RFP 210000001627 - Questions and Answers (Round 2) v5.7.2021.pdf

Department of Technology, Management and Budget—Procurement Digital Cigarette Stamps and Related Services

Request for Proposal No. 210000001627

Question and Answer Addendum #2

Posted 5/7/2021

Round 2 – Written Question Due by 3PM on 5/3/2021

Please Note:

1. Question Numbering has been continued from the first round of questions and answers.

2. An updated version of the RFP has been posted with this Addendum with redlines to show changes made reflecting Answers provided for Question

#12, #21 and #22. Please update your proposal file BidderName_ScheduleA-SOW.docx to reflect these redlines to the SOW.

# RFP Section Page Reference Bidder Question State Answer

10 RFP

Attachment

42 Question 1 In Attachment 3 – Mandatory Minimum Requirements it is stated that the bidder must have a minimum of one existing contract providing Digital Tobacco Stamps to one state within the U.S. If a bidder does not have a US reference but has suitable International References would these be considered as a basis for qualification in this tender?

Yes. Please see Question and Answer #3 from the first round of bidder questions for the amended mandatory minimum requirement #1.

11 Proposal Instructions

2 RFP Structure & Documentation

If any one file as outlined in the table for “RFP Structure & Documentation” is larger than 6MB, can it be split into two files with the same file name defined followed by “part 1 of 2” and “part 2 of 2”? For example, the SOW response could be larger if graphics are included to add clarity to the descriptions of how requirements will be met.

Yes. If the file needs to be split into multiple files due to upload size restrictions, please follow the naming structure in the RFP and add a part number to the file name to indicate there are multiple parts to the file.

12 Schedule A

– Statement of Work

11 1.1.2 Overt Security Features

1. State Seal constructed of color-controlled gratings creating a true color

Color-controlled grating is unique to a holographic image and would potentially restrict the competitive options available to the SOM.

Would SOM confirm vendors can propose alternative stamp designs that include

The SOM will consider vendors who propose alternative stamp designs that include banknote-grade anticounterfeit color shifting features.

See updated language in amended RFP posted on SIGMA.

Request for Proposal No. 210000001627

Question and Answer Addendum #2

Posted 5/7/2021 replication of the Michigan State Seal at certain defined angles of viewing.

banknote-grade anticounterfeit color shifting features that maximize the visibility and ease of authentication of overt security control features?

13 Schedule A of Work

11 1.1.3 Covert Security Features

How many verification devices will be required in the field to verify the covert security features?

The State of MI currently has 47 mobile verification applications deployed. The IOS based mobile application is downloaded to the employee’s existing cell phone. This number can fluctuate slightly based on enforcement staffing levels.

14 Schedule A

– Statement of Work

13 1.2.i Contractor will complete Factory Acceptance Testing (FAT) on any High-Speed machines installed or moved during the term of the contract.

Can SOM provide an estimate of the number of times this will occur annually?

Alternately, could SOM provide historical data on the number of FAT occurrences during the last three years of current operations?

This is a very infrequent occurrence. Historically, due to the enormity of moving a High Speed machine, the FAT process is only utilized once or twice per year on average.

15 Schedule A

– Statement of Work

14 1.3.1.h - Contractor to provide training to any added authorized users. See Section 1.7.3 for additional details on training requirements.

Can SOM provide an estimate of how often new authorized users are added and require training per year?

Alternately, can SOM provide the number new authorized users added each year in the last 3 years of current operations.

There are approximately 40 authorized users to the stamp ordering system. There are approximately 7-10 adds or deletes to the authorized users list annually, most being adds which would require training.

16 Schedule A

– Statement of Work

17 1.6.1. – General Mobile Application System Requirements

g. Contractor will provide application support during standard business hours via an 800# for all users.

Can the State provide any estimates on the volume of support calls for the inspection app based on the history with the current solution?

There are 47 authorized mobile verification application users currently. There are approximately 20 adds or deletes to the mobile application authorized users list annually.

Request for Proposal No. 210000001627

Question and Answer Addendum #2

Posted 5/7/2021

17 Schedule A

– Statement of Work

17 1.7.1 . Annual SOC testing

c. If Applicable, the Contractor must perform annual testing of all security control requirements to determine they are working as intended…

Would SOM please verify if the SOC audit costs should be included in the section on “Additional Resources and Costs Available from Bidder” or “Related Support Services and Systems”?

The SOC audit should not be priced at this time. If required, at a later date, the State will negotiate with the awarded vendor on the scope and pricing.

18 Schedule A

– Statement of Work

17 1.7.1 c. Annual SOC testing Can SOM confirm that the bidders must provide evidence of experience in successfully certifying software solutions for another client through SOC testing and audit?

Bidders are not required to provide evidence of experience in successfully certifying software solutions for another client through SOC testing and audit in their proposal.

19 Schedule A

– Statement of Work

18 1.7.2.a Contract Transition

a. Existing HS and Hand stamping systems must be compatible with a new vendor’s systems. The SOM stampers use Red Stamp and USI High Speed machines.”

We see that the SOM stampers use Red Stamp and USI High Speed machines.

Please provide the current hand stamping system software and or hardware specifications currently in use so that we can ensure compatibility. If a system interface is required, please provide interface specifications.

A hand stamping system interface would require that all encrypted hand stamped metadata (outlined in 1.1.5) is captured and uploaded nightly into the master Inventory track and trace system, and subsequently available on the mobile application. This would require all file formats and/or file definitions are compliant with Schedule E & Schedule F and available for viewing in both above referenced systems.

Our current hand stamping systems do not require MSA software.

20 Schedule A

– Statement of Work

1.7.2 Contract Transition

e. Training on the mobile application for Treasury Enforcement & MSP personnel.

f. Training on the Inventory system for

Would SOM please provide the number of estimated users who will require training in the contract transition for:

a. Mobile application:

b. Inventory System:

c. Stamp Ordering System:

The estimated numbers of users requiring training in a contract transition are:

a. Mobile application - 47

b. Inventory system - 50

c. Stamp Ordering system - 40

Request for Proposal No. 210000001627

Question and Answer Addendum #2

Posted 5/7/2021 all Treasury personnel.

g. Training on the Stamp Ordering system for all Distributors’ authorized

21 Schedule A

– Statement of Work

24 2.1.g. Contractor must ship orders to MI authorized stampers within a maximum of 48 hours of order placed into the stamp ordering system.

Would the State confirm that the 48 hours maximum for shipping orders is based on business days (e.g., an order placed on a Friday must be shipped by the following Monday)? Does this requirement also pertain to state holidays?

Yes, the 48 hours is based on business days.

State Holidays are not considered business days.

on SIGMA.

22 Schedule A of Work Schedule E

4.0 Staffing

4.3.b

Sections 4.1 indicates that the Contractor Representative must be available for calls during the hours of 8:00 am – 5:00 pm.

This conflicts with Schedule E #4.3b which requires the Contractor provide unlimited telephone support between the hours of 7:00 am and 7:00 pm EST.

Please clarify that the expanded telephone support from 7:00 am – 7:00 pm EST can be support staff designated by the named Contractor Representative.

Telephone support hours have been updated to reflect the hours of 8:00 am – 5:00 pm EST in both sections.

on SIGMA

23 Schedule A of Work

28 4.6. Contractor Staff Security

Would SOM please confirm that 4.6. 2c.

requiring fingerprints as part of the background check for all prospective employees would only be required for contractor staff with access to a federal database as noted in Attachment 6, section 12 (Background Checks).?

The SOM confirms that 4.6. 2c. Requiring fingerprints as part of the background check only applies to contractor or subcontractor employees who may have access to any database of information that contains confidential or personal information, including but not limited to FTI. As the 3 subsystems referred to in Q20 above do not contain confidential information or FTI, the

Request for Proposal No. 210000001627

Question and Answer Addendum #2

Posted 5/7/2021 requirement for fingerprints does not apply for the purposes of this contract.

24 Schedule A

– Statement of Work

28 4.7 Access to Tax Information

Does Treasury anticipate this system will house what is considered FTI (protected taxpayer information)?

Could the SOM provide the relevant Data Classification Declarations (Form DTMB- 3544) referenced in attachment 7, Part B?

At this time, Treasury does not anticipate FTI to be housed in this system. The relevant data classifications are:

Public Data – Data that can be distributed without causing harm or violating any rights to privacy. Examples would be public websites, brochures, news releases and publicly available financial reports.

Internal Data – Information that is not sensitive to disclose but is intended for use by only agency employees and authorized non-agency employees. Examples would be Policies and procedures, customer information, and organizational charts.

Confidential Data - sensitive information in which unauthorized disclosure could cause serious financial, legal, or reputational damage to an agency or the State of Michigan. Examples would be Social Security numbers, credit card numbers and personally identifiable information (PII).

Restricted Data – extremely sensitive.

Unauthorized disclosure could be hazardous to life of health, cause extreme damage to integrity or image, or impair the effective delivery of services. Examples would be sensitive law enforcement data, disaster recovery plans, and investigative reports.

Request for Proposal No. 210000001627

Question and Answer Addendum #2

Posted 5/7/2021

25 Schedule F 64 3.2. …ensure that the Software and State Data is securely hosted, supported, administered, and accessed in a data center and backup center that resides in the continental United States.

Would the State please confirm if support resources residing outside the continental United States can access the database hosted in the continental US for IT support?

No. Support resources residing outside the continental United States cannot access the database hosted in the continental US for IT support. If you cannot agree to this requirement, please note your exceptions within your proposal.

26 Schedule F 64 3. Protection of the State’s Confidential Information

3.3 maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State’s Confidential Information that comply with the requirements of the State’s data security policies as set forth in the Contract, and must, at a minimum, remain compliant with FISMA and the NIST Special Publication 800.53 (most recent version) MOD Controls using minimum control values as established in the applicable PSP, and must, at a minimum, remain compliant with FISMA and the NIST Special Publication

800.53 (most recent version) HIGH Controls using minimum control values as

Please confirm vendors must demonstrate experience in delivering a solution with controls appropriate to remain compliant with FISMA and the NIST Special Publication 800.53 (most recent version) HIGH Controls using minimum control values as established in the applicable

PSP.

Bidders are not required to demonstrate experience in delivering a solution with controls appropriate to remain compliant with FISMA and the NIST Special Publication 800.53 (most recent version) HIGH Controls using minimum control values as established in the applicable PSP.

Schedule F, does require bidders indicate their agreement to comply by checking the box.

Request for Proposal No. 210000001627

Question and Answer Addendum #2

Posted 5/7/2021 established in the applicable

PSP.

27 Schedule A 24 2.1.f. Standard shipping (3 business days) to the distributor is paid for by the

SOM.

Do you expect shipping costs for standard 3-day delivery to be billed directly to the SOMs UPS or FedEx Account?

Shipping charges must be accounted for within Schedule B, line item #1 - New Tax Stamps.