ProviderManagementPlatform RFP FINAL - DOJ EIS CSS APPROVED 7.13.pdf

COVER PAGE

Oregon Department of Early Learning and Care

Is issuing this Request for Proposals (RFP) under OregonBuys Bid

# S-58100-00007532 for

PROVIDER MANAGEMENT PLATFORM

Date of Issue: Thursday, July 13th 2023

Opening Date: Monday, August 14th 2023 at 5:00 PM PT

Single Point of Contact (SPC): Ashley Griffin

Address: 700 Summer ST NE City, State, Zip: Salem, OR 97301

Phone (voice): 971-240-2426 E-mail: Ashley.Griffin@delc.oregon.gov

The State of Oregon promotes equal opportunity for all individuals without regard to age, color, disability, marital status, national origin, race, religion or creed, sex or gender, sexual orientation, or veteran status.

TABLE OF CONTENTS

SECTION 1: GENERAL INFORMATION

1.1 INTRODUCTION

1.2 SCHEDULE

1.3 SINGLE POINT OF CONTACT (SPC)

SECTION 2: AUTHORITY, OVERVIEW, AND SCOPE

2.1 AUTHORITY AND METHOD

2.2 DEFINITION OF TERMS

2.3 OVERVIEW AND PURPOSE

2.4 SYSTEM REQUIREMENT DESCRIPTION AND SCOPE OF SERVICES

SECTION 3: PROCUREMENT REQUIREMENTS AND EVALUATION

3.1 MINIMUM SUBMISSION REQUIREMENTS

3.2 ROUND 1 PROPOSAL REQUIREMENTS

SECTION 4: ROUND 1 SOLICITATION PROCESS

4.1 PUBLIC NOTICE

4.2 PRE-PROPOSAL CONFERENCE

4.3 QUESTIONS/ REQUESTS FOR CLARIFICATION

4.4 SOLICITATION PROTESTS

4.5 PROPOSAL DELIVERY OPTIONS

4.6 PROPOSAL MODIFICATION OR WITHDRAWAL

4.7 PROPOSAL DUE

4.8 PUBLIC OPENING

4.9 PROPOSAL REJECTION

4.10 ROUND 1 EVALUATION PROCESS

4.11 ROUND 1 POINT AND SCORE CALCULATIONS

4.12 ROUND 1 RANKING OF PROPOSERS

4.13 ROUND 1 NEXT STEP DETERMINATION

4.14 ROUND 2

4.15 ADDITIONAL ROUNDS

4.16 SCORING AND RANKING OF PROPOSERS FOR SUBSEQUENT ROUNDS

4.17 POINT AND SCORE CALCULATIONS

SECTION 5: CONTRACT NEGOTIATION

5.1 AWARD NOTIFICATION PROCESS

5.2 INTENT TO AWARD PROTEST

5.3 APPARENT SUCCESSFUL PROPOSER SUBMISSION REQUIREMENTS

5.4 CONTRACT NEGOTIATION

SECTION 6: MISCELLANEOUS

6.1 COMMITMENT TO DIVERSITY, EQUITY AND INCLUSION

6.2 CERTIFIED FIRM PARTICIPATION

6.3 GOVERNING LAWS AND REGULATIONS

6.4 OWNERSHIP / PERMISSION TO USE MATERIALS

6.5 CANCELLATION OF RFP; REJECTION OF PROPOSALS; NO DAMAGES

6.6 COST OF SUBMITTING A PROPOSAL

6.7 STATEWIDE E-WASTE/RECOVERY POLICY

6.8 RECYCLABLE PRODUCTS

6.9 CHECKLIST DISCLAIMER

LIST OF ATTACHMENTS

Attachment A: SAMPLE CONTRACT

Attachment B: DISCLOSURE EXEMPTION AFFIDAVIT

Attachment C: PROPOSER INFORMATION AND CERTIFICATION SHEET

Attachment D: REFERENCE CHECK FORM

Attachment E: PRICE PROPOSAL

Attachment F: SYSTEM REQUIREMENTS

Attachment G: RESPONSIBILITY INQUIRY

SECTION 1: GENERAL INFORMATION

1.1 INTRODUCTION

The Oregon Department of Early Learning and Care (“DELC” or “Agency”) is issuing this Request for Proposal (“RFP”) for Provider Management Platform.

DELC would like the System implemented in phases. Additional details on the Scope of the services are included in the System Requirements/Scope of Work section. DELC anticipates the award of one Contract from this RFP. The term of the Contract will be 3 years with options to renew.

1.2 SCHEDULE

The table below represents a tentative schedule of events. All times are listed in Pacific Time. All dates listed are subject to change. N/A denotes that event is not applicable to this RFP.

Event Date Time

RFP Release to OregonBuys 7/13/2023

Voluntary Pre-Proposal Conference 7/18/2023 1:30 PM PT

Questions / Clarification/Protests Due 07/21/2023 5:00 PM PT

Answers to Questions/Clarification/Protest posted to OregonBuys 07/24/2023 5:00 PM PT

Closing (Proposals Due) 8/14/2023 5:00 PM PT

Evaluation Team Evaluates Proposer Response 8/15/2023- 8/21/2023

Competitive Range Announcement 8/21/2023 5:00 PM PT

Presentations, Demonstrations, or Interviews 8/28/2023- 8/30/2023

Issuance of Notice of Intent to Award (approx.) 08/31/2023 5:00 PM PT

Award Protest Period Ends 7 days after posting of Intent To Award

1.3 SINGLE POINT OF CONTACT (SPC)

The SPC for this RFP is identified on the Cover Page, along with the SPC’s contact information.

Proposer shall direct all communications related to any provision of the RFP, whether about the technical requirements of the RFP, contractual requirements, the RFP process, or any other provision only to the SPC.

SECTION 2: AUTHORITY, OVERVIEW, AND SCOPE

2.1 AUTHORITY AND METHOD

DELC is issuing this RFP pursuant to its authority under ORS 279A.050 as amended by Senate Bill 427 (2023).

DELC is using the Competitive Sealed Proposals method, pursuant to ORS 279B.060 and OAR 137-047-0261. DELC may use a combination of the methods for Competitive Sealed Proposals, including optional procedures: a) Competitive Range; b) Discussions and Revised Proposals; c) Revised Rounds of Negotiations; d) Negotiations; e) Best and Final Offers; and f) Multistep Sealed Proposals.

2.2 DEFINITION OF TERMS

For the purposes of this RFP, capitalized words will refer to the following definitions.

2.2.1 General Definitions.

Capitalized terms not specifically defined in this document are defined in OAR 125-246- 0110. For terms used in reference to OregonBuys, the Terminology Crosswalk can be found at TerminologyCrosswalk(BothPhases).pdf (oregon.gov).

2.2.2 Project Specific Definitions.

“Central Background Registry” The database the Agency uses and maintains to track the individuals that have undergone Background Checks to provider child care.

“Child Safety Portal” A web portal run by the agency to serve as a resource for Oregon families to get information about the safety, health, and quality of licensed child care facilities.

“Conditional Enrollment” If a background check is only pending the results of an FBI criminal records check and the individual has been determined to be suitable based on their application having no disclosures of negative foster care history or a substantiated finding of adult abuse or neglect, no state disqualifying criminal records information, the individual has conditional enrollment.

http://arcweb.sos.state.or.us/pages/rules/oars_100/oar_125/125_246.html http://arcweb.sos.state.or.us/pages/rules/oars_100/oar_125/125_246.html https://www.oregon.gov/das/ORBuys/Documents/TerminologyCrosswalk(BothPhases).pdf

“ERDC Program” Employment Related Day Care Program that Oregon families can apply to, to receive subsidized child care.

“External Visit” Any type of in person check that must be performed by an external party of a providers' facility or residence.

“Facility” A place where child care is provided.

“KDIM Visit” A visit that is conducted for qualified, licensed providers that is quicker than average visits.

“License Exempt Provider” A provider that does not need to obtain a license to provide child care, but must complete other requirements (i.e. background checks).

“Licensed Provider” A provider that has obtained a license to provide child care among other requirements.

“Limited Enrollment” A restricted approval in the Central Background Registry that does not allow an individual to conduct unsupervised child care.

“Visit” Any type of in person check that must be performed by an Agency employee of a providers' facility or residence.

“Oregon Records Management System” An external, statewide program that provides information management tools, training and support for public entities in Oregon, which was developed to help agencies better manage information and records. The Agency must post specific documentation, data and records onto this external site.

“Overpayments” When a provider is paid more than what the provider is owed by the Agency.

“Quality Ratings / Spark Ratings” A quality evaluation metric that is conducted by an external system to evaluate the quality of early learning and care programs.

“Technical Assistance” The advice or corrections given by Office of Child Care field staff to childcare providers on how to rectify a small compliance issue preventing them from passing a visit.

2.3 OVERVIEW AND PURPOSE

2.3.1 Agency Overview and Background

The Department of Early Learning and Care’s (DELC) mission is to support all of Oregon’s young children and families to learn and thrive. DELC works as an integrated team focused on: Child Care, Early Learning Programs and Cross Systems Integration, Policy and Research, and Equity.

Per the directive of House Bill 3073, on July 1, 2023, the new early learning agency – the Department of Early Learning and Care (DELC) -- transitioned from Oregon Department of Education, Early Learning Division (ELD) into an independent agency and the Employment Related Day Care program (ERDC), a child care subsidy program currently administered by the Oregon Department of Human Services (ODHS), migrated to DELC.

2.3.2 Project Overview and Background

The Department of Early Learning and Care is a newly formed agency, truly in its infancy, that is bringing together many services throughout several agencies focused on servicing the needs of the state’s most vulnerable customers. DELC’s aim is to fulfill the State Chief Information Officer’s mandate to move to a cloud-based, data driven solution. At the same time, DELC expects to go through many organizational and legislative changes, especially within the first few years of the Agency’s infancy. The solution provided pursuant to this RFP must be designed so that it is dynamic and flexible enough to make large changes or additions that are custom to the Agency’s changing but specific needs. After the solution is implemented, DELC anticipates the need to release additional solicitations to adapt the supplied solution, as-needed. (see requirements #NF-006-0014, -0015 in Attachment F)

2.4 SYSTEM REQUIREMENT DESCRIPTION AND SCOPE OF SERVICES

2.4.1 System Requirements

The System Requirements for this project are found in Attachment F, System Requirements.

2.4.2 Scope of Services

2.4.2.1 DELC believes the System can be implemented in the following phases:

Phase 1: Replacement of the current Provider Pay and Service authorization system from Oregon Department of Human Services (ODHS).

Phase 1 includes project management, implementation / development services, data conversion, testing and defect management, training, operations and maintenance, transition support, disaster recovery, and business continuity services.

All Phase 1 functionality must be configured, implemented, and in production by December 2024.

Phase 2: Replacement of the current Child Care Regulatory Information System (CCRIS) functionality.

Phase 2 includes project management, implementation / development services, data conversion, testing and defect management, training, operations and maintenance, transition support, disaster recovery, business continuity services and project close-out. Contractor shall not begin work on Phase 2 until Agency has issued a notice of intent to proceed and the parties have agreed upon the Services to be provided and amended the Contract as necessary and Agency has received all necessary approvals.

2.4.2.2 Additional Services

In addition to the System, Proposer must provide the following services to DELC:

a. Project Planning and Project Management: Proposer shall provide all project management services necessary to complete the implementation of the System in a two phase process from the kick-off meeting(s) through closeout of each phase and final closeout of the implementation of both phases. Proposer shall develop a Project Management Plan (PMP ®) to include as part of the Project. The Plan must include standard project management details, an organizational change management plan, a communication management plan, and a project schedule.

b. Fit-Gap Analysis: Proposer shall provide a Fit-Gap Analysis using information provided in the System Requirements, Exhibit F. The Fit-Gap Analysis should include Proposer’s strategies to address anticipated process changes and improving configuration of the System to meet business needs.

c. System Architecture: Proposer shall provide both a narrative description of the Solution architecture and a diagram detailing the architecture.

d. Timeline: Proposer shall provide an anticipated timeline for the project based on prior experience and the phased implementation.

e. System Interfaces and Integration Plan: Proposer shall develop a plan for system interface and integration to address state and ODHS’s and DELC’s data systems, including but not limited to Statewide Financial Management Application (SFMA) and Awards Management Systems (AMS). The plan must include at a minimum, standard components including system to system required information, technical strategies for identifying and matching data elements and system functions, development risks, configuration and quality management procedures, and security controls.

f. Data Migration and Conversion: Proposer shall develop a Data Migration/Conversion Plan, which describes the strategy for converting and validating all legacy system data into the System. The Plan should describe the general approach used to extract, transform, cleanse, and load data from the legacy systems to the System. Describe any automated tools that will be used, any parts of the conversion to be done manually, how potential constraints or conflicts will be handled, and the approach to quality control before and after conversions. DELC intends to migrate data from legacy systems that are housed at two different agencies (ODHS and OED).

g. Implementation: Proposer shall develop a phased Implementation Plan for DELC that outlines the tasks and activities that will take place during implementation as well as describe Proposer’s overall strategy and services needed for the System Go- Live. The Plan must include a detailed description of Proposer’s provided support through implementation, implementation services timeline, and rollback strategy.

h. Test Plan: Proposer shall develop a Test Plan that outlines the test strategy, execution strategy, test management process, and Plan timeline.

i. User and Acceptance Testing: Proper shall develop a User and Acceptance Testing Plan that outlines the strategy used for deliverables that are susceptible to acceptance testing. The Plan should include:

i. Testing and acceptance timelines, tasks, and activities for deliverables.

ii. Information detailing user notification and support in testing deliverables.

iii. Action for notice of non-acceptance of deliverables.

j. Sandbox/Testing Environment: Proposer shall provide a description only of Sandbox/Testing Environment and the proposed period of use. Describe whether this environment will only be accessible during testing or if it will be made available after testing is complete.

k. Training: Proposer shall develop a Training Plan, which identifies the approach to training, schedule, tools, environments, readiness, and user guides for DELC. This plan should also include information on how changes to software releases and or regulatory compliance will be incorporated into training and training materials.

l. Post implementation Go-Live Support: Proposer should outline services provided and the duration of such services to support the System post-implementation in Phase 1 and after Phase 2 for DELC.

m. System Security Plan: Proposer shall assist DLEC in documenting a System Security Plan following the Enterprise Information Services (EIS) Cyber Security Services (CSS) Security Plan Template at https://www.oregon.gov/das/OSCIO/Documents/SystemSecurityPlan.docx.

n. Project Close-Out: Proposer shall develop a Project Close-Out Plan. The Plan must include: how Proposer will finalize all activities and ensure completion, all work has https://www.oregon.gov/das/OSCIO/Documents/SystemSecurityPlan.docx received formal written acceptance, ensure transfer of project knowledge, actions and activities necessary to transfer the project’s products/services to Operations and Maintenance, and a closing report.

o. Ongoing Services, Maintenance and Repair; Customer Services/Help Desk:

Proposer must provide a description of any ongoing services, maintenance and repair, customer services and/or help desk services and the timeframe for which each will be provided to DELC. As a part of its ongoing Services, Proposer shall submit:

i. An Escalation Plan that includes: the procedure to be used during the implementation and post implementation of the project if resolution is required to a conflict arising during the duration of the resulting Contract and a call prioritization guidelines including names, titles, and contact information.

ii. A Disaster Recovery Plan that reflects the Proposer-recommended and DELC-authorized approach for DELC to use in the event of an agency or contractor declared disaster. The plan must define the scope, objectives, and stakeholders related to disaster recovery procedures that would be used to maintain ongoing services. The Plan must include a Recovery Time Objective (RTO) and a Recover Point Objective (RPO).

p. License Agreement, Subscription Agreement, Performance Standards and Service Level Agreement (SLA)

Proposer shall provide its license agreement, subscription agreement, and all other agreements related to or necessary for its System(s) and Services, including Proposer’s service level standards.

SECTION 3: PROCUREMENT REQUIREMENTS

3.1 MINIMUM SUBMISSION REQUIREMENTS

3.1.1 Round 1 Proposal Submissions

To be considered for evaluation, the Proposal must contain each of the following elements (further detailed in Proposal Requirements section below):

• Proposer Information and Certification Sheet (Attachment C)

• Executive Summary

• Proposer’s Organization Profile

• Experience and Capabilities

• Key Persons, Organizational Chart, Subcontractors

• Scope of Work

• System Requirements (Attachment F)

• Price Proposal (Attachment E)

• Reference Check Form (Attachment D)

• Project Samples

• Underlying Agreements

• Disclosure Exemption Affidavit (Attachment B) – submit 1 copy only

3.1.2 Proposal Page Limits

Proposal is limited to 75 pages. Any pages exceeding this limit will not be provided to the evaluation committee or considered in the evaluation. The following items do not count toward the page limit:

• Disclosure Exemption Affidavit (Attachment B)

• Proposer Information and Certification Sheet (Attachment C)

• Reference Check forms (Attachment D)

• Price Proposal (Attachment E)

• Work samples

3.1.3 Proposal Format and Quantity

Proposal should follow the format and reference the sections listed in the Proposal Requirements section. Responses to each section and subsection should be labeled to indicate the item being addressed.

OregonBuys Electronic Response. Proposer should submit its Proposal electronically through OregonBuys. Proposer should follow the procedures outlined in See: Section

4.5.1 for electronic submission.

The Price Proposal must be submitted as a separate electronic response file.

Proposer shall submit one copy of its Proposal and all other submittal requirements, with Attachment C - Proposer Information and Certification Sheet bearing the Proposer’s authorized representative’s Signature, in one of the following formats: Adobe Acrobat (pdf), Microsoft Word (docx), or Microsoft Excel (xlsx). If Proposer believes any of its Proposal is exempt from disclosure under Oregon Public Records Law (ORS 192.311 through 192.478), Proposer shall complete and submit the Disclosure Exemption Affidavit (Attachment B).

Proposer shall also mark as “Confidential” in OregonBuys all attachments to its Proposal that Proposer believes are exempt from disclosure.

The Proposer Information and Certification Sheet (Attachment C) must bear the Proposer’s authorized representative’s Signature.

3.1.4 Authorized Representative

The Proposer Information and Certification Sheet (Attachment C) must bear the Proposer’s authorized representative’s Signature. Failure of the authorized representative to sign the Proposal may subject the Proposal to rejection by DELC.

3.2 ROUND 1 PROPOSAL REQUIREMENTS

Proposal must address each of the items listed in this section and all other requirements set forth in this RFP. Proposer shall describe the Goods to be provided or the Services to be performed or both. A Proposal that merely offers to provide the goods or services as stated in this RFP may be considered non-Responsive to this RFP and will not be considered further.

Proposal should not include extensive art work, unusual printing or other materials not essential to the utility and clarity of the Proposal. Do not include marketing or advertising material in the Proposal. Proposal should be straightforward and address the requests of the RFP. Proposal containing excess marketing or advertising material may receive a lower evaluation score if specific information is difficult to locate.

3.2.1 Proposer Information and Certification Sheet (Not Scored)

Proposer shall complete and submit the Attachment C (Proposer Information and Certification Sheet).

Failure to demonstrate compliance with Oregon Tax Laws and sign the Proposer Information and Certification Sheet (Attachment C) may result in a finding of non- Responsibility.

3.2.2 Executive Summary. (Not Scored)

Briefly describe how the proposed solution addresses the high level requirements listed below. These requirements form the basis for a comprehensive yet succinct Executive Summary, not to exceed three pages, that summarizes the proposed solution, its distinctive features, and how it will fulfill the State’s requirements. The Executive Summary may also contain a high-level “block” diagram of the proposed solution in addition to the three pages.

Proposer’s response shall delineate any potential single points of failure in the proposed solution. The high level requirements that the proposed solution must address include the following:

o System Requirements, including hardware and software, network requirements and capability, selective routing, and databases and database services, security requirements, service levels and service level requirements o Services, including : project management, project plan and schedule, data gathering, network design meeting all system requirements, implementation, data migration and training o Ongoing Services, including,: network management, monitoring, reporting, maintenance and repair, and Customer Services/Help Desk

3.2.3 Proposer’s Organization Profile (Scored)

Proposer must provide a profile of its organization. This is Proposer’s opportunity to give an overview of its organization, describe the structure of its business, and discuss how the organization can effectively deliver the Services described in this RFP. The Profile must include:

1. Ownership. If incorporated, the state in which the organization is incorporated and the date of the incorporation;

2. Location of the organization’s offices (headquarters and branches);

3. Location of the office from which employees will be assigned to work on the Project for DELC;

4. Number of employees located in the Pacific Northwest, nationally, and internationally;

5. Established business relationships with proposed subcontractors (e.g., data conversion contractor); and

6. Organization’s client base.

3.2.4 Experience and Capabilities (Scored)

Proposer must demonstrate Proposer has a minimum of five (5) years of experience providing services similar to this RFP. Proposer must have at least one (1) system successfully implemented in the past three (3) years of similar scope and size.

3.2.5 Key Persons, Organizational Chart and Subcontractors (Scored)

Key Persons. Proposer shall specify key persons to be assigned to the Services and include a current resume (not to exceed two (2) pages each) for each individual that demonstrates qualifications and experience for the Services proposed.

• The following are required for Key Person(s):.

• Strong project management, business analysis, budgeting, and financial analysis experience and knowledge are required.

• Recent experience, in last three (3) years, and knowledge serving as key advisor and partner with business and IT executives in project management strategy and approaches with multi-million-dollar projects is required including experience in the following:

o Reviewing, making recommendations, and drafting procedures to implement best practices, mature project management practices, and meet requirements.

• Demonstrate Contractor has internal quality control practices for its Key Person(s) to use when reviewing, editing, and providing feedback on projects and project artifacts is required.

• Recent experience, in last three (3) years, developing, performing, and facilitating system testing activities is required.

• Strong quality control experience and knowledge required.

• Demonstrated experience, within the last three (3) years, in business analysis for complex information technology projects is required.

• Demonstrated experience, in the last three (3) years, in data conversion/migration, and system integration is required.

The following are preferred for Key Person(s):

• Project Management Institute’s Project Management Professional (“PMP”) Certification is preferred for project management

• Experience in Business Analysis Body of Knowledge, version 3 (“BABOK”) guidelines is preferred.

• Bachelor’s degree or higher in computer science, public administration, business management or another relevant field is preferred.

• Strong understanding of public sector environment is preferred.

Due to the nature of services, Key Person(s) must be available to work remotely and on site as agreed. Work site is designated as DELC’s headquarters office in Salem, Oregon.

Organizational Chart. Proposer shall provide an organizational chart identifying the staffing that will provide the Services required by this RFP, illustrating the lines of authority as appropriate.

Subcontractors. If Proposer intends to work with subcontractor(s), Proposer shall include a statement detailing any subcontracting firms or individual subcontractors that may be engaged as part of the Proposal to this RFP, with those entities and the Services they will provide clearly identified.

3.2.6 Scope of Work (Scored)

Proposer must submit a Scope of Work for a phased implementation with detailed tasks and deliverables for Phase 1, including a project timeline, and a high-level project plan for Phase 2, based upon the information in Section 3.2.5 above.

3.2.7 Security Requirements (Mandatory, Not Scored)

To be considered for evaluation, the Proposal must demonstrate how the Proposer meets all requirements of this section:

1. Data Protections

• Proposer understands and has the capability of handling and protecting Agency Data that has been classified as Level 3 Information under the State of Oregon’s Information Asset Classification policy, available online at https://www.oregon.gov/das/Policies/107-004-050.pdf.

• Proposer and its employees, contractors, and agents shall comply with all applicable state and federal laws and regulations, and State of Oregon policies governing Agency Data and its use and disclosure, including as those laws, regulations, and policies may be updated from time to time, including:

Oregon’s Statewide Information Security Standards, found online at:

https://www.oregon.gov/das/OSCIO/Pages/SecurityGuidance.aspx, including security controls that meet or exceed “Moderate” security controls in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53.

Oregon’s Statewide Information Security Plan, found online at:

https://www.oregon.gov/das/OSCIO/Pages/SecurityGuidance.aspx.S tatewide Cloud Computing policy:

http://www.oregon.gov/das/policies/107-004-150.pdfOregon’s Statewide Information Technology Policies:

www.oregon.gov/das/Pages/policies.aspx#IT.

Privileged Access Monitoring and Reporting viewable at:

https://www.oregon.gov/das/Policies/107-004-140.pdf

The Oregon Consumer Information Protection Act (OCIPA), ORS 646A.600 through 646A.628, to the extent applicable. For purposes of OCIPA, Proposer is a vendor.

2. Security Narrative

As an organization that shares in the responsibilities to protect the state's data, it is important to understand how cybersecurity principles at an architectural and organizational level will be applied. Provide a narrative that describes the organization's security program as it relates to the proposed solution, addressing the following NIST 800-53 control families in the response.

Control Family Required Topics

AC Access Control Account Management, Least Privilege

AT Awareness and Training

Cybersecurity training

AU Audit and Accountability

Logging and Auditing

CA Security Assessment and Authorization

Penetration tests, Security assessments

CM Configuration Management

CP Contingency Planning

DR/BCP

IA Identification and Authentication

General Authentication (MFA, modern auth)

IR Incident Response

Incident response plans and procedures

MA Maintenance Patching MP Media

Protection

PE Physical and Environmental

PL Planning PM Program

Management Governance (Security Program , Plan of Action and Milestones, System Inventory)

PS Personnel Security

Background Checks

PT PII Processing and

Transparency RA Risk Assessment Vulnerability

Management, General Risk Management

SA System and Services Acquisition

Secure Development

SC System and Communications

SI System and Information Integrity

Remediation, System Monitoring, Malicious Code Protection

SR Supply Chain Risk Management

3. Background Checks

Proposer and Proposer's staff monitoring the systems who will have access to State systems, facilities, and confidential information will submit to all security checks requested by Agency, which may include any combination of fingerprinting, Oregon Law Enforcement Data Systems (“LEDS”) and Federal Bureau of Investigation Criminal Justice Information Services (“FBI CJIS”) background checks.

3.2.8 Price Proposal (Scored)

Proposer shall complete and submit the Price Proposal (Attachment E).

3.2.9 References (Scored)

Provide 3 references from current or former client firms for similar projects performed for any clients within the last 5 years. References must be able to verify the quality of previous, related Work.

Proposer shall send the Reference Check Form (Attachment D) to its references.

Reference forms must be completed by the reference. Reference forms should be collected by the Proposer and submitted with the Proposal.

DELC may check to determine if references provided support Proposer’s ability to comply with the requirements of this RFP. DELC may use references to obtain additional information, or verify any information needed. DELC may contact any reference (submitted or not) to verify Proposer’s qualifications.

3.2.10 Project Samples. (Scored)

Proposer shall submit a project summary for two (2) previously completed projects that align with the scope of this RFP. These projects must have been completed within the last 5 years.

3.2.11 System Requirements (Scored)

Proposer shall complete Attachment F, System Requirements.

3.2.12 Value Added Services (Not scored)

If Proposer is proposing any value-added services, Proposer shall include a statement describing these services. Proposer may submit services including solution engineering, installation, configuration, training and maintenance/support, the corresponding prices and subcontractors and/or resellers available to provide said services.

3.2.13 Underlying Agreements (Not Scored)

Proposer will submit any additional documents required for this project (e.g., End User License Agreement (EULA), Maintenance Agreement, Service Level Agreement (SLA), etc.).

3.2.14 Disclosure Exemption Affidavit (Pass/Fail)

Proposer shall complete and submit the Disclosure Exemption Affidavit (Attachment B) as part of the Proposal. Submission is required even if Proposer is not identifying confidential or proprietary information and data for nondisclosure. If Proposer is identifying items for nondisclosure as confidential or proprietary, Proposer must specify the reason for the exemption and Proposer must provide an appropriately redacted single hard copy and single electronic copy of the complete, original Proposal submission (see section 3.1.2).

SECTION 4: ROUND 1 SOLICITATION PROCESS

4.1 Public Notice

The RFP and attachments are published in the State of Oregon’s electronic procurement system OregonBuys at https://oregonbuys.gov/. Documents will not be mailed to prospective Proposers.

Modifications, if any, to this RFP will be made by written Amendment(s) published in OregonBuys. Prospective Proposer is solely responsible for checking OregonBuys to determine whether or not any Amendment(s) have been issued. Amendment(s) are incorporated into the RFP by this reference.

4.2 Pre-Proposal Conference

A pre-Proposal conference will be held at the date and time listed in the Schedule.

Prospective Proposers’ participation in this conference is VOLUNTARY. Prospective Proposers may attend virtually with the Zoom Conference information below..

The purpose of the pre-Proposal conference is to:

• Provide additional description of the project;

• Explain the RFP process; and

• Answer any questions Proposers may have related to the project or the process.

The pre-Proposal meeting will be held on Tuesday, July 18th 2023 at 1:30 PM PT

Please use Zoom Link:

https://www.zoomgov.com/j/1618464477?pwd=N2F6THBBcUt1WEppNjI0bURrK09rZz09

Zoom Call in information:

Meeting ID: 161 846 4477 Passcode: 791414 One tap mobile +16692545252,,1618464477# US (San Jose) +16692161590,,1618464477# US (San Jose)

Statements made at the pre-Proposal conference are not binding. DELC Proposers may be asked to submit questions in Writing.

Interested parties may participate in the Preproposal Conference by:

4.3 Questions / Requests for Clarification

All inquiries, whether relating to the RFP process, administration, deadline or method of https://oregonbuys.gov/ https://www.zoomgov.com/j/1618464477?pwd=N2F6THBBcUt1WEppNjI0bURrK09rZz09 award, or to the intent or technical aspects of the RFP must:

• Be delivered to the SPC via an OregonBuys submission, email, or hard copy;

• Reference the OregonBuys bid number;

• Identify Proposer’s name and contact information

• Refer to the specific area of the RFP being questioned (i.e. page, section and paragraph number); and

• Be received by the due date and time for Questions/Requests for Clarification identified in the Schedule in Section 1.2.

4.4 SOLICITATION PROTESTS

4.4.1 Protests to RFP

Prospective Proposer may submit a Written protest of anything contained in this RFP, including but not limited to, the RFP process, Specifications, Scope of Services, and the proposed Contract. This is prospective Proposer’s only opportunity to protest the provisions of the RFP, except for protests of Addenda or the terms and conditions of the proposed Contract, as provided below.

4.4.2 Protests to Amendment(s)

Prospective Proposer may submit a Written protest of anything contained in an Amendment. Protests to an Amendment, if issued, must be submitted by 5:00 p.m. Pacific Time on the second Business Day following the issuance of the Amendment or the date/time specified in the Amendment, or they will not be considered. Protests of matters not added or modified by the respective Amendment will not be considered.

4.4.3 Requirements for Protests:

Protests must:

• Be delivered to the SPC via email or hard copy;

• Reference the OregonBuys bid number;

• Identify prospective Proposer’s name and contact information;

• Be sent by an authorized representative;

• State the reason for the protest, including:

o the grounds that demonstrate how the Procurement Process is contrary to law, Unnecessarily Restrictive, legally flawed, or improperly specifies a brand name; and o evidence or documentation that supports the grounds on which the protest is based

• State the proposed changes to the RFP provisions or other relief sought

Protests to the RFP must be received by the due date and time identified in the Schedule.

Protests to Amendment must be received by the due date identified in the respective Amendment.

4.5 PROPOSAL DELIVERY OPTIONS

Proposer is solely responsible for ensuring its Proposal is received by the SPC in accordance with the RFP requirements before Opening. DELC is not responsible for any delays in mail or by common carriers or by transmission errors or delays, or for any mis-delivery for any reason. A Proposal submitted by any means not authorized below will be rejected. The following delivery options are permitted for this RFP:

4.5.1 Delivery through OregonBuys

Proposal submission should be electronically through OregonBuys at: OregonBuys.gov.

Detailed instructions on how to submit a Proposal can be found at OregonBuys Vendor Formal Solicitation Response.pdf

4.6 PROPOSAL MODIFICATION OR WITHDRAWAL

If a Proposer wishes to make modifications to a submitted Proposal, the Proposer must submit its modification in the authorized method listed in Section 4.5 (Proposal Delivery Options). To be effective the notice must include the OregonBuys bid number and be submitted to the SPC prior to Opening.

If a Proposer wishes to withdraw a submitted Proposal, it must submit a Written notice signed by an authorized representative of its intent to withdraw to the SPC via email or hard copy prior to Opening in accordance with OAR 137-047-0440. To be effective the notice must include the OregonBuys bid number.

4.7 PROPOSAL DUE

A Proposal (including all required submittal items) must be received by the SPC on or before Closing. All Proposal modifications or withdrawals must be received prior to Closing.

A Proposal received after Closing is considered LATE and will NOT be accepted for evaluation. A late Proposal will be returned to the Proposer or destroyed.

4.8 PUBLIC OPENING

There will be no public Opening of Proposals. Proposals received will not be available for inspection until after the evaluation process has been completed and the Notice of Intent https://www.oregon.gov/das/ORBuys/Documents/OregonBuys%20Vendor%20Formal%20Solicitation%20Response.pdf https://www.oregon.gov/das/ORBuys/Documents/OregonBuys%20Vendor%20Formal%20Solicitation%20Response.pdf to Award is issued pursuant to OAR 137-047-0630. However, DELC will record and make available the identity of all Proposers after Opening.

4.9 PROPOSAL REJECTION

DELC may reject a Proposal for any of the following reasons:

• Proposer fails to substantially comply with all prescribed RFP procedures and requirements, including but not limited to the requirement that Proposer’s authorized representative sign the Proposal.

• Proposer has liquidated and delinquent debt owed to the State or any agency, board, commission, department or division of the State.

• Proposer fails to meet the responsibility requirements of ORS 279B.110.

• Proposer makes any contact regarding this RFP with State representatives such as State employees or officials other than the SPC or those the SPC authorizes, or inappropriate contact with the SPC.

• Proposer attempts to inappropriately influence a member of the Evaluation Committee.

• Proposal is conditioned on DELC’s acceptance of any other terms and conditions or rights to negotiate any alternative terms and conditions that are not reasonably related to those expressly authorized for negotiation in the RFP or Amendments.

4.10 ROUND 1 EVALUATION PROCESS

4.10.1 Responsiveness and Responsibility Determination

4.10.1.1 Responsiveness determination

A Proposal received prior to Closing will be reviewed to determine if it is Responsive to all RFP requirements including compliance with Section 3.2 (Round 1 Proposal Requirements). If the Proposal is unclear, the SPC may request clarification from Proposer. However, clarifications may not be used to rehabilitate a non-Responsive proposal. If the SPC finds the Proposal non-Responsive, the Proposal may be rejected, however, DELC may waive mistakes in accordance with OAR 137-047-0470.

4.10.1.2 Responsibility determination

DELC will determine if an apparent successful Proposer is Responsible prior to award and execution of the Contract. Proposer shall submit a signed Responsibility Inquiry (Attachment G) within 5 Business Days of receipt of Intent to Award notice.

At any time prior to award, DELC may reject a Proposer found to be not Responsible.

4.10.2 Evaluation Criteria

Each Proposal meeting all Responsiveness requirements will be independently evaluated by members of an Evaluation Committee. Evaluation Committee members may change and DELC may have additional or fewer evaluators for optional rounds of competition.

Evaluators will assign a score for each evaluation criterion listed below in this section

4.10.2 up to the maximum points available as specified in Section 4.11 (Point and Score Calculation).

SPC may request further clarification to assist the Evaluation Committee in gaining additional understanding of Proposal. A response to a clarification request must be to clarify or explain portions of the already submitted Proposal and may not contain new information not included in the original Proposal.

The Proposals will be scored as follows for Round 1:

4.10.2.1 Proposer’s Organization Profile (50 Points)

Does Proposer demonstrate sufficient experience in providing the Services?

4.10.2.2 Experience and Capabilities (100 Points)

Proposer must demonstrate Proposer has a minimum of five (5) years of experience providing services similar to this RFP.

4.10.2.3 Key Persons, Organizational Chart and Subcontractors (150 Points)

Degree to which Proposer shall provide a sufficient number of Key Persons and support personnel qualified by experience, credentials and capabilities to deliver the requested services.

4.10.2.4 Scope of Work (200 Points)

The degree to which Proposer demonstrates a clear understanding of the services requested in this RFP, and the business and technical resources that equip Proposer to consistently deliver superior service.

4.10.2.5 Price

Price is not scored in Round 1.

4.10.2.6 References (30 Points)

References will be scored using the formula below, based upon the Proposer’s scores as given by each reference in response to the three (3) experience related questions, using the form in Attachment D.

If the Proposer fails to submit the required three (3) references, the Proposer will receive a zero score for each missing reference.

Each individual reference will be scored, up to 10 points, and then the SPC will combine the three scores received and divide that total by 30, this number will then be multiplied by the 30 points allotted for this category to determine the Proposer’s final reference score.

Total Score for 3 References (Max of 30 Points)

X 10 = Reference Score

4.10.2.7 Project Samples (70 Points)

Degree to which the project samples show work consistent with that required in this

RFP.

4.10.2.8 System Requirements (400 Points)

This spreadsheet is automatically tabulated.

4.10.3 PREFERENCES

4.10.3.1 Reciprocal Preference

For evaluation purposes per OAR 137-046-0310, DELC shall add a percent increase to each out-of-state Proposer's Proposal price that is equal to the percent preference, if any, given to a Resident Offeror in the Proposer's state.

4.10.3.2 Recycled Materials

In comparing Goods from two or more Proposers, if at least one Proposer offers Goods manufactured with Recycled Materials, and at least one Proposer does not, DELC will select the Proposer offering Goods manufactured from Recycled Materials if each of the conditions specified in ORS 279A.125 (2) exists following any adjustments made to the price of the Goods according to any applicable reciprocal preference.

4.10.3.3 Tiebreakers

Oregon Supplies: If DELC receives Proposals identical in price, fitness, availability and quality and chooses to award a Contract, DELC shall award the Contract in accordance with the procedures outlined in OAR 137-046-0300.

http://www.oregon.gov/DAS/EGS/ps/Pages/reciprocal.aspx

4.11 ROUND 1 POINT AND SCORE CALCULATIONS

Scores are the points assigned by each evaluator. In each round, an evaluator may change a score up until the time the SPC has requested final scores for that round. If an evaluator elects to change any score, the evaluator must date and initial the change and include a reason for the change. The evaluator’s final score will be the score the SPC will document.

The maximum points possible for each evaluation item are listed in the table below.

Cost points are calculated as stated in the Cost Evaluation section.

Round Maximum Points Available

Organization Profile 50

Experience and Capabilities 100

Key Persons, Organizational Chart and Subcontractors 150

Scope of Services 200

Reference 30

Project Samples 70

System Requirements 400

TOTAL POINTS 1000

4.12 ROUND 1 RANKING OF PROPOSERS

The SPC, in its sole discretion, may conduct an evaluation committee meeting at the end of any round and the evaluators may review their scores. If the SPC elects to conduct an evaluation committee meeting, the SPC will ask for final scores at the end of the meeting.

The SPC will average the final scores for each Proposal in a given round of competition (calculated by totaling the points awarded by each Evaluation Committee member and dividing by the number of members).

DELC will rank all Proposers at the conclusion of the evaluation and scoring and may, in DELC’s sole discretion, determine an apparent successful Proposer with no additional rounds of competition. If additional rounds are conducted, DELC will rank advancing Proposers at the conclusion of each subsequent round and may determine an apparent successful Proposer at any time during the solicitation process.

The SPC will apply any applicable preferences and combine the average score for each Proposal with Proposer’s price score. SPC will describe the rank order for each Proposer, with the highest score receiving the highest rank, and successive rank order determined by the next highest score.

4.13 ROUND 1 NEXT STEP DETERMINATION

At the conclusion of Round 1 evaluation, DELC may determine the Apparent Successful Proposer or may choose to conduct additional round(s) of competition if in the best interest of the State. Additional rounds of competition may consist of:

• Interviews

• Presentations/Demonstrations/Additional Submittal Items

• Site visits

• Discussions and submittal of revised Proposals

• Serial or simultaneous negotiations

• Best and Final Offers

4.13.1 Competitive Range Determination

If DELC, in its sole discretion, determines that one or more additional rounds of competition is necessary, it will select a Competitive Range to indicate the Proposers that will be invited to participate in a subsequent round. The Competitive Range may include all, or at DELC’s sole discretion, some (based primarily on a natural break in the distribution of scores), of the Proposers from a previous round. DELC will post a notice in ORPIN of its Competitive Range Determination and provide details about the process and schedule for the subsequent round.

4.13.2 Competitive Range Protest

Proposers excluded from a round may submit a Written protest of Competitive Range.

Protests must:

• Be emailed to the SPC;

• Reference the OregonBuys bid number;

• Identify Proposer’s name and contact information;

• Be sent by an authorized representative;

• State the reason for the protest; and

• Be received within 7 calendar days after issuance of the Notice of the Competitive

Range unless a different due date and time is specified in such notice.

DELC will address all protests within a reasonable time and will issue a Written decision to the respective Proposer. Protests that do not include the required information may not be considered by DELC.

4.14 ROUND 2

4.14.1 Price Proposal Evaluation

As part of this round 2, price proposals will be evaluated by the Evaluation Committee.

4.14.2 Additional Submittals or Requirements

This round 2 may contain demonstration, interviews, sandbox, site visits and best and final offers.

4.15 ADDITIONAL ROUNDS

4.15.1 Demonstration (Scored)

Proposers progressing to Round 2 may be invited to provide demonstrations.

Demonstrations may be in person at a location determined by DELC; however, DELC may elect to conduct demonstrations via teleconference or video conference. Further details will be provided prior to scheduling demonstrations.

4.15.2 Interviews (Scored)

Proposers progressing to Round 2 may be invited to interviews. Interviews may be in person at a location determined by DELC; however, DELC may elect to conduct interviews via teleconference or video conference. Further details will be provided prior to scheduling demonstrations.

4.15.3 Sandbox (Scored)

DELC may elect to evaluate the Proposers’ current system(s) via a Sandbox environment. The Proposer will provide Agency access to a standard operational environment in which the execution, operation, and processes can be tested and evaluated. The evaluation criteria will be based upon both objective and subjective tests with points awarded. The criteria and number of points awarded will be provided to the selected Proposers when and if the Sandbox is used.

4.15.4 Site Visits (Scored)

DELC may elect to conduct site visits of Proposer’s references or other Proposer clients.

Proposer will assist in coordinating these visits.

4.15.5 Best and Final Offers (Scored)

Proposers in the Competitive Range may be asked to submit Best and Final Offers.

Further details will be provided when and if Best and Final Offers will be used.

4.16 SCORING AND RANKING OF PROPOSERS FOR SUBSEQUENT ROUNDS

If Agency conducts two or more rounds of competition, the score from each round will be added to subsequent rounds. The Proposer with the highest cumulative score will receive the highest final ranking.

4.17 POINT AND SCORE CALCULATIONS

Agency will add the scores from all rounds conducted for a total by Proposer in the Competitive Range.

Rounds Maximum Points Available

Round 1 Scores:

Organization Profile 50

Experience and Capabilities 100

Key Persons, Organizational Chart and Subcontractors 150

Scope of Services 200

References 30

Project Samples 70

System Requirements 400

Total Score Round 1 1000

Round 2 Scores:

Demonstration/Interview 300

Price 200

Total Score Round 2 500

SECTION 5: AWARD AND NEGOTIATION

5.1 AWARD NOTIFICATION PROCESS

5.1.1 Award Consideration

DELC, if it awards a Contract, shall award a Contract to the highest ranking Responsible Proposer(s) based upon the scoring methodology and process described in Section 4.

DELC may award less than the full Scope defined in this RFP.

5.1.2 Intent to Award Notice

DELC will notify all Proposers in Writing that DELC intends to award a Contract to the selected…