RFP - Agile Digital Experience Product Transformation (ADEPT).pdf

Agile Digital Experience Product Transformation (ADEPT) Solicitation #: BPM044685 RFP Document

RFP for Maryland Department of Information Technology Page 1 of 118

STATE OF MARYLAND

MARYLAND DEPARTMENT OF INFORMATION

TECHNOLOGY

(DOIT)

REQUEST FOR PROPOSALS (RFP)

AGILE DIGITAL EXPERIENCE PRODUCT TRANSFORMATION (ADEPT)

RFP NUMBER: BPM044685

ISSUE DATE: 6/4/24

NOTICE

A Prospective Offeror that has received this document from a source other than eMarylandMarketplace

(eMMA) https://procurement.maryland.gov should register on eMMA. See Section 4.2.

MINORITY BUSINESS ENTERPRISES ARE ENCOURAGED TO RESPOND

TO THIS SOLICITATION.

RFP for Maryland Department of Information Technology Page 2 of 118

VENDOR FEEDBACK FORM

To help us improve the quality of State solicitations, and to make our procurement process more responsive and business friendly, please provide comments and suggestions regarding this solicitation. Please return your comments with your response. If you have chosen not to respond to this solicitation, please email or fax this completed form to the attention of the Procurement Officer (see Key Information Summary Sheet below for contact information).

Title: Agile Digital Experience Product Transformation (ADEPT) Solicitation No: BPM044685

1. If you have chosen not to respond to this solicitation, please indicate the reason(s) below:

� Other commitments preclude our participation at this time

� The subject of the solicitation is not something we ordinarily provide

� We are inexperienced in the work/commodities required

� Specifications are unclear, too restrictive, etc. (Explain in REMARKS section)

� The scope of work is beyond our present capacity

� Doing business with the State is simply too complicated. (Explain in REMARKS section)

� We cannot be competitive. (Explain in REMARKS section)

� Time allotted for completion of the Proposal is insufficient

� Start-up time is insufficient

� Bonding/Insurance requirements are restrictive (Explain in REMARKS section)

� Proposal requirements (other than specifications) are unreasonable or too risky (Explain in REMARKS section)

� MBE or VSBE requirements (Explain in REMARKS section)

� Prior State of Maryland contract experience was unprofitable or otherwise unsatisfactory. (Explain in REMARKS section)

� Payment schedule too slow

� Other: __________________________________________________________________

2. If you have submitted a response to this solicitation, but wish to offer suggestions or express concerns, please use the REMARKS section below. (Attach additional pages as needed.)

REMARKS:

Vendor Name: ________________________________ Date: _______________________

Contact Person: _________________________________ Phone (____) _____ - _________________

Address: ______________________________________________________________________

E-mail Address: ________________________________________________________________

RFP for Maryland Department of Information Technology Page 3 of 118

STATE OF MARYLAND

DEPARTMENT OF INFORMATION TECHNOLOGY (DOIT)

KEY INFORMATION SUMMARY SHEET

Request for Proposals IT Services – Agile Digital Experience Product Transformation

(ADEPT)

Solicitation Number: BPM044685

RFP Issue Date: 6/4/24

RFP Issuing Office: Maryland Department of Information Technology (DoIT)

Procurement Officer: Hanta Ralay 45 Calvert St., Annapolis, MD 21401 email:

Office Phone:

Hanta.Ralay@maryland.gov 410-260-7338

Proposals are to be sent to: Submit Via eMMA Click here for step-by-step instructions to respond to this RFP in eMMA

Pre-Proposal Conference: Monday, 6/10/24 at 11:00 am Local Time Virtual Teleconference by Calendar Invitation from Procurement Officer Only See Attachment A for directions and instructions.

Questions Due Date and Time Thursday, 6/13/24 at 2:00 pm Local Time

Proposal Due (Closing) Date and Time:

Tuesday, 6/25/24 at 5:00 pm Local Time Offerors are reminded that a completed Feedback Form is requested if a no-bid decision is made (see page iv).

MBE Subcontracting Goal: 25%, with no subgoals

VSBE Subcontracting Goal: 5%

Contract Type: Fixed Price (COMAR 21.06.03.02) / Indefinite Delivery Indefinite Quantity (IDIQ) (COMAR 21.06.03.06) for Labor Hours with Work Orders

Contract Duration: Five (5) base year period, with two (2), two-year option periods

Primary Place of Performance:

Various locations State’s Offices / Contractor’s Location

SBR Designation: No

Federal Funding: May be required at the Work Order Level https://mdprocurement.freshdesk.com/support/solutions/articles/70000592967-responding-to-solicitations-rfp-vendor-

RFP for Maryland Department of Information Technology Page 4 of 118

TABLE OF CONTENTS – RFP

1 Minimum Qualifications

1.1 Offeror Minimum Qualifications

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.2 Background, Purpose, and Scope

2.3 Responsibilities and Tasks

2.4 Examples of Work Order Deliverables

2.5 Service Level Agreement (SLA)

3 Contractor Requirements: General

3.1 Contract Initiation Requirements

3.2 End of Work Order Transition

3.3 Invoicing

3.4 Liquidated Damages

3.5 Disaster Recovery and Data

3.6 Insurance Requirements

3.7 Security Requirements

3.8 Security Incident Response

3.9 Problem Escalation Procedure

3.10 SOC 2 Type 2 Audit Report

3.11 Experience and Personnel

3.12 Substitution of Personnel

3.13 Definitions

3.14 Minority Business Enterprise (MBE) Reports

3.15 Veteran Small Business Enterprise (VSBE) Reports

3.16 Work Orders

3.17 Additional Clauses

4 Procurement Instructions

4.1 Pre-Proposal Conference

4.2 eMaryland Marketplace Advantage (eMMA)

4.3 Questions

4.4 Procurement Method

RFP for Maryland Department of Information Technology Page 5 of 118

4.5 Proposal Due (Closing) Date and Time

4.6 Multiple or Alternate Proposals

4.7 Economy of Preparation

4.8 Public Information Act Notice

4.9 Award Basis

4.10 Oral Presentations

4.11 Duration of Proposal

4.12 Revisions to the RFP

4.13 Cancellations

4.14 Incurred Expenses

4.15 Protest/Disputes

4.16 Offeror Responsibilities

4.17 Acceptance of Terms and Conditions

4.18 Proposal Affidavit

4.19 Contract Affidavit

4.20 Compliance with Laws/Arrearages

4.21 Verification of Registration and Tax Payment

4.22 False Statements

4.23 Payments by Electronic Funds Transfer

4.24 Prompt Payment Policy

4.25 Electronic Procurements Authorized

4.26 MBE Participation Goal

4.27 VSBE Goal

4.28 Living Wage Requirements

4.29 Federal Funding Acknowledgement

4.30 Conflict of Interest Affidavit and Disclosure

4.31 Non-Disclosure Agreement

4.32 Nonvisual Access

4.33 Mercury and Products That Contain Mercury

4.34 Location of the Performance of Services Disclosure

4.35 Department of Human Services (DHS) Hiring Agreement

4.36 Small Business Reserve (SBR) Procurement

4.37 Maryland Healthy Working Families Act Requirements

RFP for Maryland Department of Information Technology Page 6 of 118

5 Proposal Format

5.1 Two Part Submission

5.2 Proposal Delivery and Packaging

5.3 Volume I - Technical Proposal

5.4 Volume II – Financial Proposal

6 Evaluation and Selection Process

6.1 Evaluation Committee

6.2 Technical Proposal Evaluation Criteria

6.3 Financial Proposal Evaluation Criteria

6.4 Reciprocal Preference

6.5 Selection Procedures

6.6 Documents Required upon Notice of Recommendation for Contract Award

7 RFP ATTACHMENTS AND APPENDICES

Attachment A. Pre-Proposal Conference Response Form

Attachment B. Financial Proposal Instructions & Form

Attachment C. Proposal Affidavit

Attachment D. Minority Business Enterprise (MBE) Forms

Attachment E. Veteran-Owned Small Business Enterprise (VSBE) Forms

Attachment F. Maryland Living Wage Affidavit of Agreement for Service Contracts

Attachment G. Federal Funds Attachments

Attachment H. Conflict of Interest Affidavit and Disclosure

Attachment I. Non-Disclosure Agreement (Contractor)

Attachment J. HIPAA Business Associate Agreement

Attachment K. Mercury Affidavit

Attachment L. Location of the Performance of Services Disclosure

Attachment M. Contract

Attachment N. Contract Affidavit

RFP for Maryland Department of Information Technology Page 7 of 118

Attachment O. DHS Hiring Agreement

Appendix 1. – Abbreviations and Definitions

Appendix 2. – Offeror Information Sheet

Appendix 3. – Digital Maturity Self-Score Matrix…………………………………………………… 118

RFP for Maryland Department of Information Technology Page 8 of 118

1 Minimum Qualifications

1.1 Offeror Minimum Qualifications

To be considered reasonably susceptible for award, the Offeror must document in its Proposal that the following Minimum Qualifications have been met: The minimum qualifications required for consideration are designed to ensure that potential offerors possess the necessary expertise, experience, and maturity in digital services. Only those Offerors that meet all minimum qualification criteria shall be eligible for proposal evaluation. Offerors not satisfying each of the criteria below will be found not reasonably susceptible for award.

1.1.1 Required Experience

Offerors must:

A. Possess at least three (3) years of experience in designing and developing plain language content, information architecture, website design, and development, as well as designing and implementing digital services applications and software for public sector customers.

B. Achieve a minimum Digital Maturity Self-Score of 25 points total for the Technical and Corporate Qualifications.

1.1.2 Required Documentation:

Offerors must:

A. Complete and submit the Digital Maturity Self-Score Matrix form provided in Appendix 3.

Both tabs, Technical Qualifications & Corporate Qualifications, in the scoring table of the form must be completed.

B. Submit artifacts for the Technical Qualifications tab in each of the categories listed in the columns in the Matrix sheet. to further demonstrate the scored capability. Artifacts may be submitted in various formats including but not limited to text files, PDF documents, or image files. However, artifacts must be in human-readable data formats; artifacts submitted in machine-readable formats (e.g., CSV, JSON, XML) will not be considered. Artifacts may include client deliverables, code (provided in a human-readable format), and/or screenshots. For example, Offerors may include a screenshot of a webpage or copy site code into a text file. Multiple screenshots may be submitted as a single artifact as long as they are related to a single case study.

Artifacts for the Corporate Qualification are not needed as part of the minimum qualifications;

however, they may be requested as part of the Oral Presentation, if applicable.

C. Provide three (3) references from the past five (5) years attesting to the Offeror’s experience in providing digital services within the scope of this solicitation. At least two (2) references must be from public sector customers.

Reference information must include the following:

1. Name of client organization;

2. Name, title, telephone number, email address, of the point of contact for client organization; and

RFP for Maryland Department of Information Technology Page 9 of 118

3. The total dollar value of the contract and/or business with the organization, type of contract, its duration, and a description of services provided.

The Digital Maturity Self Score allows Offerors to critically analyze their capabilities, processes, and methodologies in providing digital services. DoIT believes that this introspective approach will not only aid in identifying the most qualified Offerors but also help the Offerors who are not the best fit for this opportunity to save resources by opting out of the competition.

DoIT reserves the right to request additional references or utilize references not provided by the Offeror.

Points of contact must be accessible and knowledgeable regarding the Offeror's performance.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

RFP for Maryland Department of Information Technology Page 10 of 118

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.1.1 The Maryland Digital Service (MDDS) within the Maryland Department of Information

Technology (“DoIT” or "the Department") is issuing this Request for Proposals (RFP) in order to develop a streamlined enterprise-wide method to obtain digital service support.

2.1.2 It is the State’s intention to obtain goods and services, as specified in this RFP, from a Contract between the selected Offeror and the State. The Contract(s) shall be Fixed Price and Indefinite Quantity Contract(s) as defined in COMAR 21.06.03.02 and 21.06.03.06. Work Order awards will be issued hereunder, as appropriate to the type of services being requested. All rates proposed are fully burdened and inclusive of any travel expenses.

2.1.3 The Department intends to make up to eight (8) awards as a result of this RFP. See RFP Section

4.9 Award Basis for more Contract award information. Periodically during the Contract term, at its discretion, DoIT may announce the opening of expansion windows during which new Offerors may propose to become Contractors.

2.1.4 An Offeror, either directly or through its subcontractor(s), must be able to provide all goods and services and meet all of the requirements requested in this solicitation and the successful Offeror (the Contractor) shall remain responsible for Contract performance regardless of subcontractor participation in the work.

2.1.5 A Contract award does not ensure a Contractor will receive all or any State business under the Contract.

2.1.6 Maryland State and local entities, and not-for-profit entities within the State of Maryland, as defined in State Finance and Procurement 13-110(a)(5) - (7), may purchase from the Contractor goods or services covered by the Contract at the same prices chargeable to the State. All such purchases by non-executive branch entities, non-State governments, government agencies or not-for-profit entities:

A. Shall constitute Contracts between the Contractor and that government, agency or not-for-profit entity;

B. Shall not constitute purchases by the State or State agencies under the Contract;

C. Shall not be binding or enforceable against the State; and D. May be subject to other terms and conditions agreed to by the Contractor and the purchaser.

2.1.7 All Contract prices, terms, and conditions must be provided to any Maryland local government or not-for-profit entity requesting services under the Contract. The Contractor bears the risk of determining whether or not a government, agency or organization with which the Contractor is dealing is a State entity.

2.2 Background, Purpose, and Scope

2.2.1 Background

The mission of the MDDS is to assist agencies in creating consistent and intuitive digital experiences that are user-centered, accessible to all Marylanders, and secure. Marylanders deserve a digital experience with their government that is on par with the experience they have when interacting with top private sector companies.

RFP for Maryland Department of Information Technology Page 11 of 118

This acquisition aims to enhance Maryland's digital landscape, simplifying residents' access to state resources, improving digital user experience, setting operational standards, fostering business opportunities, and securing skilled talent for efficient and inclusive digital services.

2.2.2 Purpose

The purpose of this initiative is to enhance the digital experience for Maryland residents, making it simpler for them to understand and access the benefits and resources provided by the State. Our goal is to implement measurable improvements in the digital user experience, establish clear standards and guidelines for state operations, and create equitable opportunities for both large and small companies to support Maryland's needs. Additionally, we aim to secure access to experienced Contractors capable of delivering Digital Services at scale, including full stack development and specialized web experience projects. This comprehensive approach is designed to not only streamline services for residents but also foster a more efficient, inclusive, and innovative digital landscape within the State of Maryland.

2.2.3 Scope

The Agile Digital Experience Product Transformation (ADEPT) contract is a multi-award contract designed to streamline the procurement of Digital Service Support. It serves as an effective gateway for state agencies to connect with a diverse range of talent, encompassing specialized content strategy firms as well as comprehensive full stack Digital Service Design and development companies. Under this contract, agencies have the flexibility to place orders specifically for Web Experience capabilities or to request more extensive services including full stack Application System and Software Development. This contract is tailored to meet the varying digital service needs of Maryland State Agencies, ensuring access to both niche and broad skill sets as required. Vendors awarded a contract under this contract shall cultivate a positive, trusting, and cooperative working relationship with the State and other vendors supporting this work.

2.2.4 Period/Place of Performance, and Investment

The contracts awarded will consist of a Five (5) Year Base Period, with Two (2), Two-Year Option Periods. Contractor(s) shall perform at their location within the Continental United States. However, travel may be necessary to various locations throughout the State of Maryland. Expected work orders under these contracts are anticipated to vary, with values ranging from under $100,000 to up to $3 million. However, the State retains the discretion to place orders exceeding this range, based on evolving requirements and budgetary considerations. Prospective Offerors are advised to form partnerships and create collaborative structures that enable them to compete effectively for contracts of varying scale.

2.3 Responsibilities and Tasks

A. The nature of the work orders to be issued under this Contract may vary, e.g., discovery only, discovery and design, or a comprehensive scope of discovery, design, and development.

B. The work orders may cover some or all of the following types of activities:

1. User Research and User Story Collaboration: The Contractor shall use a range of qualitative and quantitative user research methods to determine people’s goals, needs, and behaviors. If requested in the work order, the Contractor shall have the ability to recruit test users from a variety of backgrounds. This research shall be documented in a form that the State and other Contractors can easily access and learn from. The Contractor shall work with the product owner or other State staff to generate and prioritize user stories based on this research.

RFP for Maryland Department of Information Technology Page 12 of 118

2. User-Centered Design: The Contractor shall design digital services that help people easily complete the desired tasks. Work will include UX strategy, UI and visual design, rapid prototyping, and front-end engineering.

3. Plain-Language Content Writing: The Contractor shall work with various stakeholders to develop written plain-language content that is easy for people to understand while accurately describing State processes, requirements and other content. Content shall be tested with users to ensure it is easily understood.

4. Agile Software Development: The Contractor shall develop software in an iterative style following the modern best practices described in the Digital Services Playbook (https://playbook.cio.gov). Specific technologies to be used (if known) will be communicated at the Work Order level but will commonly include industry-standard web programming languages and frameworks such as JavaScript, Ruby, Java, and .NET; or COTS and/or SaaS products and platforms that can be used or adapted to meet the State’s needs. Specific capabilities to be delivered by a team will be defined at the Work Order level, but may include developing/modifying responsive web applications, developing/modifying REST APIs, and developing/modifying native mobile applications.

Activities may include writing custom software, configuring Software as a Service (SaaS) platforms, or configuring COTS and/or SaaS products to support specific objectives.

Software developed under this RFP will be covered by automated unit and integration tests, and all software and configurations created under the RFP will be developed in a modern software version control system specified by the State. Contractors shall use both code reviews and automated checks to ensure software quality. The Contractor shall monitor industry trends and propose suitable technologies to implement to the State.

5. Product Management: The Contractor shall provide the oversight, planning and strategy to design, develop, and deliver products. This includes defining and managing product roadmap definitions and life cycles to ensure productivity throughout the entire product life cycle from idea to marketing and post-launch product phases, with a clear and complete product view throughout.

6. Automated Testing: The Contractor shall create and maintain an automated test suite for the purposes of performing automated unit, functional and integration testing on all user stories and for ongoing regression testing to ensure functionality and quality of the overall system. These automated tests shall be integrated into the continuous integration workflow, such that new features delivered do not break existing capabilities and can be verified with new automated tests.

7. Accessibility Testing: The Contractor shall evaluate products delivered by the team by testing them with users throughout the development lifecycle. This includes, but is not limited to, performing Section 508 testing. Findings from usability testing shall be used to iteratively improve the products.

8. Usability Testing: The Contractor shall use Usability testing to evaluate how easy a product is to use by testing it with real users to observe how they interact with it and identify areas for improvement.

9. Continuous Improvement: The Contractor shall provide Continuous Product support by providing enhancements support etc.

10. Deployment Activities: The Contractor shall plan, create and validate the implementation and deployment of scripts for use during application deployment, and https://playbook.cio.gov/

RFP for Maryland Department of Information Technology Page 13 of 118 provide release planning and management support. Deployments should not require any planned or unplanned downtime or outages.

11. DevSecOps: The Contractor shall work collaboratively and cross functionally with engineering and operations to implement CI/CD, production monitoring, and production support. The Contractor shall support its own code while in production. The Contractor shall be experienced with modern commercial cloud environments and tools, and have experience deploying code to testing, staging, and production in a commercial cloud environment.

12. Integration Support: The Contractor shall integrate open source, COTS and/or SaaS solutions into existing, custom built, or new systems and provide configuration, customization and implementation services. The Contractor shall also integrate with other State systems using modern standards-based communication protocols and data formats.

13. Cross-Functional Collaboration: The Contractor shall participate in integrated program, project, or product teams and agile teams to enhance communication, share lessons learned and facilitate rapid identification of dependencies between various functional entities to ensure that the projects deliver the right solutions and value to the business and end-users. This collaboration may include coaching product teams as directed in support of State attempts to stand up or execute an agile project.

14. Metrics Reporting and Analytics: The Contractor shall develop and communicate project metrics. This may include both metrics about the delivery of the products, such as agile burn down charts, release roadmaps, and schedule, as well as analytics about product usage, such as number of users or transactions. It is expected that all capabilities delivered under this RFP will be instrumented with system monitoring, error tracking, and user analytics.

15. Data Science: The Contractor shall leverage advanced analytical techniques and data-driven insights to optimize business processes, enhance decision-making, and uncover hidden opportunities. This will involve collecting, processing, and analyzing large datasets to build predictive models and algorithms, ultimately aiming to improve efficiency, increase profitability, and support strategic goals in a measurable and impactful way. This will prioritize innovation in data handling and analysis, ensuring accuracy, security, and compliance with relevant regulations. This can include AI and ML and associated model governance.

16. UX Measurement: The Contractor shall leverage data to help understand and prioritize digital products for improvement. This will involve implementing a range of qualitative and quantitative research methods, such as user testing, surveys, and analytics, to gather insights about user behavior and preferences. The aim is to continuously refine and optimize user interfaces and interactions to meet and exceed user expectations, thereby improving customer engagement, satisfaction, and loyalty.

2.3.1 Web Experience Responsibilities and Tasks

A. Work orders for Web Experience Contractors are anticipated to provide the Department with well-rounded teams, possessing expertise across a variety of disciplines. These include:

1. Product Management,

2. User Research,

3. UX Strategy, RFP for Maryland Department of Information Technology Page 14 of 118

4. Information Architecture,

5. Content Strategy,

6. Plain Language Content Design,

7. User Interface,

8. Visual Design, and

9. Proficiency In Content Management Systems.

The scope of responsibilities is expected to be diverse and comprehensive.

B. Key tasks may involve leading user centric website redesigns for various agencies, aiming to enhance both customer and user experiences by improving site navigation, content, and interaction design. A significant part of the Contractor’s role will be to create and refine content in plain language, working in tandem with agency stakeholders and conducting user testing to ensure content clarity and understandability. Contractors will also be responsible for supporting the implementation of Google Analytics 4 (GA4) and providing expert recommendations for Search Engine Optimization (SEO).

C. Additionally, Contractors will play a crucial role in developing and implementing statewide guidelines and patterns (leveraging the US Web Design System), which will help standardize and regulate websites and applications across agencies. Another important aspect will be conducting research on various Content Management System (CMS) alternatives, followed by providing a detailed assessment report on the feasible options, aiding the Department in making informed decisions for the State’s digital infrastructure.

2.3.2 Application System and Software Development Responsibilities and Tasks

A. Work orders for Application System and Software Development are anticipated to provide the Department with well-rounded teams, possessing expertise in a variety of tasks, tailored to the evolving needs of the projects. These tasks could range from short-term product discovery sessions, aimed at defining problems and user needs, to the development or integration of software products for specific programmatic needs. Additionally, there may be opportunities for Contractors to conduct usability testing and analytics, along with Content Management System (CMS) development, implementation, and content migration. A significant aspect of these potential tasks will involve embedding Agile methodologies into workflows, ensuring high-quality product delivery that adheres to the 'Definition of Done' and aligns with the Digital Services Playbook guidelines.

B. Future work may also entail designing and optimizing solutions to support the State’s initiatives, with a focus on mobile-first operations and maintaining a consistent user interface across platforms. Incorporating robust accessibility principles and actively engaging users in the design process will likely be integral to these tasks. Embracing modern digital services using DevOps techniques, including Continuous Integration and Continuous Deployment, might also be a key component of the work. Contractors will need to stay abreast of current and emerging technologies, exploring COTS and SaaS products to deliver personalized, high-quality solutions.

Furthermore, a strong emphasis on security and comprehensive functionality testing using automated frameworks will be essential to meet the diverse and dynamic requirements of the State’s digital initiatives.

https://designsystem.digital.gov/

RFP for Maryland Department of Information Technology Page 15 of 118

2.3.3 Contractor-Supplied Hardware, Software, and Materials

A. By responding to this RFP and accepting a Contract award, the Offeror specifically agrees that for any software, hardware or hosting service that it proposes, the State will have the right to purchase such item(s) from another source, instead of from the selected Offeror.

B. SaaS applications shall be accessible from various client devices through a thin client interface such as a Web browser (e.g., Web-based email) or a program interface.

C. The State shall be permitted limited user-specific application configuration settings.

D. The Contractor is responsible for the acquisition and operation of all hardware, software and network support related to the services being provided, and shall keep all software current.

E. All Upgrades and regulatory updates shall be provided at no additional cost, as part of the agile development process, and subject to backlog prioritization.

F. The State also requires that the Offeror provide fully functional, generally available software and multiple-user licenses for purchase as needed throughout the life of the Contract.

G. The Offeror shall install and provide all documentation for the software furnished under the Contract.

H. Hardware and software costs procured as part of the RFP cannot exceed 30 percent of the total Contract value.

I. Material costs shall be passed through with no mark-up by the Contractor.

J. The Contractor shall prepare software releases and stage at the Department for validation in the system test environment. The Department will provide authorization to proceed. The Department will have the ability to manage the distribution of these releases to the appropriate sites. To support this requirement, the Contractor shall propose, provide and fully describe their solution for updating all sites with any new software releases.

K. The Offeror shall provide manufacturer or provider’s standard warranty for the item. Any warranty period for goods and services will not commence until acceptance of the products or services by the Department. Notwithstanding anything to the contrary, all defective items must be replaced at no additional cost to the State.

2.3.4 Required Project Policies, Guidelines, and Methodologies

The Contractor shall be required to comply with all applicable laws, regulations, policies, standards and guidelines affecting Information Technology projects, which may be created or changed periodically. Offeror is required to review all applicable links provided below and state compliance in its response.

It is the responsibility of the Contractor to ensure adherence and to remain abreast of new or revised laws, regulations, policies, standards and guidelines affecting project execution. These include, but are not limited to:

a) Digital Service Playbook: https://playbook.cio.gov/;

b) The State of Maryland System Development Life Cycle (SDLC) methodology at:

http://doit.maryland.gov/SDLC/Pages/agile-sdlc.aspx;

c) The State of Maryland Information Technology Security Policy and Standards at:

https://doit.maryland.gov/policies/Pages/20-07-IT-Security-Policy.aspx;

d) The State of Maryland Digital Accessibility Policy:

https://doit.maryland.gov/policies/Pages/DigitalAccessibilityPolicy.aspx;

https://playbook.cio.gov/ http://doit.maryland.gov/SDLC/Pages/agile-sdlc.aspx https://doit.maryland.gov/policies/Pages/20-07-IT-Security-Policy.aspx https://doit.maryland.gov/policies/Pages/DigitalAccessibilityPolicy.aspx

RFP for Maryland Department of Information Technology Page 16 of 118

The Contractor shall follow Agile methodologies for software design and development.

2.3.5 Future Work Order Requirements

A. Offerors may propose open-source software; however, the Offeror must provide operational support for the proposed software as part of its Proposal.

B. Offerors shall be authorized to furnish the proposed goods and services. Offerors proposing to resell services of another entity must be authorized by such other entity (See RFP Section 5.3.2).

C. No international processing for State Data: As described in Section 3.7 Security Requirements, Offerors are advised that any processing or storage of data outside of the continental U.S. is prohibited.

D. Any Contract award is contingent on the State’s agreement, during the Proposal evaluation process, to any applicable terms of use and any other agreement. Such agreed upon terms of use shall apply consistently across services ordered under the Contract.

E. The Contractor shall not establish any auto-renewal of services beyond the period identified in Contract documents.

F. In addition to any notices of renewal sent to the Department, Contractors shall email notices of renewal to the email address designated by the Contract Monitor.

G. Additional information will be provided on the work order level.

2.4 Examples of Work Order Deliverables

A. Deliverables under this Contract are defined as the completion and acceptance according to the

“Definition of Done” of the iterations completed, which are based on the Agile Software Development Methodology. This methodology defines the repeatable process of providing development and deployment services in small iterations lasting two to five weeks which results in the delivery of human centered design, usable software, data, or product, which have little to no inherent defects.

B. The iteration process shall be defined in the Performance Work Statement (PWS) and should document how planning, requirement analysis (user story building), design, development, testing, quality assurance, and documentation will all meet the Contractor’s “Definition of Done”.

C. Below are examples of Work Order Deliverables that the Contractor may be required to provide:

Deliverable Performance Standard(s) Acceptable Quality Level Method of Assessment

Tested Code Code delivered under the order must have substantial test code coverage and a clean code base Version-controlled, public repository of code comprising the product, which will remain in the government domain

Minimum of 90% test coverage of all code

Combination of manual review and automated testing

RFP for Maryland Department of Information Technology Page 17 of 118

Properly Styled Code

GSA 18F Front-End Guide 0 linting errors and 0 warnings

Combination of manual review and automated testing

Accessibility Web Content Accessibility Guidelines 2.1 AA standards

0 errors reported using an automated scanner, and 0 errors reported in manual testing

Pa11y

Deployed Code must successfully build and deploy into staging environment

Successful build with a single command

Combination of manual review and automated testing

Documented All dependencies are listed and the licenses are documented. Major functionality in the software/source code is documented. Individual methods are documented inline using comments that permit the use of documentation-generation tools such as JSDoc. A system diagram is provided

Combination of manual review and automated testing, if available

Manual review

Security OWASP Application Security Verification Standard 4.0, Level 2

Code submitted must be free of medium- and high-level static and dynamic security vulnerabilities

Clean tests from a static testing SaaS (such as npm audit) and from OWASP ZAP, along with documentation explaining any false positives

User research Usability testing and other user research methods must be conducted at regular intervals throughout the

Artifacts from usability testing and/or other research methods with end users are available at the

Manual review https://frontend.18f.gov/ https://github.com/pa11y/pa11y http://usejsdoc.org/ https://www.owasp.org/images/d/d4/OWASP_Application_Security_Verification_Standard_4.0-en.pdf https://www.owasp.org/images/d/d4/OWASP_Application_Security_Verification_Standard_4.0-en.pdf https://www.owasp.org/images/d/d4/OWASP_Application_Security_Verification_Standard_4.0-en.pdf https://docs.npmjs.com/cli/audit https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

RFP for Maryland Department of Information Technology Page 18 of 118 development process (not just at the beginning or end) end of every applicable sprint, in accordance with the vendor’s research plan

2.5 Service Level Agreement (SLA)

Service Level Agreement (SLA) may be identified on the work order level.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

RFP for Maryland Department of Information Technology Page 19 of 118

3 Contractor Requirements: General

3.1 Contract Initiation Requirements

The Department will schedule a kickoff meeting with the Contractors.

3.2 End of Work Order Transition

3.2.1 Contractors shall provide transition assistance as requested by the State to facilitate the orderly transfer of services to the State or a follow-on Contractor during the 30-day period prior to Work Order end date, or the termination thereof. Such transition efforts shall consist, not by way of limitation, of:

A. Provide additional services and support as requested to successfully complete the transition;

B. Maintain the services called for by the Work Order at the required level of proficiency;

C. Provide updated System Documentation, as appropriate; and D. Provide current operating procedures (as appropriate).

3.2.2 The Contractor shall work toward a prompt and timely transition, proceeding in accordance with the directions of the Contract Monitor. The Contract Monitor may provide the Contractor with additional instructions to meet specific transition requirements prior to the end of the Contract.

3.2.3 The Contractor shall ensure that all necessary knowledge and materials for the tasks completed are transferred to the custody of State personnel or a third party, as directed by the Contract Monitor.

3.2.4 The Contractor shall support End-of-Work Order transition efforts with technical and project support to include but not be limited to:

A. The Contractor shall provide a draft Transition-Out Plan 150 Business Days in advance of Contract end date addressing, at a minimum, the following areas:

i. Any staffing concerns/issues related to the closeout of the Work Order;

ii. Communications and reporting process between the Contractor, the Department and the Contract Monitor;

iii. Security and system access review and closeout;

iv. Connectivity services provided, activities, and approximate timelines required for

Transition-Out;

v. Knowledge transfer, to include reviewing with the Department the procedures and practices that support the business process and current system environments;

vi. End of Work Order transition out will include equipment removal and coordinating with the incoming vendor to support data transfer and ticket cashing during and after transition to a new contract; and

vii. Any risk factors with the timing and the Transition-Out schedule and transition process.

The Contractor shall document any risk factors and suggested solutions.

B. The Contractor shall ensure all documentation and data including, but not limited to, System Documentation and current operating procedures, is current and complete with a hard and soft copy in a format prescribed by the Contract Monitor.

RFP for Maryland Department of Information Technology Page 20 of 118

C. The Contractor shall provide copies of any current daily and weekly back-ups as directed by the Contract Monitor as of the final date of transition, but no later than the final date of the Work Order.

D. Access to any data or configurations of the furnished product and services shall be available after the expiration of the Work Order as described in Section 3.2.5.

3.2.5 Return and Maintenance of State Data

A. Upon termination or the expiration of the Work Order Term, the Contractor shall: (i) return to the State all State data in either the form it was provided to the Contractor or in a mutually agreed format along with the schema necessary to read such data; (ii) preserve, maintain, and protect all State data until the earlier of a direction by the State to delete such data or the expiration of 90 days (“the retention period”) from the date of termination or expiration of the Work Order term;

(iii) after the retention period, the Contractor shall securely dispose of and permanently delete all State data in all of its forms, such as disk, CD/DVD, backup tape and paper such that it is not recoverable, according to National Institute of Standards and Technology (NIST)-approved methods with certificates of destruction to be provided to the State; and (iv) prepare an accurate accounting from which the State may reconcile all outstanding accounts. The final monthly invoice for the services provided hereunder shall include all charges for the 90-day data retention period.

B. In addition to the foregoing, the State shall be entitled to any post-termination/expiration assistance generally made available by Contractor with respect to the services.

3.3 Invoicing

3.3.1 General

A. The Contractor shall email the original of each invoice and signed authorization to invoice to the Contract Monitor and as otherwise specified in a Work Order.

B. All invoices for services shall be verified by the Contractor as accurate at the time of submission.

C. An invoice not satisfying the requirements of a Proper Invoice (as defined at COMAR

21.06.09.01 and .02) cannot be processed for payment. To be considered a Proper Invoice, invoices must include the following information, without error:

1) Contractor name and address;

2) Remittance address;

3) Federal taxpayer identification (FEIN) number, social security number, as appropriate;

4) Invoice period (i.e. time period during which services covered by invoice were performed);

5) Invoice date;

6) Invoice number;

7) State assigned Contract number;

8) State assigned (Blanket) Purchase Order number(s);

9) Goods or services provided;

RFP for Maryland Department of Information Technology Page 21 of 118

10) Amount due; and

11) Any additional documentation required by regulation or the Contract.

D. The Department reserves the right to reduce or withhold Contract payment in the event the Contractor does not provide all required deliverables within the time frame specified in the Contract or Work Order or otherwise breaches the terms and conditions of the Contract or Work Order until such time as the Contractor brings itself into full compliance with the Contract.

E. Any action on the part of the Department, or dispute of action by the Contractor, shall be in accordance with the provisions of Md. Code Ann., State Finance and Procurement Article §§ 15- 215 through 15-223 and with COMAR 21.10.04.

F. The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of Columbia sales taxes and transportation taxes. The Contractor; however, is not exempt from such sales and use taxes and may be liable for the same.

G. Invoices for final payment shall be clearly marked as “FINAL” and submitted when all work requirements have been completed and no further charges are to be incurred under the Contract.

In no event shall any invoice be submitted later than 60 calendar days from the Contract termination date.

3.3.2 Invoice Submission Schedule

The Contractor shall submit invoices in accordance with the following schedule:

A. For items of work for which there is one-time pricing (see Attachment B – Financial Proposal Form) those items shall be billed in the month following the acceptance of the work by the Department.

B. For items of work for which there is annual pricing, see Attachment B– Financial Proposal Form, those items shall be billed in equal monthly installments for the applicable Contract year in the month following the performance of the services.

1. Deliverable Invoicing

Deliverable based invoices shall be accompanied by notice(s) of acceptance issued by the State. Payment of invoices will be withheld if a signed DPAF is not submitted (see online example at http://doit.maryland.gov/contracts/Documents/_procurementForms/DeliverableProduct AcceptanceForm-DPAFsample.pdf).

Payment for deliverables will only be made upon completion and acceptance of the deliverables as defined in Section 2.4.

2. Labor Hour Invoicing

All labor hour invoices shall be accompanied by a signed timesheet as described below and notice(s) of acceptance issued by the State: DPAF for each time period invoiced (see online example at http://doit.maryland.gov/contracts/Documents/_procurementForms/DeliverableProduct AcceptanceForm-DPAFsample.pdf). Include for each person covered by the invoice the following, individually listed per person: name, hours worked, hourly labor rate, invoice amount and a copy of each person’s timesheet for the period signed by the Contract Monitor.

a. Time Sheet Reporting

RFP for Maryland Department of Information Technology Page 22 of 118

Within three (3) Business Days after the 15th and last day of the month, the TO Contractor shall submit a semi-monthly timesheet for the preceding half month providing data for all resources provided under the Contract.

At a minimum, each semi-monthly timesheet shall show:

1) Title: “Time Sheet for <<xxxxx>>”;

2) Issuing company name, address, and telephone number;

3) For each employee /resource:

a) Employee / resource name, and

b) For each Period ending date, e.g., “Period Ending: mm/dd/yyyy”

(Periods run 1st through 15th, and 16th through last day of the month.):

i) Tasks completed that week and the associated deliverable names and ID#s;

ii) Number of hours worked each day;

iii) Total number of hours worked that Period;

iv) Period variance above or below 40 hours;

v) Annual number of hours planned under the work order;

vi) Annual number of hours worked to date; and

vii) Balance of hours remaining;

4) Annual variance to date (Sum of periodic variances); and

5) Signature and date lines for the Contract Monitor.

Time sheets shall be submitted to the Contract Monitor prior to invoicing. The Contract Monitor shall sign the timesheet to indicate authorization to invoice.

3.3.3 For the purposes of the Contract an amount will not be deemed due and payable if:

A. The amount invoiced is inconsistent with the Contract;

B. The proper invoice has not been received by the party or office specified in the Contract;

C. The invoice or performance is in dispute or the Contractor has failed to otherwise comply with the provisions of the Contract;

D. The item or services have not been accepted;

E. The quantity of items delivered is less than the quantity ordered;

F. The items or services do not meet the quality requirements of the Contract;

G. If the Contract provides for progress payments, the proper invoice for the progress payment has not been submitted pursuant to the schedule;

H. If the Contract provides for withholding a retainage and the invoice is for the retainage, all stipulated conditions for release of the retainage have not been met; or

RFP for Maryland Department of Information Technology Page 23 of 118

I. The Contractor has not submitted satisfactory documentation or other evidence reasonably required by the Procurement Officer or by the Contract concerning performance under the Contract and compliance with its provisions.

3.3.4 Travel Reimbursement

Travel will not be reimbursed under this RFP.

3.4 Liquidated Damages

3.4.1 MBE Liquidated Damages

MBE liquidated damages are identified in Attachment M.

3.4.2 Liquidated Damages other than MBE

THIS SECTION IS INAPPLICABLE TO THIS RFP.

3.5 Disaster Recovery and Data

The following requirements apply to the Contract:

3.5.1 Redundancy, Data Backup, and Disaster Recovery

A. Unless specified otherwise in the RFP, Contractor shall maintain or cause to be maintained disaster avoidance procedures designed to safeguard State data and other confidential information, Contractor’s processing capability and the availability of hosted services, in each case throughout the Contract term. Any force majeure provisions of the Contract do not limit the Contractor’s obligations under this provision.

B. The Contractor shall have robust contingency and disaster recovery (DR) plans in place to ensure that the services provided under the Contract will be maintained in the event of disruption to the Contractor/subcontractor’s operations (including, but not limited to, disruption to information technology systems), however caused.

1. The Contractor shall furnish a DR site.

2. The DR site shall be at least 100 miles from the primary operations site and have the capacity to take over complete production volume in case the primary site becomes unresponsive.

C. The contingency and DR plans must be designed to ensure that services under the Contract are restored after a disruption within twenty-four (24) hours from notification and a recovery point objective of one (1) hour or less prior to the outage in order to avoid unacceptable consequences due to the unavailability of services.

D. The Contractor shall test the contingency/DR plans at least twice annually to identify any changes that need to be made to the plan(s) to ensure a minimum interruption of service. Coordination shall be made with the State to ensure limited system downtime when testing is conducted. At least one (1) annual test shall include backup media restoration and failover/fallback operations at the DR location. The Contractor shall send the Contract Monitor a notice of completion following completion of DR testing.

E. Such contingency and DR plans shall be available for The Department to inspect and…