2627-02 RFP OIR

Market Conduct Multi-State Examination

Questions and Answers

Failure to file a protest within the time prescribed in section 120.57(3), F.S., or failure to post the bond or other security required by law within the time allowed for filing a bond shall constitute a waiver of proceedings under Chapter 120, F.S.

Below are the questions and answers related to this solicitation. In the table below, the Department of Financial Services (Department) has answered each of the questions submitted by potential respondents.

No. Attachment Identifier

Section Number

Sub-Section Reference

Item Reference

Page No. Question Department Response

1. Attachment 1- Special Contract Conditions

17- Indemnification

6 of 9 Would the Office consider limiting indemnification obligations to Contractor’s gross negligence or willful misconduct?

Indemnification shall be as provided in paragraph 7.f.

Attachment 2 – Scope of Services Agreement.

2. Attachment 5 Data Security Requirements

2-Data Security;

4. Data Access and Storage 5.

Data Encryption and Protection

2a. NIST;

2d.Cloud Service;

4b. Access

2 of 4 Attachment 5 sets data security obligations for the Contractor, including meeting the NIST Cybersecurity Framework, Version 1.1, under Rule Chapter

A Respondent should be prepared to demonstrate at the time of contract execution that it is in compliance with Attachment 5, Data Security Requirements. If a Respondent, however, 60GG-2, F.A.C. (section 2.a), SOC 2 Type II audits for a Cloud Service Provider (section 2.d), controls on access and remote access (section 4), and encryption of data in transit (section 5). For a market conduct examination contractor that handles Non-Open Data mainly on its own business systems, please confirm: (a) whether the Office expects the Contractor to show compliance with Attachment 5 at contract execution or during performance, and what evidence (if any) the Office will require, such as a written attestation, policies, or a third-party report; and (b) whether a Contractor that uses commercial cloud services, such as email and document storage, to hold examination work papers is a "Cloud Service Provider" under section 1.d and subject to section 2.d requires time to demonstrate its ability to comply with Attachment, Data Security Requirements, it must be able to do so prior to the provision of services contemplated by Attachment 2, Scope of Services.

Demonstration of such compliance will be in any manner deemed acceptable by the Office’s IT Security Team.

Respondent should be prepared to demonstrate, if requested, that it is a Cloud Services consumer or user and not a Cloud Services Provider. Such demonstration, however, will not relieve Respondent from the affirmative data usage and security requirements contemplated by Attachment 5 – Data Security Requirements.

3 Attachment 5 Data Security Requirements

6-Breach and Liability

3 of 4 Would the Office consider a reasonable cap for the obligations in this subsection?

In accordance with section

3.1 of the RFP, Respondents may provide alternative contractual terms that are equivalent to or exceed the Office’s contractual terms and conditions without being deemed non-responsive.

If the Office deems a response that includes alternative contractual terms otherwise responsive, the Office reserves the right to accept, reject or modify any proposed alternative contractual terms and, should the Office decide to modify or reject such proposed alternative contractual terms it will provide the Respondent an opportunity to consider the Office’s modification or rejection at the time of contract execution.

4 Attachment 5 Data Security Requirements

9. Cooperation with the State and Third Parties

4 of 4 Would the Office consider limiting access to Contractor’s personnel only, and remove the required access to systems and facilities?

No.

5 Attachment 5- Data Security Requirements

2.-Data Security a. NIST 2 Section 2.a requires the Contractor to meet or exceed the NIST

The Office’s primary concern is data security and integrity.

The Office would accept

Cybersecurity Framework, Version 1.1.

Would the Office accept a Contractor that maintains security controls aligned to another industry-recognized framework, such as NIST Cybersecurity Framework 2.0, ISO/IEC 27001:2022 or the CIS Critical Security Controls v8? Please also confirm whether the Office expects compliance to be shown at contract execution or during performance, and what evidence it will require, such as a written attestation, policies, or a third-party report.

security controls that are equal to or exceed those required by Attachment 5 – Data Security Requirements and Rule 60GG-2, Florida Administrative Code.

6 Attachment 2- Scope of services

7.f Indemnification

6-May Attachment 2, section 7.f limits each party's liability to the unpaid balance of compensation and further to a cap of $100,000. Attachment 4, section 8.g sets a different limit and excludes indemnity claims. Please confirm that Attachment 2, section 7.f controls over Attachment 4, section

See: Response to Question 1.

8.g, and that the cap in section 7.f applies to all claims, including claims under Attachment 4, section 8.f and Attachment 5, section 6.

7 Attachment 5- Data Security Requirements

6. Breach and Liability

3 Would the Office consider a reasonable cap for the obligations in this subsection, such as the limitation of liability in Attachment 2, section 7.f?

See: Response to Question 3.

8 RFP Sections 2.7 and 3.1

7, 8 Section 2.7 states that the Office will not accept proposed modifications or exceptions to Appendix A unless made by addendum. Section 3.1, replacing PUR 1001 section 9(a), states that where an exception is made by a Respondent, it will provide an alternative that is equivalent to or exceeds the Office's terms.

Please confirm whether a Respondent may include in its Response an exception that offers an equivalent or better alternative, or whether all modifications must

See: Response to Question 3.

be requested in this question period.

9 Attachment 5- Data Security Requirements

2.Data Security d. Cloud Service

2 Please confirm that a Contractor that uses commercial cloud services, such as hosted email and document storage, to hold examination work papers on its own behalf is not a "Cloud Service Provider" under section 1.d, and that section 2.d does not apply to it.

See: Response to Question 2.

10 Attachment 5- Data Security Requirements

4. Data Access and Storage

b. Open Data

2 Please confirm that the approval of personnel in section 4.b may be given for the Contractor's named examination team as a group, with additions approved by the Office's Contract Manager by email.

In accordance with Section 3.3.2.A.2. of the RFP, Respondent should identify its key personnel who will provided the services contemplated by the RFP.

After execution of contract, any changes in personnel will require approval from the Office’s contract manager.

11 Attachment 4, PUR 1000

8.Disputes and Liabilities e.ii(a) and (c)

Terms 15-16 Section 8.e.ii(a) requires 60 days' notice before any policy is cancelled and requires every policy to provide that the insurer notifies the Customer. Would the Office accept the Contractor's written undertaking to notify the Office within 30 days of

See: Response to Question 3.

“Per Occurrence” in section 8.e.ii. (c) – Attachment 4, PUR 1000 - applies to the coverage requirements of sections 8.e.i. (a) and (b).

any cancellation or material reduction that is not replaced by equivalent coverage, in place of insurer notice?

Please also confirm that the "per occurrence" requirement in section 8.e.ii(c) applies only to the workers' compensation insurance identified in section 8.e.i(b).

12 Attachment 1- Special Contract Conditions

27 Guarantee of Parent Corporation

9 Would the Office consider deleting section 27? In the alternative, please confirm that no separate guarantee instrument is required at proposal or contract execution, and that any parent guarantee would be limited to the Contractor's liability under the Contract as limited by Attachment 2, section 7.f.

No.

Execution of Contract will serve as proof of guarantee between the Parties.

Any limit of liability will be as stated in 7.f. Attachment 2

– Scope of Services.

13 RFP 1.2; Contract Signature Page;

Attachment 2, Section 3

3, 17, 27 Section 1.2 of the RFP states that the Contract will terminate no later than June 30, 2027. The Contract Signature Page states a completion date of one year from the Effective Date, and Attachment 2, section 3

Anticipated Contract termination date is November 30, 2027, as stated in Attachment 2 – Scope of Services. The need for post examination availability will stem from that date unless the Contract termination date is subsequently amended.

states an estimated completion date of November 30, 2027, which may be extended by up to one year. Please confirm the Contract term and completion date, and confirm how the one-year post-examination availability in Attachment 2, sections 3 and 4.f relates to the Contract term.

14 Attachment 1- Special Contract Conditions

29 Exit Transition Services

9 Would the Office consider providing that Exit Transition Services after the first 30 days will be billed at the hourly rates in the Contract?

See: Response to Question 3.

15 Attachment 6, Vendor Certification Form

1 If a Respondent has no interest, contract, grant or gift to disclose under section 286.101(3), F.S., please confirm that no separate disclosure statement or filing with the Department of Financial Services is required, and that the Attachment 6 certification is sufficient.

See: Attachment 6 Vendor Certification Form.

In accordance with section 286.103(3), F.S., an entity is only required to disclose an interest, contract, grant or gift, that meets the requirements of that section.

Otherwise, a disclosure that no such interest, contract, grant or gift exists is sufficient.