Robust Reporting Requirements, Results and Analysis.

Bidders will complete Section B of the RFR Response Template with regard to Robust Reporting Requirements, Results and Analysis. Bidders must demonstrate the capability to provide detailed assessments, analysis of scoping environments, reports and any other information required by Eligible Entities. CTR and the Executive Office of Technology Services and Security (EOTSS) track overall compliance for state departments. Contractors will be required to provide overall state compliance assessments, reduction in PCI scope recommendations, and other information for overall PCI compliance.

4. Virtual and In-State Presence.

Bidders will certify their Virtual and In-State Presence in Section B -1 of the RFR Response Template. Must be United States firm able to perform both virtual and on-site work in Massachusetts, with no services being provided outside the continental US. While most of the required work should be able to be performed virtually, some on-site work may be requested or required. It is preferred that Contractors have an in state presence, with a local office as opposed to a registered agent location. Pricing must include travel. Given the number of qualified firms in the New England area, it is expected that there are numerous vendors capable of providing emergency services locally, with no travel costs added. Bidders seeking to recoup travel costs must include pricing with travel included. Bidders with applications that will be accessing any Department data may not store any data in global clouds where data is travelling outside the continental US.

5. Partnership Commitment.

The Bidder will certify their response in Sections A-3 and A-6 of the RFR Response Template. Bidders must demonstrate a significant commitment to partner with the Commonwealth and Eligible Entities to achieve the highest level of compliance and ensure that methods are employed to prevent fraud, waste and abuse of Commonwealth funds and resources.

6. Supplier Diversity Plan (SDP) Bidders must complete and submit to COMMBUYS the Supplier Diversity Plan Form.

Massachusetts Executive Order 565 reaffirmed and expanded the Commonwealth’s policy to promote the award of state contracts in a manner that develops and strengthens certified Minority Business Enterprises (MBEs), Women Business Enterprises (WBEs), Minority and Women Nonprofit Organizations (M/WNPOs), Veteran Business Enterprises (VBEs), Service-Disabled Veteran-Owned Business Enterprises (SDVOBEs), Disability-Owned Business Enterprises (DOBEs), and Lesbian, Gay, Bisexual and Transgender Business Enterprises (LGBTBEs).

In planning their SDP commitment, certified Bidders must note that the commitment cannot be met by making expenditures within their own company or with parent or wholly owned subsidiary companies.

All bidders are required to make a significant financial commitment to partner with certified M/WBEs, M/WNPOs, VBEs, and/or SDVOBEs, DOBEs and/or LGBTBEs certified or verified by the Supplier Diversity Office (SDO). Bidders must identify a commitment in the form of a specific percentage of sales made under the resulting contract that will be spent with an SDP Partner(s) on a Massachusetts fiscal year basis, using SDP Plan Form #1 – SDP Plan Commitment. This percentage commitment will extend for the life of any resulting contract.

This requirement extends to all bidders regardless of their certification status, and no bidder will be awarded a Contract unless and until the above requirement is met. Bidders may not list themselves or affiliates as SDP Partners. In order to ensure compliance with this section and encourage bidder participation, SDP Plans will be evaluated at 10% or more of the total evaluation score.

Resources available to assist Bidders in finding potential SDP partners and a webcast explaining the SDP program can be found at: www.mass.gov/sdp.

D. Environmental, and Cost Specifications

1. Environmental Specifications View the Environmentally Preferable Products (EPPs) Procurement Program General Information, Requirements and Guidance for detailed information about the program at https://www.mass.gov/doc/epp-general-information-requirements-and-guidance/download.

a. Bidder Current Environmental Practices Form Bidders must complete this form, Bidder Environmental Plan to this RFR, and submit it with their Quote. The form allows Bidders to communicate existing business practices that foster a sustainable approach to conducting their operations and reduce environment or public health impacts. Bidders may receive additional points in the evaluation phase of the RFR for the environmental initiatives they identify, however, bidders must substantiate all answers in order to receive additional points.

b. Environmental plan Awarded Bidders must agree to work with OSD and the PMT to examine the feasibility of implementing an environmental plan throughout the life of the contract. Such a plan may include, but not be limited to, implementing energy initiatives, adopting and implementing sustainability policies or third-party standards and/or certifications, or publicizing their environmental initiatives. The objective of this requirement is to actively encourage suppliers to incorporate sustainable practices throughout their business operations and further market such practices to Contract users. Bidders may include written proposals submitted as an attachment named Bidder Environmental Plan to their Quote detailing a commitment to action contingent upon receipt of a Contract award.

2. Compensation Structure/Pricing Bidders must identify any and all costs or charges that can be billed under the Statewide Contract. Costs not identified may not be charged. Bidders will be paid based upon reaching established scheduled milestones and submission of required reports, data or other documentation in accordance with required scope of service and fees. Eligible Entities reserve the right to withhold payment for any scheduled milestone that is not met until properly completed. Eligible Entities also reserve the right to apply a Retainage on all payments to ensure delivery of services under the terms of the contract.

Bidders will submit price proposals for each of the separate categories of work for which the bidder is responding as required in Part D of the RFR Response Template.

a. Cost tables Compensation will be based solely on the cost tables supplied by the Bidder and accepted by the PMT and posted on COMMBUYS. Cost tables must contain all goods and services to be provided on this Statewide Contract.

Bidders will submit price proposals for each of the separate categories of work for which the bidder is responding as required in Part D of the RFR Response Template.

b. Subcontracting Prior approval of the department is required for any subcontracted service of the Contract. Contractors are responsible for the satisfactory performance and adequate oversight of their subcontractors.

Subcontractor and Prime Bidders. When completing responses, the Bidder must indicate if the Bidder will be directly providing the services or contracting out the provision of services through a subcontractor. All subcontractor work will be billed through the Bidder as Primary Contractor under the Primary Contractor’s Tax ID. The Commonwealth will not entertain “joint” bids.

Eligible Entities may contract solely with Contractors approved under the Statewide Contract and may not enter into direct relationships with named subcontractors. Therefore, named subcontractors that desire direct contract relationships for scanning or other services independent of the Primary Contractor must submit their own Response for these services (in addition to being listed as a named subcontractor under a Prime Contractor Response) in order to be considered a Statewide Contractor that can have a direct relationship with Eligible Entities. For Bidders providing both QSA and Scanning Services the Bidder must be able to demonstrate complete independence of QSA services and Scanning Services.

Bidders may propose other options for payments that meet industry standards and are the most cost effective and efficient methods of compensation

c. Prompt Pay Discount All Bidders must agree to offer discounts through participation in the Commonwealth Prompt Payment Discount (PPD) initiative for receiving early and/or on-time payments, unless the Bidder can provide compelling proof that it would be unduly burdensome.

Bidders must submit agreeable terms for Prompt Payment Discount unless otherwise specified by the PMT. The PMT will review, negotiate or reject the offering as deemed in the best interest of the Commonwealth.

The requirement to offer a PPD may be waived by the PMT on a case-by-case basis if participation in the program would be unduly burdensome on the Bidder. If a Bidder is claiming that this requirement is a hardship or unduly burdensome, the specific reason must be documented in the Bidder’s Quote.

d. Bill Payment All invoices issued pursuant to this contract are payable in accordance with the Comptroller’s Bill Payment Policy: http://www.mass.gov/osc/docs/policies-procedures/accounts-payable/po-ap-commonwealth-bill-paying.doc .

e. Late Payment Fees Late Payment fees may be assessed only as authorized by the Office of the Comptroller: http://www.mass.gov/osc/docs/ctrinfo/comptroller-regulations/815/cumulative-lpi-rates.doc.

f. Electronic Funds Transfer (EFT) All Awarded Contractors must agree to participate in the Commonwealth Electronic Funds Transfer (EFT) program for receiving payments.

Upon notification of award, Contractors will be provided with the “Authorization for Electronic Funds Payment Form”. Contractors are required to enroll in EFT by completing and submitting this form to the PMT for review, approval and forwarding to the Office of the Comptroller, unless already enrolled in EFT. The “Authorization for Electronic Funds Payment Form” and all information contained on this form, shall not be considered a public record and shall not be subject to public disclosure through a public records request.

The EFT form, and any subsequent requests to make changes to this form, must be signed by an authorized signatory appearing on the "Contractor Authorized Signatory Verification Listing."

g. Creditworthiness No public entity utilizing this contract shall be required, as a condition of purchase, to undergo any creditworthiness review or application process.

h. Tax Exemption Payment vouchers or invoices submitted to Massachusetts government entities must not include sales tax.

E. Evaluation Criteria Contractors must submit responses that meet all the submission requirements of the RFR. Only responsive proposals that meet the submission requirements will be evaluated, scored and ranked by the evaluation team according to the evaluation criteria. Additional information may be requested for evaluation purposes.

Any submission which fails to meet the submission requirements of the RFR will be found non-responsive without further evaluation unless the evaluation team, at its discretion, determines that the non-compliance is insubstantial and can be corrected. In these cases, the evaluation team may allow the contractor to make minor corrections to the submission.

Bidder scores will be used to rank Bidders and will determine which Bidders will proceed to subsequent stages of the evaluation and/or enter into negotiations with the Commonwealth to receive a Contract award.

1. Mandatory Requirements Mandatory Specifications must be met in order for a Quote to be evaluated and may be used to disqualify Bidders. In addition, certain Mandatory Specifications have desirable components to them that may be evaluated by the PMT. The PMT reserves the right, in its discretion, to determine if non-compliance with a Mandatory Specification is insignificant or can be easily corrected.

Bid sections that include terms such as: “must”, “shall”, “will” and “required” are mandatory. Failure to meet the requirements of a Mandatory Specification without providing an alternate that is acceptable to the evaluators may result in the disqualification of a Bidder's proposal.

2. Evaluation Components Bidders must meet the minimum qualifications for their bid category and make their submissions to COMMBUYS by the deadline of Thursday, December 26, 2019 at 4PM. The completed RFR Response Template for the category or categories bid is mandatory. Also all Contract forms referenced in this RFR’s Submission Checklist (Section J of this RFR) are required.

Bidders will be selected for this Statewide Contract based upon overall qualifications, but also on the quality, detail, usability, and demonstrated expertise and thoroughness of these plans. Bidders must submit the most detailed and comprehensive plans available to be considered for this Contract.

Bidders will be separately reviewed and ranked in each of the categories in which they bid, and Bidders may bid on any or all of the categories. Bidders will be ranked separately under each category and may or may not be selected to provide more than one category of services, even if a Response has been submitted for more than one category.

3. Price Please note that price will carry a significant weight in the evaluation process. Bidders will submit their response for prices for the category for which they are responding within Section D of the RFR Response Template.

4. Supplier Diversity Plan (minimum of 10% weight) The SDP form must be completed for this Statewide Contract. Bidders that have questions regarding this form or what businesses to partner with may contact the Supplier Diversity Office (SDO) by phone at 617-502-8851 or by email at sdp@mass.gov.

E. Statewide Contract Specifications

1. Use of COMMBUYS Bidders and awarded Contractors are required to maintain an active registration in COMMBUYS and to keep current the email address of the Bidder’s contact person and prospective contract manager, if awarded a contract, and to monitor that email inbox for communications from the Purchasing Department, including requests for clarification. The Purchasing Department and the Commonwealth assume no responsibility if a prospective Bidder’s/awarded Contractor’s designated email address is not current, or if technical problems, including those with the prospective Bidder’s/awarded Contractor’s computer, network or internet service provider (ISP) cause email communications sent to/from the prospective Bidder/Awarded contractor and the Purchasing Department to be lost or rejected by any means including email or spam filtering. Awarded contractors must comply with applicable COMMBUYS requirements outlined in Section G.

2. Public Records Law All Quotes and information submitted in response to this RFR are subject to the Massachusetts Public Records Law, M.G.L., Chapter 66, Section 10, and to Chapter 4, Section 7, Subsection 26. Any statements in submitted Quotes that are inconsistent with these statutes shall be disregarded.

3. Reasonable Accommodation Bidders with disabilities or hardships that seek reasonable accommodation, which may include the receipt of RFR information in an alternative format, must communicate such requests in writing to the contact person. Requests for accommodation will be addressed on a case by case basis. A Bidder requesting accommodation must submit a written statement which describes the Bidder’s disability and the requested accommodation to the contact person for the RFR. The PMT reserves the right to reject unreasonable requests.

4. Prohibitions Bidders are prohibited from communicating directly with any employee of the procuring Department or any member of the PMT regarding this RFR except as specified in this RFR, and no other individual Commonwealth employee or representative is authorized to provide any information or respond to any question or inquiry concerning this RFR. Bidders may contact the contact person using the contact information provided in the Header Information this Bid in the event that this RFR is incomplete or information is missing. Bidders experiencing technical problems accessing information or attachments stored on COMMBUYS should contact the COMMBUYS Helpdesk (see the document cover page for contact information).

5. Non-Collusion By submitting a Quote, the Bidder certifies that the Quote has been arrived at independently and has been submitted without any communication, collaboration, or without any agreement, understanding or planned common course or action with, any other Bidder of the commodities and/or services described in the RFR.

6. Minimum Quote Duration Bidders’ Quotes to this RFR must remain in effect for at least 120 days from the date of Quote submission deadline and thereafter until either the bidder withdraws it, a Contract is executed, or the procurement is canceled, whichever occurs first.

7. Ownership of Submitted Quotes OSD and the PMT shall be under no obligation to return any Quotes or materials submitted by a Bidder in response to this RFR. All materials submitted by Bidders become the property of the Commonwealth of Massachusetts and will not be returned to the Bidder. The Commonwealth reserves the right to use any ideas, concepts, or configurations that are presented in a Bidder’s Quote, whether or not the Quote is selected for Contract award.

Quotes stored on COMMBUYS in the encrypted lock-box are the file of record. Bidders retain access to a read-only copy of this submission via their COMMBUYS account, as long as their account is active.

8. Multiple Quotes Bidders may not submit Multiple Quotes in response to a Bid. If a Bidder submits multiple quotes in response to an RFR that does not authorize multiple responses, only the latest dated quote submitted prior to the bid opening date will be evaluated.

9. Evaluation – Best Value Selection and Negotiation The PMT may select the Quotes(s) which demonstrates the best value overall, including proposed alternatives, that will achieve the goals of the procurement. The PMT and a selected Bidder may negotiate a change in any element of Contract performance or cost identified in the original RFR or the selected Bidder’s Quote which results in lower costs or a more cost effective or better value than was presented in the selected Bidder’s original Quote.

F. Performance Measures:

1. Minimum amount of business with this Contract

a. In order to remain active on this Statewide Contract, Bidders must meet the following requirements regarding the amount of business conducted under the Statewide Contract: Vendors are required to have done business with an Eligible Entity within a two year period. Bidders who have not provided services for two consecutive years under this contract may be indefinitely suspended from new business

2. Continued qualification based on performance

a. Reports on Performance will be reviewed by the Contract Manager

b. Vendors should be…