RFP 81DMV-S2762 IT Scope of Work.docx

TABLE OF CONTENTS

BACKGROUND

PROJECT

The current vendor contract is due to expire September 30, 2024. An Electronic Mailing and Tracking Services it required all Nevada DMV offices to continue to support our process.

Currently three of the DMV's programs use a contracted vendor to provide mail services. Central Services' Insurance Verification Program and the Driver's License Program mail both First Class and Certified mail. Administrative Services Revenue Recovery mails Certified letters only. There are numerous template letters that are merged with electronically transferred data. There is the possibility for other programs to need the vendor services in the future.

AGENCY

The Nevada DMV is comprised of eight divisions encompassing six functional areas. Each division within the Nevada DMV administers several programs. The divisions and examples of the programs are described below:

The Director’s Office includes Public Information and Hearings Offices, established policy for the Nevada DMV. The Directors Office is responsible for leading and controlling the agency’s operations and responding to all media inquiries through the Public Information Officers. Nevada DMV policies, information security, and human resources management units also fall under the responsibility of this office.

The Administrative Services Division (ASD) is responsible for providing services to include fiscal accounting, budgeting, travel arrangements, payroll, warehousing, inventory control, mail services, purchasing services, contract management, facilities management, revenue collection and distribution, and processes customer information requests.

The Central Services and Records Division (CSD) provides alternative processing methods for Nevada DMV customers regarding drivers’ licenses, identification cards, vehicle registrations, license plates, vehicle titles, and insurance verification. CSD ensures data integrity, applies driver’s license sanctions, manages records, operates call center services, administers the Off-Highway Vehicle program, and processes customer information requests.

The License Plate Factory is responsible for designing, manufacturing, and distributing Nevada's vehicle license plates to Nevada DMV Offices, County Assessor’s Offices, and AAA partner locations for issuance to vehicle owners and operators in Nevada.

The Compliance Enforcement Division (CED) is the regulatory division of the Nevada DMV. Regulating the auto industry provides consumer protection through the licensing and regulation of businesses related to the manufacture, transport, sale, repair, and disposal of vehicles. This division also licenses and regulates schools for training drivers. The Division investigates all complex and criminal complaints filed against licensees and investigates fraudulent activities. CED performs audits, monitors, inspects, and provides investigative services on the internal and external entities related to the Nevada DMV’s core programs.

The Emissions Control Program ensures vehicles in Nevada comply with state and federal laws and regulations for emission standards. The Division licenses and regulates emissions stations. Emission inspectors are provided training and certification to perform emission tests.

The Field Services Division (FSD) provides direct customer service operations for both commercial and non-commercial driver licensing, identification, State issued credentials, voter registration, vehicle registration, vehicle titles, vehicle inspections, and fleet operations. Field Services assures safe and knowledgeable drivers receive the privilege to drive on the highways. Field Services Division also collects appropriate fees and taxes from the drivers, owners, and operators of vehicles.

Research and Project Management (RPM) is a resource to help achieve the Nevada DMV’s strategic plan, goals, and ensure consistent uniform program delivery. RPM is responsible for managing projects, implementing new or improved business processes, creating, and completing surveys, developing program related procedures, developing, and managing requests for proposals, managing forms, developing regulations, drafting legislation, and preparing fiscal notes. RPM supports other divisions in the areas of research, coordination of project completion, regulation and statutory changes, and legislative interaction related to all Nevada DMV functions and business programs. Employee Development unit falls under the responsibility of this division.

The Motor Carrier Division (MCD) is responsible for ensuring compliance with state laws, federal laws, and other governing documents applicable to its motor carrier customers. This includes administration of special fuel and motor fuel supplier programs to fairly collect and distribute over 1 billion dollars annually owed to Nevada and other entities (counties, cities, etc.). MCD is responsible for the licensing and fuel tax use collections for all commercial vehicles over 26,000 pounds based in Nevada. Motor Carrier also licenses commercial vehicles over 10,000 pounds with intrastate operations; collects revenue and revenue recovery payments; and conducts audits of motor carriers and fuel suppliers to provide customer education to ensure compliance.

The Motor Vehicle Information Technology Division (MVIT) supports technology involved in the development and maintenance of computer systems for the Nevada DMV. MVIT is responsible for the maintenance of application systems, testing, and the development of new programs, and enhancements of existing programs. They provide network support and installation necessary for the infrastructure of systems data. MVIT provides technical and operational support, and is responsible for hardware, software, network, and security in Nevada DMV operations. Additionally, MVIT provides Desk Top Support and User Support both internal and external customers.

The functional areas are fiscal, vehicle registration/title/insurance verification, driver’s license, motor vehicle industry regulation, motor carrier and fuel tax collection. There are 18 field offices statewide with the largest metropolitan offices in the Las Vegas valley and in Reno. There are approximately 1,200 employees statewide with the majority within Field Services. In addition, the DMV serves Nevada Citizens, other State agencies, Federal agencies, external, and internal customers by providing driver identification credential, vehicle ownership, registration, vehicle insurance and other historical data based on qualified records requests.

CONCURRENT IMPACTS/PROJECTS

Nevada DMV is currently engaged in its “Transformation Effort” (DTE), to revise business processes, reorganize, and move systems to a cloud solution. This will greatly improve DMV services and allow customer transactions online. DTE project delivery will continue into 2026 and involves over 100 staff and vendors. The proposed effective data will require programing, testing and implementation in the legacy system and DTE.

The Nevada DMV is working with Slalom to configure all services online using Salesforce and MuleSoft. This project will impact all aspects of the Nevada DMV as it is a large shift in the Nevada DMV’s current service system and the goal is to have a full customer 360 view from appointments to transaction completion.

CURRENT COMPUTING ENVIRONMENT

The citizens of the State of Nevada can seek services and productions by visiting the 18 physical Nevada DMV offices located throughout the State. Subsets of services are offered at eight (8) County Assessors’ offices, some police departments, various emission stations, and auto dealers. In addition, a growing portfolio of services is offered online and at self-service kiosks in Nevada DMV offices. Additionally, partnership locations across the State offer select services. The users of the Nevada DMV application, located across the State, can be classified as internal Nevada DMV or State employees, external, public, or virtual.

The Nevada DMV relies on the Motor Vehicle Information Technology (MVIT) division for Information Technology (IT) services. MVIT collaborates with the Office of the Chief Information Officer (OCIO)division within the Department of Administration who oversees, hosts, and maintain a comprehensive IT infrastructure including a system Z IBM mainframe.

OCIO provides services such as, but not limited to:

Wide Area Network (WAN) provisioning and support.

Local Area Network (LAN) provisioning and support.

Mainframe (System Z) hardware and upgrades.

Enterprise Storage Services Enterprise Storage replication for Disaster Recovery; and IT Governance and Standards

MVIT provides services such as, but not limited to:

Nevada DMV specific IT infrastructure (Windows Servers, VMWare ESX Server hypervisor, Storage Area Network (SAN).

Nevada DMV specific Local Area Network (LAN) provisioning and support.

IT hardware and equipment inventory, rollout, and management.

Non-application specific IT inquiries and support.

Application specific issues, inquiries, and support.

Batch schedule administration and output management.

Application Lifecycle Management.

Establish and enforce IT policies and procedures.

Security, Access Control and Auditing.

Business Operations Reporting.

Application and System performance monitoring and tuning.

Database administration.

Backup and recovery of application and data.

IT project administration.

Application design, development, and maintenance; and SAN storage & replication

PROJECT SOFTWARE

MVIT provides the following key computing activities such as, but not limited to: Distribution of the Nevada DMV Combined Automotive Revenue and Registration System (CARRS) Application, Authentication/Security, Cluster/Failover, Rollout of IT equipment, Storage replication/backup, Disaster/Recovery, etc.

The distribution of application software components is facilitated through localized distribution servers. Interaction between appropriate versions of software components are enabled through versioning. The software components rely on Active Directory Services and Identity Manager (Mainframe RACF) to authenticate and control access.

MVIT personnel in the North and South manage rolling out of new IT equipment, software installation and upgrades, and support Nevada DMV offices across the State.

OCIO replicates the storage between Northern and Southern Nevada Facilities for Disaster Recovery (DR) purposes for the Nevada DMV CARRS Application. EITS is responsible for establishing the IT infrastructure (platform, software, and communication) that is necessary for the Nevada DMV to access and restore Nevada DMV specific resources that are required to recreate the application environments at the DR site. Nevada DMV specific resource.

All software used for project management shall be approved by the State.

DEVELOPMENT SOFTWARE

All proposed software used in design, development, testing and implementation of deliverables outlined in this solicitation shall be approved by the State.

If the application software is not public domain, the awarded vendor shall provide a licensing strategy.

The State shall procure licenses for all base components and third-party equipment (operating system, data base, etc.) based upon specifications provided by the awarded vendor.

The awarded vendor shall provide twenty (20) licenses and formal training for twenty (20) NV DMV employees.

The State is currently using the following development software:

Microsoft Visual Studio 2008/2010 Sybase Power Builder V12 Interspace-Homegrown Application IBM RDz-IBM IDE-Used for Mainframe Access Hummingbird-Used for Mainframe Access Crystal Reports Ver. 9/10 QAS Batch Software- Address Verification Application Dameware-Remote Access to PCs Sybase SWL Anywhere PDF4NET- Third Party Tool used to create PDF forms/reports through ASP.NET MS SQL Server 2008 R2-Microsoft SQL Server DB Software MS Team Foundation-Server Source Control Software Microsoft Internet Information Services-Web Servers.

Adobe Acrobat X PRO-Limited number of licenses for creating PDFs.

Microsoft SharePoint 2010 IBM CICS Transaction Server

IBM DB2

IBM DB2 Connect ZEKE-Batch job schedule on System Z IBM Output Manager IBM Removable Media Manager-Tape Management Software Information Identity Systems-Fuzzy Search Software

UNI (AAMVA)

Identity and Access Manager- Built by MVIT to authenticate and control access to DMV applications.

Secure FTP polling processor-Built by MVIT for processing to receive, process and return insurance data for NV LIVE Microsoft Silverlight SDK

STATE RESOURCES

The following paragraphs describe resources the State has committed to this project.

Project Sponsor. The NV DMV is the Project Sponsor. All project activities shall be conducted under the authority of the NV DMV.

Project Manager. A Project Manager has been appointed to coordinate the activities of all individuals and organizations involved in the project. The Project Manager shall provide on-going daily direction and oversight to State project staff and Contractor and report progress and problems to the Project Manager. The Project Manager shall coordinate all organizations involved in the project and ensure resource requirements are identified and addressed. The Project Manager sets priorities when choices of alternatives are required.

State Project Staff

The awarded vendor shall be expected to work closely with State project staff assigned to this project.

State project staff shall be available to attend meetings, interviews and assist assigned staff in reviewing functions with the awarded vendor.

State project staff shall be assigned to the project on an as-needed basis, as determined by project and technical management to represent the various functional and technical areas.

State project staff shall report to the Project Manager who shall act as a conduit to the awarded vendor.

Quality Assurance Monitor. A Quality Assurance (QA) monitor may be utilized and shall act as technical assistant to the State. The QA monitor shall report to the State Project Manager. Major functions shall include, but not be limited to the following.

Review of project tasks Validation of results Provide recommendations, as required Review of deliverables Project plan monitoring

SYSTEM REQUIREMENTS

VENDOR RESPONSE TO SYSTEM REQUIREMENTS

COMPUTING PLATFORM

Nevada DMV Motor Vehicle Information Technology (MVIT) Services

The citizens of the State of Nevada can seek services and products by visiting one of the 18 physical Nevada DMV offices located throughout the State. Subsets of services are offered at eight (8) County Assessors’ office, some policy departments, various emission stations, and auto dealers. In addition, a growing portfolio of services is offered online and at self-services kiosks in Nevada DMV offices. Additionally, partnership locations across the State offer select services. The users of the Nevada DMV application, located across the State, can be classified as internal Nevada DMV or State Employees, external, public, or virtual.

The Nevada DMV relies on the MVIT division for IT services. MVIT collaborates with the Office of Chief Information Officer (OCIO) division within the Department of Administration who oversee, host, and the maintain a comprehensive IT infrastructure including a system Z IBM mainframe.

OCIO provides services such as, but not limited to:

Wide Area Network (WAN) provisioning and support.

Local Area Network (LAN) provisioning and support.

Mainframe (System Z) hardware and upgrades.

Enterprise Storage Services Enterprise Storage replication for Disaster Recovery; and IT Governance and Standards

MVIT provides services such as, but not limited to:

Nevada DMV specific IT infrastructure (Windows Servers, VMWare ESX Server hypervisor, Storage Area Network (SAN).

Nevada DMV specific Local Area Network (LAN) provisioning and support.

IT hardware and equipment inventory, rollout, and management.

Non-application specific IT inquiries and support.

Application specific issues, inquiries, and support.

Batch schedule administration and output management.

Application Lifecycle Management.

Establish and enforce IT policies and procedures.

Security, Access Control and Auditing.

Business Operations Reporting.

Application and System performance monitoring and tuning.

Database administration.

Backup and recovery of application and data.

IT project administration.

Application design, development, and maintenance; and SAN storage & replication

TECHNICAL REQUIREMENTS

The vendors proposed solution shall include a business intelligence system to create a Decision Support Data warehouse system to measure key performance indicators (KPI) generate reports, and dashboards to gain better insight into business processes.

The vendors proposed solution shall allow users to schedule and subscribe to analytical reports and notifications.

The vendors proposed solution shall allow users to generate ad-hoc analytical reports.

The vendor proposed solution shall reduce the time required to gather, process, and share information (required for the provision of the services and benefits), and creation of reporting on those services and benefits), and creations of reporting on those services and benefits.

The vendors proposed solutions shall provide forecasting and trend analysis for all processes, functions, interactions with customers, business partners, and internal users.

The vendors proposed solutions shall enhance capacity to do “predictive modeling” and What if” scenarios to support program and policy development.

The vendor shall design a system to include Business Intelligence (BI) and functionality supporting and potentially broad range of areas including, but not limited to, security monitoring and control of systems and users, document processing quality and control, staff, appointment, and service office resource management, etc., using real-time data with supporting graphics-based dashboards with all transactions available from throughout the entire Nevada DMV system ubiquitously.

The vendors propped system shall employ real-time data visualization methods on the core data creating a visual descriptive statistics platform.

The vendors proposed BI system shall deliver complex data that is highly accessible, understandable, and usable to the user community allowing the measuring and dissection of patterns or relationships in the data for one or more variables.

Cloud Ready

The vendor shall propose design and facilitate a whole solution to the Cloud.

The vendor shall describe the Cloud Ready solution’s security components.

The vendor shall describe the Cloud Ready solution’s shareable online file storage devices.

The vendor shall describe the Cloud Ready solution’s social connectors.

The vendor shall describe the Cloud Ready solution’s infrastructure services.

The data can be hosted in any Cloud provider solution so long as the platform resides within the United States as well as the disaster recovery site. The disaster recovery site must not be in the same vicinity as the primary site. The Cloud provider services, and solution must be FEDRAMP certified and implement two (2) factor authentication per State NRS 603A and State Information Security Consolidated Policy -http:/ /it.nv.gov/uploaded Files/ITnvgov/Content/Governance/dtls/Standards/134C loud Hosting.pdf

Big Data Analytics Ready

The vendor shall describe possible big data goals for collaboration, solving issues and identify growth opportunities.

The vendor shall describe the big data range that will be appropriate for ease in scalability and for providing secure shared access.

The vendor shall describe the big data possible scope of unstructured data that may be leveraged by the Nevada DMV.

The vendor shall describe industry-leading capacity, performance, and workload requirements.

System Throughput and Processing The vendors proposed solution shall meet the following additional requirements:

The vendors proposed solution shall run on Windows 13 workstations or higher.

The Vendor's proposed solution shall run on a minimum of a T1connection.

The vendors proposed solution shall run on industry standard browsers such as, but not limited to, Microsoft Edge, Mozilla Firefox, Google Chrome, Microsoft Spartan, etc.

The vendors proposed solution shall be optimized for a screen resolution of 1024 x 768 DPI.

The vendors proposed solution shall not exceed .70-second response time, during peak times - 8:00 am through 5:00 pm PST, Monday through Saturday, at all Nevada DMV locations.

The vendors proposed solution shall have a minimum throughput of 8,000 transactions per hour with at least 150 concurrent transactions per minute.

The vendors proposed solution maintenance window shall not exceed two (2) hours on weekdays and three (3) hours on weekends or holidays.

Maintenance shall not be scheduled between the hours of 6:00 am through 7:00 pm PST on any day of the week.

The vendors proposed solution shall not require extensive changes to the application during hardware and software updates/upgrades.

The vendors proposed solution shall allow access to a minimum of 1,500 internal, 1 million external registered users, and 500,000 external non-registered guest users.

The vendors proposed solution shall employ keyboard shortcuts when available and meet the process and system flow.

The vendor shall avoid commonplace errors in architecture, design, implementation, deployment, and delivery of the proposed system.

The vendors proposed solution shall ensure scalability and sustainability beyond simple overloads and should be up to 60 times the ratio of normal business.

The vendors proposed solution shall ensure accurate and actionable enterprise identity management check capability.

The vendors proposed solution shall ensure HTTP 503 errors are a non-issue.

The vendors proposed solution shall ensure recoverability from crashes and unexpected failures.

Application Environments

The vendors proposed solution shall consider hosting production and non-production environments on separate physical hardware.

Though Nevada DMV is expecting to support the following discrete Application Environments, the vendor shall propose the number of discrete application environments that may be needed:

Production Development Integration Test User Acceptance Q&A Training Disaster Recover; and Conversion

Disaster Recovery

Nevada DMV is expecting to host two data centers. The data center at Carson City, Nevada, will be the primary site. The data center in Las Vegas, Nevada, will be the secondary site. The secondary site in Las Vegas is expected to become primary if the Carson City data center is either offline or is inaccessible. The secondary site in Las Vegas could host non-production environments should the vendor choose to separate production and non-production environments between the data centers.

The vendors proposed solution shall include tools needed to replicate persisted data that is needed to establish a comprehensive production environment at the secondary site.

The vendors proposed solution shall optionally load balance the production environment between the data centers, if needed, to meet the requirements outlined in this RFP.

The vendor shall comprehensively list the tools, hardware, software, and network bandwidth.

requirements needed to replicate production data between the sites.

The vendor shall recommend and offer guidance about conditions that could be considered for automatic failover.

The vendor shall recommend and offer guidance about conditions that could be considered for manual failover to minimize scheduled outages.

The vendors proposed solution shall include comprehensive documentation, procedures, best practices, and suggest frequency to test failover capability between the primary and secondary sites.

The vendor shall include an architectural diagram detailing the hardware, software, and the Application environments that are needed to meet the requirements outlined in this RFP.

Training Environment

The vendors proposed solution shall establish an environment that can be used to train new recruits.

The vendors proposed solution shall include tools that will allow the Nevada DMV Training Division to restore the training environment to a consistent state to ensure users can repetitively train, practice, and learn.

Integrated Privilege

The vendors proposed solution shall have the ability to transform and consolidate the privilege eligibility and enrollment functions to a consumer-centered profile Pll model that incorporates a customer registry and an electronic case record that improves both user and consumer experience and will include:

Simplification and consolidation of customer eligibility rules based on criteria that can be easily utilized by multiple Nevada DMV business partners and enable a flexible, adaptable, extensible, and easy to use rules-based engine.

A robust customer self-service one-stop-shop through multi-channel use of technology and automated validation and verification.

External Interfaces

The vendor must incorporate and continue to support all external interfaces with Nevada DMV's business partners as specified in this RFP.

The vendors proposed system shall interface with existing external interfaces with minimal changes or impacts. Where feasible, some interfaces shall be upgraded.

Internal Interfaces

The vendor shall incorporate and continue to support all internal interfaces as specified in this RFP.

The vendor’s proposed system shall interface with existing internal interfaces with minimal changes or impacts. Where feasible, some interfaces shall be upgraded.

SECURITY STANDARDS

System shall meet or exceed all applicable Nevada Revised Statutes (NRS), Nevada Administrative Code (NAC), State Information Security Program Policy, and State and Department Security Standards related to product or service being required/provided.

DMV SECURITY STANDARDS

The Nevada DMV is required by law to meet the highest security standards in its technology platforms to meet all risks that could possibly affect the integrity of the State as a steward of public data and the issuance of legal documents.

The Nevada DMV shall publish and update all of its security documentation based on the following basic security policy and standards: the Nevada DMV security documentation based on the following basic security mandate’s best practices:

Security Policy AND Standards: The Nevada DMV security office, for the purposes of the RFP, is in the process of increasing the scope of the Nevada State security standards. Part of that increased scope incorporates NRS 242, Common Criteria 3.1 Revision 4, September 2012, TOE, various Federal standards, and Zero-tolerance security policy.

Security Architecture: A strategic and unifying framework employing reusable services that implement policy standards and risk management decisions (see: RA Security). The master security model architecture shall resemble a series of interlocking defensive zones. Upon detection, a suspected viral anomaly shall be successively stripped of its harmful components and forced into an isolated zone. The viral anomaly shall be isolated for analysis and subsequently destroyed.

Security Processes: Shall be driven by a modern technical security ecosystem that is not only current but also forward-looking into the ever-evolving landscape of hacking and viruses. The technical Ecosystem shall be a living application that constantly thwarts threats and vulnerabilities and produce highly available countermeasures to protect the integrity and privacy of the State, the public at large, and the Nevada DMV Data.

Security Metrics: Measuring and monitoring standards, architecture, and process to validate the hermetic seal of the system.

System must meet State security standards for transmission of personal information as outlined in NRS 205.4742 and NRS 603A.

MINIMUM SECURITY STANDARDS

The vendor shall ensure end-to-end security is installed and applied to all sustainable and reliable environments such as but not limited to development, unit testing, integration testing, user acceptance testing, quality assurance testing, production, training, etc.

The vendor shall ensure the top-down view does not lose sight nor hide the atomic details and inherent security weaknesses.

The vendor shall ensure Web URLs and URLs are tamper, phishing, hacker, virus, and spider proof.

The vendor shall share and must inform the Nevada DMV of all possible internal threats, weaknesses, and vulnerabilities.

The vendor shall recommend and inform the Nevada DMV of changes to personnel policies to reflect the true risks thus ensuring adequate countermeasures and enforcement of such.

The vendor shall ensure EDI standards and stop/plug any and all vulnerabilities encountered.

The vendor shall ensure PII is protected and stored accurately.

The vendor must provide an explanation of security measures taken to protect PII for printed matter and how waste/disposal is handled because of jams, misprints, registration issues, etc.

The vendor shall ensure transactions and logs are optimized for accuracy, rollback of breeches, and lost data.

The vendor shall ensure all transactions and logs are stored for State compliance and per Nevada DMV policies.

The vendors proposed solution shall ensure process and information are segregated for the user interfaces and not co-mingled.

The vendors proposed solution shall ensure accurate customer and Nevada DMV employee profiles.

The vendors proposed solution shall ensure formal end-to-end ad hoc performance testing.

The vendor shall adhere to the security master model and security reference architecture in this section.

The vendor shall follow the zero-tolerant security mandates in this RFP.

The vendor shall design a network system capable to integrate the functionality of contemporary devices such as, but not limited to:

VLANs;

IEEE 1613 specified Multiplexing;

HTTP/2;

SPDY 4.0; and RFID Technology

ENCRYPTION METHODS

The vendor shall incorporate the highest encryption standards including or similar to, but not limited to:

National Institute of Standards and Technology (NIST): Special Publications 800-111, 131A, 57, Part 1, CMVP Validation List:

National Security Agency (NSA) insertion of Dual EC DRBG.

Advanced Encryption Standard (AES): symmetric block cipher used by the U.S. government to protect classified information implemented in software and hardware to encrypt sensitive data.

Un-decodable Encryption Schemes and Barcodes: bit secure cipher text.

Federal Register (FR): contains government agency rules and proposed rules.

SANS 20 Critical Security Controls: Industry-accepted best practices for cyber defense, minimum standard Data Protection Level (DPL) 0-3.

HP 256-bit key Atalla Cloud Encryption: ESSIV Schema, Cipher-Block Chaining (CBC).

RISK ADVERSE SECURITY

The vendor shall integrate a risk-averse security model into its end to-end architecture.

The vendor shall ensure a risk management centric approach allowing the security architecture to be agile in responding to the business continuity and disaster aversion needs.

The vendors proposed system shall ensure that the end-to-end threats and vulnerabilities shall be destroyed, contained, quarantined, or at least mitigated by deploying countermeasures.

The vendor shall implement risk assessment to ensure the Nevada DMV's risk exposure is in line with risk tolerance goals; zero tolerance.

The vendor shall offer the highest opportunities to create highly available and successful countermeasures for the proposed solution.

The vendor shall design the proposed solution to take on, at a minimum, the appropriate level of risk-averse actions based on the business goals as set out in this RFP.

EXTERNAL RISK AVOIDANCE

The vendors proposed solution shall protect the Nevada DMV from external bad acts caused by bad design and/or standard or nonstandard components that the vendor recommends, integrates, implements and/or deploys such as:

The vendors proposed solution shall prevent cyber-vandalism from affecting the Nevada DMV. The vendors proposed solution shall prevent hacks into Nevada DMV's unclassified email system.

The vendors proposed solution shall prevent "cyber-security intrusion" from exposing employee personal information. The vendors proposed solution shall prevent computer hacking that causes significant security-breaches of inter-agency computer security.

The vendors proposed solution shall prevent weaknesses found in third party software such as, but not limited to: Microsoft DLLs, Microsoft's Word, MS Excel, etc.; to allow hackers to penetrate the Nevada DMV.

The vendors proposed solution shall prevent Nevada DMV files and records from being stolen.

DISCRETE PROTECTION SERVICES

The vendor shall provide confidentiality, integrity, and availability of needed protection services for the vendor's proposed solution.

The vendors proposed solution shall provide specialized and discrete services that are implemented purely as protection services such as, but not limited to:

Authentication and authorization.

Detection services, such as monitoring and auditing; and Response services such as incident response including state of the art forensics.

The vendor shall ensure the proposed solution allows the Nevada DMV to become an auto governed risk management body.

ZERO TOLERANT SECURITY

The vendors proposed security solution shall emphasize a zero tolerant security model. All program requirements shall be considered to ensure the security solution model is not overemphasized in relation to the total solution.

The vendor shall incorporate zero-tolerance policy management functionality into the proposed solution's architecture by offering zero-discretion policy services, where the goal is ZERO room for deviation from the absolute rule.

The vendor shall be prohibited from public disclosure of security vulnerabilities (source, cause, and remediation methods) found in the vendor's proposed solution.

The vendor shall ensure system security vulnerabilities remain discrete for certified "Nevada DMV Eyes-only".

The vendor shall ensure the proposed system has the ability to discover new security vulnerabilities in real-time.

The vendor shall provide expert resources to ensure all security vulnerabilities are addressed.

The vendor shall implement security patches, during the course of the project, in a timely manner to meet the gravitas of the breach and the magnitude of disruption to business continuity.

The vendor shall implement best practices to enforce system security Zero-Tolerance functional policy models.

The vendor shall adopt a similar practice model for Zero-Tolerance policy, which will have a specified hard deadline to remediate, or turn-off. The specific timeline shall be negotiated between the Nevada DMV and the awarded vendor.

The vendor shall incorporate a case management tool that includes the Case-by-Case approach to any security breach; which shall include items such as, but not limited to; case identification, assignment, resolution, disposition, etc.

The vendor shall ensure that no software implemented with the proposed solution contains rogue software that would assume to take control, load, or threaten the Nevada DMV functionality.

VULNERABILITY PROTECTION

The vendor shall design the proposed system to ensure protection of weaknesses and vulnerabilities such as, but not limited to:

Authentication;

Denial of Service;

Buffer Overflow;

Memory Corruption;

Directory Traversal;

Protocol Vulnerability;

Privilege Escalation;

Cross Site Scripting;

Remote Code Execution;

SQL Injection;

Integer Overflow;

Stack Overflow;

Heap Corruption; and Use After Free

SECURITY ARCHITECTURE WEB SERVICE COMPONENTS

The vendor shall include the following web service requirements for the design and implementation of the proposed solution:

Transparency: The vendors proposed solution shall include transparent recovery to ensure that users (internal and external) never experience a loss of a Web presence, Recovery: The vendors proposed solution shall recover from malicious hacking attacks and malware by enabling frontend quarantine devices; while a backend countermeasure is launched to destroy or at least mitigate the threat.

System Failure Recovery: The vendors proposed solution shall include a design mechanism that keeps the agency's sites running at a minimum in the event of a system failure within the Internet Data Center, e.g., hardware or software.

Site Failure Recovery: The vendors proposed solution shall include a design that keeps the site running in the event of a failure that takes down the entire Internet Data Center, e.g., natural disasters or utility failures.

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY

The vendor shall take into account NIST standards applicable to the various system object mappings when developing security objects as follows:

53A

SCOPE OF WORK

Objectives and Scope

Currently the NV DMV requires electronic tracking, electronic return receipt and records retention for their Presort First Class, First Class, Express, Priority, Certified and registered national and international mail. The volume of mailers for FY23 was 252,191 for Certified mail and 371,704 for First Class mail. The volumes may increase or decrease in the future.

The objective is to establish a quick and easy way to prepare Presort First Class, First Class, and Certified mail. This includes the ability to provide Presort First Class, First Class and Certified mail with Express and Priority mail delivery and other special services such as electronic tracking and electronic return receipt, insured registered and international mail. The scope of work includes providing an automated method of collecting electronic data, processing for address standardization and address verification, printing, finishing, mail preparation, and transportation to the United States Postal Service (USPS) for same day mail entry. The DMV intends for this process to be completed using an automated process that expedites the print and mail delivery process, tracking solutions that reduces costs.

The vendor shall collect the electronic data through a secure interface.

Data may be printed on: A self-mailer (8 ½ x 14), 6 x 9 USPS approved automated Certified mail envelope, a 9 x 12 USPS approved automated Certified mail flat, or an approved format by the DMV.

Current Letter – 8.5 x 14 (3-5 versions) 20#T or 60#T White K/0 (Black on one side, no print on other) Variable addressing/laser imaging 2 leaves (sheets), nested Double-parallel fold to 8.5x3.75 (approx.)

#9 BRM (postage paid) White K/0 Mail Processing 3-piece Insert into #10 Double Window (Letter-2 leaves and #9BRM) Seal Meter first class or presort first class Drop at mail facility *Quantities Vary, approx. 2500/day Proposed Future State Letter -8.5x14 (3-5 versions) 20#T or 60#T White K/K (black print, two sides) Variable addressing/laser imaging Double -parallel fold to 8.5x3.75 (approx.)

Mail Processing 1 piece Insert into #10 Doble Window and seal

NCOA

Data Conversion Presort Mail processing Drop at Mail Facility Presort, first class mailing (min. 500 pcs.) or first class metering *Quantities Vary, approx. 2500/day Mail to be prepared according to the USPS standards.

Mail must be processed and transported to the USPS by the following business day from the time of receipt of the electronic data transfer.

Mail must be processed through an automated system and presented to the USPS with all required documentation.

Mail must be able to be tracked and searched for on a web site accessible to the DMV.

Awarded vendor shall retain a scanned image of the front and back of each letter mailed so the Department of Motor Vehicles can retrieve when necessary.

PROJECT SPECIFIC TERMS AND CONDITIONS

The vendor shall receive a data stream, print stream, or raw data electronically through a secure interface. Electronic data must be received and processed through an automated system due to volume. The vendor shall provide turnkey production, finishing, distribution of the mail pieces along with approved Certified mail envelopes. The vendor will need to provide a secure Web interface, for daily USPS delivery status updates, tracking updates, electronic manifest showing legal proof of mailing and showing proof of delivery.

Data Transmission

The vendor must be able to accept electronic data through a secure interface. DMV data will be sent to the vendor in a batch and must be protected from unauthorized access or use. All data for tracking the mail must be maintained and made available to the DMV via secure web site for the entire duration of the contract. DMV data may be used only for work performed under this contract. All historical data shall be considered property of the DMV and shall be turned over upon request or termination of the contract at no additional cost.

The process of receiving data from the vendor's secure server to the print center should be received, processed, and finished using an automated method. The need for the automation is to increase security, eliminate errors and insure confidentiality. All mail must be printed and dropped into the mail stream by the next business day following receipt of transmission of data.

Individual Record Deletion

The vendor must have the ability to pull and delete an individual record from a transmitted batch upon request of the DMV prior to printing and mailing.

Printing and Finishing

The vendor shall submit sample mailings (electronic, press, laser proofs) with specifications in accordance with Scope of Work line-item Section 3.1.4. The DMV must agree to the minimum standards in the specifications prior to implementation.

Personalization will be required as specified by the DMV. The vendor will perform all merge functions. Therefore, the vendor is responsible for printing and maintaining template documents to be merged with individual records. New templates will be submitted during the course of the contract. Revisions and new creations must be completed within agreed upon deadlines.

The vendor shall maintain the ability to provide the following finishing options taking in to consideration window, non-window, printed and nonprinted:

Automated self-mailer pressure sealed;

Automated 9 x 12 envelope (flat) (up to 48 pages);

Automated #10 envelope (up to 5 pages);

Automated 6x9 envelope Any information that is specific to Special Services (Certified, Insured, Registered) Express mail, or Priority mail;

Electronic Delivery ConfIrmation;

Electronic Manifest Submission; and Electronic generation of all reports.

Distribution

The vendor must provide materials for use with Certified mail, Express mail, and Priority mail. Replenishment of the materials including envelopes, if needed, and self-mailers, shall be the responsibility of the vendor. The vendor may use mailers in lieu of envelopes with DMV approval.

The vendor must prepare the mail for submission to the USPS in accordance with all mailing standards applicable to the class of mail. (As USPS mailing standards change over time, the vendor must comply with the particular standards at the time of actual performance.) The vendor must prepare the mail in such a manner to afford the DMV the lowest possible automation basic rates for mail pieces that qualify. The vendor is responsible for providing all materials required by USPS to receive these rates. The vendor is responsible for knowing and meeting all deadlines set by the USPS for acceptance of mail to meet the requirements set by the DMV. The vendor must be able to accept batch jobs assigned by the DMV Monday through Saturday each week excluding Nevada State Holidays.

Customer Service and Division Support

The vendor must establish a Help Desk for assisting needs of the DMV. The web site must include a phone number and email address for the Help Desk. The Help Desk must be available during the DMV's normal business hours, 8:00 a.m. to 5:00 p.m. Pacific Time, Monday through Friday. Help Desk responses are required within two hours and requests must be completed with an agreed upon deadline.

Quality Assurance

The vendor must establish a Help Desk for assisting needs of the DMV. The web site must include a phone number and email address for the Help Desk. The Help Desk must be available during the DMV's normal business hours, 8:00 a.m. to 5:00 p.m. Pacific Time, Monday through Friday. Help Desk responses are required within two hours and requests must be completed with an agreed upon deadline.

Contingency planning

The vendor shall have an established plan and submit details for handling unanticipated peaks and surges in job volume, machine outages, and catastrophic events such as fire and flood.

Reporting and Tracking

The vendor ·will need to provide a Web interface with unlimited user access, to provide daily USPS delivery status updates, tracking updates, electronic manifest showing legal proof of mailing and showing proof of delivery. The secure web interface must:

Identify, for each piece of mail, the mail date, article number, addressee's name, address, driver license number or ID number; VIN and plate;

Track the mail’s progress and the mailing history for each piece of mail;

Track by return receipt and delivery confirmation;

Allow the printing of the return receipt and delivery confirmation;

Search by any identifying field;

Produce reports based on any identifying field;

Send individual daily invoices for each project (i.e., separate invoices for Insurance Verification, Driver's License Assessment Team and Revenue Recovery) to the DMV detailing the type of form mailed, quantity and the amount charged for each; and Send an end of the month invoice which lists all invoices and the total balance of funds due for each of the DMV's projects or jobs.

GENERAL INFORMATION

No minimum quantity fee-based penalties.

VENDOR DOCUMENTATION

PRELIMINARY PROJECT PLAN

Vendor shall submit a preliminary project plan as part of the proposal, including, but not limited to:

Gantt charts that show all proposed project activities Planning methodologies Milestones Task conflicts and/or interdependencies Estimated time frame for each task identified in Scope of Work Overall estimated time frame from project start to completion for both Vendor and State activities, including strategies to avoid schedule slippage

Vendors shall provide a written plan addressing the roles and responsibilities and method of communication between the contractor and any subcontractor(s).

The preliminary project plan shall be incorporated into the contract.

The first project deliverable is the finalized detailed project plan that shall include fixed deliverable due dates for all subsequent project tasks as defined in Scope of Work. The contract shall be amended to include the State approved detailed project plan.

Vendors shall identify all potential risks associated with the project, their proposed plan to mitigate the potential risks and include recommended strategies for managing those risks.

Vendors shall provide information on the staff that shall be located onsite in Carson City. If staff shall be located at remote locations, vendors shall include specific information on plans to accommodate the exchange of information and transfer of technical and procedural knowledge.