RFP Document.pdf

UPDATED JANUARY 2025 V2.0 1

STATE OF SOUTH DAKOTA

BUREAU OF INFORMATION AND TELECOMMUNICATIONS

700 GOVERNORS DRIVE

PIERRE, SOUTH DAKOTA 57501

Acquisition of Information Technology (IT) Staff Augmentation Services

PROPOSALS ARE DUE NO LATER THAN

February 28, 2025 (5:00PM CST)

RFP: #25RFP12070

BUYER: Bureau of Information and Telecommunications (BIT)

EMAIL: harold.bruce@state.sd.us

READ CAREFULLY

FIRM NAME: AUTHORIZED SIGNATURE:

ADDRESS: TYPE OR PRINT NAME:

CITY/STATE: TELEPHONE NO:

ZIP (9 DIGITS): FAX NO:

E-MAIL:

PRIMARY CONTACT INFORMATION

CONTACT NAME:

TELEPHONE NO:

FAX NO: E-MAIL:

UPDATED JANUARY 2025 V2.0 3

1 GENERAL INFORMATION

1.1 PURPOSE OF REQUEST FOR PROPOSAL (RFP)

1.1.1 Background:

The State of South Dakota (“State”) uses, or will use, a wide range of technologies and IT services to develop, maintain, and enhance its existing application portfolio and meet the business needs of state agencies.

1.1.2 Goals and Objectives:

On behalf of the State, the Bureau of Information and Telecommunications (“BIT”) is initiating this RFP to obtain a list of qualified vendors who can expand and enhance the

State’s existing technologies by providing a wide range of services reflected in Section

1.1.3. BIT anticipates that as a result of this RFP, there will be multiple winning vendors.

The selected winning vendors will sign a Master Service Agreement (“MSA”) with BIT. As

IT Staff Augmentation technology services are needed by state agencies, a state agency may request a cost proposal from a qualified vendor or bids from several qualified vendors for the needed services. The selected qualified vendor will enter into a job specific

Statement of Work (“SOW”) with the state agency for the needed services.

1.1.3 Description of Components:

The staff skills needed are listed in the following tables:

Mainframe System Programming and Applications Programming

Skills and/or roles to include, but are not limited to:

Assembler for z/OS

Broadcom/Computer Associates Suite– CA1, CA7, JCLCheck, FAVER, Vision:Results

CICS

COBOL

Compuware Suite - Abendaid, FileAid, XPediter

Connect Direct for zOS and Windows

DFSMS – dss and hsm

Easy RACF Query (ERQ)

EOS

IPCP/Plus

LRS VPS and VMCF

PACE (Komand, DAS, FMS)

PSF

SAG Suite – ADABAS, Natural, Broker

SAS

SYSD

TCPIP/VTAM

z/OS (including JES2, SMP/E, RACF, REXX, RMF, TSO)

UPDATED JANUARY 2025 V2.0 4

Mainframe System Programming and Applications Programming z/OS Unix System Services

Others as needed

System Administration and Support

Active Directory

AMAG Door Security

Audit Studio Administration

Azure Database and BI PAAS (Microsoft)

Brocade Fiber Channel switch configuration

Citrix

Cognos Administration

Configuration of Solaris Network parameters (DHCP)

Configuring Solaris Printers

Control-M

Data Conversion

Database Administration (DBA)

DNS

Doc1 Administration

Edifecs Administration

EntireX (Software AG)

ETG / ERG Administration

Exchange/Email/O365

F5

FileDirector

Firewall rule configurations

GIS infrastructure integration and support

HP’s SVSP, including Sync Mirrors

IBM Infosphere Datastage Administration

IBM Rational Tools (Clearcase + Clearquest) Administration

IBM SGKLM

IBM WebSphere Administration

IIS

InRule Business Rules Engine Administration

Install, configure, patch Microsoft Windows Server versions 2003, 2008

Interactive Voice Response

ITS

JAVA, J2EE, XML, SOA

Microsoft SQL Server

UPDATED JANUARY 2025 V2.0 5

System Administration and Support

Natural (Software AG)

Open Edms Administration

Oracle

Oracle (Sun) Hardware Installation

PCI Compliance/Defender

PowerShell

RACF Mainframe Security

SAN administration

Service Bus (Oracle SOA Suite or SAG/IBM WebMethods)

Sharepoint/Teams/OneDrive

Simple Mail Transfer Protocol (SMTP) setup and support

SNMP setup and support

Solaris (Jumpstart)

Solaris Installation and support

Solaris Partitions (LDOMS)

Solaris performance monitoring

Solaris users, groups, and security levels

Sophos virus protection on Solaris platforms

Sun Solaris Administration

Sun Storage Arrays

Tivoli Storage Manager (TSM) backup and archive server and client

Unix

UNIX UFS and ZFS File Systems

VmWare

Vovici’s Enterprise Feedback Management (EFM)

WebSphere installation and support

Windows Desktop and Server

Windows Server

Windows software installations

Applications Programming/Development

Application development for mobile devices

Audit Studio Development

Cognos Reports Development / Business Intelligence Experience

Crystal Reports

Data Analysis Development utilizing SAS, R/R-Studio, Python

Data Modeler/Modeling

Doc1 Administration & Development

UPDATED JANUARY 2025 V2.0 6

Applications Programming/Development

EDI Development

ETG / ERG Development

GIS related programming skills, analysis and development, including Python

InRule Business Rules Engine Development

Open Edms Development

Oracle, Sql, Pl/Sql, UNIX Shell Scripting

PowerBuilder

Web Development including:

• HTML5, CSS

• .NET – C#, ASP MVC, Web API

• .NET Core

• .NET Framework

• APIs

• JSON

• jQuery

• JavaScript

• Dojo toolkit

Consulting/Administrative Services

Application Development Methodologies:

• Agile

• SCRUM

• Use of Azure DevOps (formally TFS) or other modern source control/ALM technologies

• Software Development Lifecycle (SDLC)

Business Intelligence

Business/Systems Analyst

Data Governance

Data Scientist

Data Warehouse

Design and implementation of a comprehensive backup and recovery policy

Disaster Recovery planning and implementation

IT and/or Security Policy creation and implementation

Project and Portfolio Management

Project Management and change management procedures

Resources for User Acceptance Testing with Medicaid Experience

Technical Architect

Web services architecture planning

UPDATED JANUARY 2025 V2.0 7

Consulting/Administrative Services

Others as needed

Cloud Platform: ServiceNow

Products to include, but are not limited to:

• App Engine

• Automation Engine

• Customer Service Management

• Enterprise Asset Management

• Field Service Management

• Financial Services Management

• Governance, Risk, and Compliance

• Healthcare and Life Sciences Service Management

• HR Service Delivery

• Integration Hub

• IT Assess Management

• IT Operations Management

• IT Service Management

• Legal Service Delivery

• Manufacturing Connected Workforce

• Operational Technology Management

• Order Management

• Order Management for Technology Providers

• Order Management for Telecommunications

• Procurement Service Management

• Public Sector Digital Services

• Security Operations

• ServiceNow Platform Encryption

• ServiceNow Vault

• Strategic Portfolio Management

• Supplier Lifecycle Management

• Technology Provider Service Management

• Telecommunications Network Inventory

• Telecommunications Service Management

• Telecommunications Service Operations Management

• Workplace Service Delivery

Skills and/or Roles to include, but are not limited to:

UPDATED JANUARY 2025 V2.0 8

Cloud Platform: ServiceNow

• Business Analyst

• Engagement Manager

• Scrum/Project Manager

• ServiceNow Developer

• ServiceNow Security Engineer/Architect

• ServiceNow Solution/Technical Architect

• ServiceNow Technical Consultant

• ServiceNow Technical Trainer

• User Experience and Graphics Specialist

Cloud Platform: Azure and Power Platform

• Microsoft Azure Services

• Microsoft Dynamics 365

• Microsoft Power Apps

• Microsoft Power Automate

• Microsoft Power BI Services

• Microsoft Purview

• Microsoft EntraID

• Microsoft Cloud Security Platform

Skills and/or Roles to include, but are not limited to:

• Azure Data Engineer

• Azure Platform Architect

• Azure Platform Automation Architect

• Azure Platform Security Engineer

• Business Analyst

• Engagement Manager

• Microsoft Dynamics 365 Developer

• Microsoft Power Apps Developer

• Microsoft Power Automate Developer

• Microsoft Power BI Development

• Scrum/Project Manager

Cloud Platform: Amazon Web Services (AWS)

• Administer managed database instances.

UPDATED JANUARY 2025 V2.0 9

• Audit readiness for compliance

• Auto Scaling Groups (ASGs)

• AWS Backup

• AWS Budgets

• AWS Config

• AWS Cost Explorer

• AWS Security Hub

• CloudTrail

• CloudWatch

• Configure Virtual Private Clouds, subnets, route tables, and gateways.

• Cross-region replication for disaster recovery.

• DNS

• EBS Snapshots

• EC2

• Elastic Beanstalk for application deployment.

• Encryption with KMS

• Identity and access management policies.

• Load Balancing: Configure and troubleshoot

• Patching and system updates with AWS Systems Manager.

• Proficiency in Linux (Amazon Linux, Ubuntu, RHEL) and Windows Server.

• Rightsizing instances and reserved capacity planning.

• S3

• Scripting with Python, Bash, or PowerShell

• Security Groups & NACLs

• Serverless automation tasks.

• Terraform or CloudFormation for Infrastructure as Code (IaC).

Skills and/or Roles to include, but are not limited to:

• Business Analyst

• Cloud Infrastructure Engineer

• Cloud Operations Manager

• Cloud Support Associate

• Data Engineer

• DevOps Engineer

• Engagement Manager

• Platform Architect

• Platform Automation Architect

UPDATED JANUARY 2025 V2.0 10

• Platform Security Engineer

• Scrum/Project Manager

• Site Reliability Engineer (SRE)

• Solutions Architect

• Systems Administrator

The total dollar amount for all SOWs entered into as a result of this RFP cannot exceed $25 million.

There is no guarantee of work. Specific SOWs to acquire professional services with job specific terms and conditions and scopes of work will be created on an as needed basis.

1.2 ISSUING OFFICE AND RFP REFERENCE NUMBER

BIT is the issuing office for this document and all subsequent addenda relating to it. The reference number for the transaction is RFP #25RFP12070. This number must be referred to on all proposals, correspondence, and documentation relating to the RFP.

1.3 LETTER OF INTENT

All interested Offerors must submit a Letter of Intent to respond to this RFP.

The Letter of Intent must be submitted to Harold Bruce via email at harold.bruce@state.sd.us. Please place the following in the subject line of your email:

“Letter of Intent for RFP #25RFP12070”.

1.4 SCHEDULE OF ACTIVITIES (SUBJECT TO CHANGE)

RFP Publication: 01/17/2025

Letter of Intent and NDA Response Due: (5:00PM CST) 01/31/2025

Deadline for Submission of Written Inquiries: (5:00PM CST) 02/07/2025

Responses to Offeror Questions: (5:00PM CST) 02/24/2025

Proposal Submission: (5:00PM CST) 02/28/2025

Evaluation of Proposals: 04/04/2025

Anticipated Award Decision/Contract Negotiation: 04/11/2025

UPDATED JANUARY 2025 V2.0 11

1.5 SUBMITTING YOUR PROPOSAL

All proposals must be completed and received by BIT by the date and time indicated in the

Schedule of Activities.

Each Offeror must provide BIT an electronic version of the proposal. The electronic version should be provided in MS WORD or in PDF format to harold.bruce@state.sd.us.

The email, including attachments, must be limited to 20MB in size.

All proposals must be signed by an officer of the Offeror, legally authorized to bind the

Offeror to the proposal. Proposals that are not properly signed may be rejected. The first page of the RFP must accompany the proposal submission, completed and signed.

No proposal will be accepted from, or no contract or purchase order will be awarded to any person, firm, or corporation that is in arrears upon any obligations to the State of South

Dakota, or that otherwise may be deemed irresponsible or unreliable by the State of South

Dakota.

1.6 CERTIFICATION REGARDING DEBARMENT, SUSPENSION, INELIGIBILITY,

AND VOLUNTARY EXCLUSION – LOWER TIER COVERED TRANSACTIONS

By signing and submitting a proposal to this RFP, the Offeror certifies that neither it nor its principals are presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participation, by any federal department or agency, from transactions involving the use of federal funds. If the Offeror is unable to certify to any of the statements in this certification, the Offeror mush attach an explanation to its proposal.

1.7 NON-DISCRIMINATION STATEMENT

The State requires that all contractors, vendors, and suppliers doing business with any state agency, department, or institution, provide a statement of non-discrimination. By signing and submitting its proposal, the Offeror certifies it does not discriminate in its employment practices with regard to race, color, creed, religion, age, sex, ancestry, national origin, or disability.

1.8 MODIFICATION OR WITHDRAWAL OF PROPOSALS

Proposals may be modified or withdrawn by the Offeror prior to the established due date and time.

No oral, telephonic, telegraphic or facsimile responses or modifications to informal, formal bids, or Request for Proposals will be considered.

mailto:harold.bruce@state.sd.us

UPDATED JANUARY 2025 V2.0 12

1.9 OFFEROR INQUIRIES

All written questions should be sent to: harold.bruce@state.sd.us. Only emailed questions will be accepted.

The Offeror may submit email questions concerning this RFP to obtain clarification of requirements. No questions will be accepted after the date and time indicated in the above

Schedule of Activities. Email questions to the email address listed above with the subject line “RFP #25RFP12070”. The questions and their answers will be provided via the State of

South Dakota’s Bureau of Administration Central Bid Exchange website before the proposal submittal date and will be sent by the date and time indicated in the above

Schedule of Activities. Offeror may not rely on any other statements, either of a written or oral nature, that alter any specification or other term or condition of this RFP that have not originated from the SD RFP Project Contact. Offerors will be notified in the same manner as indicated above regarding any modifications to this RFP.

1.10 PROPRIETARY INFORMATION

The proposal of the successful Offeror(s) becomes public information. Proprietary information can be protected under limited circumstances such as client lists and non-public financial statements. Service elements are not considered proprietary. An entire proposal may not be marked as proprietary. Offerors must clearly identify in the Executive

Summary and mark in the body of the proposal any specific proprietary information they are requesting to be protected. The Executive Summary must contain specific justification explaining why the information is to be protected. Proposals may be reviewed and evaluated by any person at the discretion of the State. All materials submitted become the property of the State of South Dakota and may be returned only at the State's option.

1.11 LENGTH OF CONTRACT

The contract will begin upon date of last signature.

The contract will end on June 30, 2027.

The State reserves the right to renew the MSA under the same terms and conditions for a period of two years. There is the possibility of up to four such renewals, for a maximum of eight additional years. Any renewal of the MSA is not guaranteed.

1.12 DISCUSSIONS

At the State’s discretion, the Offeror may or may not be invited to have discussions with the

State. The discussions can be before or after the RFP has been submitted. Discussions will be made at the Offeror’s expense.

1.13 NEGOTIATIONS

This process is a Request for Proposal/Competitive Negotiation process. Each proposal will be evaluated, and each Offeror will be available for negotiation meetings at the State’s request. The State reserves the right to negotiate on any component of every proposal https://www.mercurycommerce.com/secure/SourcingEventPostingBoard/default.asp?sID=%7B1CFAA89E7-35C9-49B9-B091-AF5C3C0EEED1%7D&PagingID=&RefreshOption=3

UPDATED JANUARY 2025 V2.0 13

submitted. From the time the proposals are submitted until the formal award of a contract, each proposal is considered a working document and as such, will be kept confidential. The negotiation discussions will also be held as confidential until such time as the award is completed.

1.14 RESTRICTION ON BOYCOTT OF ISRAEL

For contractors, vendors, suppliers, or subcontractors with five or more employees who enter into a contract with the State of South Dakota that involves the expenditure of

$100,000 or more, by submitting a response to this solicitation or agreeing to contract with the State, the Offeror certifies and agrees that the following information is correct:

The Offeror, in preparing its response or offer or in considering proposals submitted from qualified, potential vendors, suppliers, and subcontractors, or in the solicitation, selection, or commercial treatment of any vendor, supplier, or subcontractor, has not refused to transact business activities, has not terminated business activities, and has not taken other similar actions intended to limit its commercial relations, related to the subject matter of the bid or offer, with a person or entity on the basis of Israeli national origin, or residence or incorporation in Israel or its territories, with the specific intent to accomplish a boycott or divestment of Israel in a discriminatory manner. It is understood and agreed that, if this certification is false, such false certification will constitute grounds for the State to reject the bid or response submitted by the bidder or offeror on this project and terminate any contract awarded based on the bid or response. The successful bidder or offeror further agrees to provide immediate written notice to the contracting executive branch agency if during the term of the contract it no longer complies with this certification and agrees such noncompliance may be grounds for contract termination.

1.15 CERTIFICATION RELATING TO PROHIBITED ENTITY

For contractors, vendors, suppliers, or subcontractors who enter into a contract with the

State of South Dakota by submitting a response to this solicitation or agreeing to contract with the State, the Offeror certifies and agrees that the following information is correct:

The Offeror, in preparing its response or offer or in considering proposals submitted from qualified, potential vendors, suppliers, and subcontractors, or in the solicitation, selection, or commercial treatment of any vendor, supplier, or subcontractor, is not a prohibited entity, regardless of its principal place of business, that is ultimately owned or controlled, directly or indirectly, by a foreign national, a foreign parent entity, or foreign government from China, Iran, North Korea, Russia, Cuba, or Venezuela, as defined by South Dakota

Codified Law § 5-18A. It is understood and agreed that, if this certification is false, such false certification will constitute grounds for the State to reject the bid or response submitted by the bidder or offeror on this project and terminate any contract awarded based on the bid or response. The successful Offeror further agrees to provide immediate written notice to the contracting executive branch agency if during the term of the contract it no longer complies with this certification and agrees such noncompliance may be grounds for contract termination and would be cause to suspend and debar a business under SDCL § 5-

18D-12.

UPDATED JANUARY 2025 V2.0 14

1.16 CERTIFICATION OF NO STATE LEGISLATOR INTEREST

The Offeror (i) understands neither a state legislator nor a business in which a state legislator has an ownership interest may be directly or indirectly interested in any contract with the State that was authorized by any law passed during the term for which that legislator was elected, or within one year thereafter, and (ii) has read South Dakota

Constitution Article 3, Section 12 and has had the opportunity to seek independent legal advice on the applicability of that provision to any agreement entered into as a result of this

RFP. By signing an agreement pursuant to this RFP, the Offeror certifies that the

Agreement is not made in violation of the South Dakota Constitution Article 3, Section 12.

2 STANDARD CONTRACT TERMS AND CONDITIONS

Any contract or agreement resulting from this RFP will include the State’s standard IT contract terms listed below, and any additional terms and conditions as negotiated by the parties. The

Offeror must indicate in its response any issues it has with specific contract terms. If the

Offeror does not indicate that there is an issue with a specific contract term, then the Offeror will be deemed to have accepted the contract term as written.

The State enters into this Master Service Agreement (MSA) for services with the Contractor in consideration of and pursuant to the terms and conditions set forth in this MSA.

Section I. Scope of Work

A. During the term of the MSA, the Contractor agrees to provide services to the State of

South Dakota and its agencies to maintain and enhance the State’s existing technical staff and expertise. On an as needed basis, the Contractor may enter into a Statement of

Work (SOW) with a state agency to augment the State’s existing technical staff to meet the agency’s maintenance and development needs. A project’s SOW will include the scope of work for that unique project and it will include additional terms and conditions based upon the unique nature of the project.

B. Additional exhibits within this MSA attached to this MSA and incorporated by reference include:

1. Appendix A: Information Technology Security Policies – BIT version

2. Appendix B: Security Acknowledgment Form

Section II. Term of Agreement

The “Term of the Agreement” will commence on the date the last signature is applied to this

MSA and terminate on unless sooner terminated pursuant to Error! Reference source not found..

UPDATED JANUARY 2025 V2.0 15

Section III. Fees and payment

The Contractor and the agency in need of services will negotiate fees and payment terms and conditions and incorporate them into each unique SOW. The State or its agencies will not pay the Contractor’s expenses as a separate item. Payments will be made pursuant to itemized invoices submitted with a signed state voucher. Payments will be made consistent with SDCL

ch. 5-26. The TOTAL AGREEMENT AMOUNT of all SOWs entered into as a result of this

MSA cannot exceed $25 million.

Section IV. Property

When providing services pursuant to a SOW entered into as a result of this MSA, the

Contractor may use some State equipment, supplies, and facilities. The State, at its sole discretion as to time, amount of services, and whether to provide services, may provide to the

Contractor limited office space, meeting space, secretarial support, or phone, fax, or copying service during the term of the SOW. The terms and conditions of use of State property or services will be enumerated within a SOW.

Section V. Employer Identification Number

The Contractor will provide the State with its Employer Identification Number, Federal Tax

Identification Number or Social Security Number upon execution of this MSA.

Section VI. Indemnification

The Contractor agrees to indemnify the State of South Dakota, its officers, agents, and employees from and against all claims or proceedings for actions, suits, damages, liabilities, or other losses or equitable relief that may arise at least in part as a result of an act or omission in performing services under this MSA and any SOW . The Contractor will defend the State of

South Dakota, its officers, agents, and employees against any claim, including any claim, action, suit, or other proceeding related to the claim. The Contractor’s obligation to indemnify includes the payment of attorney fees and other costs of defense. In defending the State of

South Dakota, its officers, agents, and employees, the Contractor will engage other professionals, subject to the written approval of the State which will not be unreasonably withheld. Notwithstanding the foregoing, the State may, in its sole discretion and at the expense of the Contractor, engage attorneys and other professionals to defend the State of

South Dakota, its officers, agents, and employees, or to assist the Contractor in the defense.

This section does not require the Contractor to be responsible for or defend against claims or proceedings for damages, liabilities, losses, or equitable relief arising solely from errors or omissions of the State, its officers, agents, or employees.

Section VII. Professional Services Quality and Originality Warranties

The Contractor represents and warrants that all professional services provided pursuant to a SOW will be performed in a professional and workmanlike manner. The Contractor further represents and warrants that the deliverables of any SOW will be its own original work, without

UPDATED JANUARY 2025 V2.0 16

incorporation of software, text, images, or other assets created by third parties, except to the extent that the State consents to such incorporation in writing.

Section VIII. Remedies for Breach of Professional Services Warranties

In the event of a breach of the warranty granted in Error! Reference source not found. of this

MSA, the Contractor, at its own expense, will promptly re-perform the professional services in question. The preceding sentence, in conjunction with the State’s right to terminate this MSA and a SOW for breach where applicable, states the State’s sole remedy and the Contractor’s entire liability for breach of the warrant granted in Error! Reference source not found..

Section IX. Independent Contractor

While performing services as a result of entering into this MSA or any SOW, the Contractor is an independent contractor and not an officer, agent, or employee of the State of South Dakota.

Section X. Insurance

During the term of this MSA, the Contractor will obtain and maintain in force insurance coverage of the types and with the limits as follows:

A. Commercial General Liability Insurance

The Contractor will maintain occurrence based commercial general liability insurance or equivalent form with a limit of not less than $1 million for each occurrence. If such insurance contains a general aggregate limit it will apply separately to this MSA or be no less than two times the occurrence limit. The insurance policy will name the State of South Dakota, its officers and employees, as additional insureds, but liability coverage is limited to claims not barred by sovereign immunity.

The State of South Dakota, its officers and employees do not hereby waive sovereign immunity for discretionary conduct as provided by law.

B. Professional Liability Insurance or Miscellaneous Professional Liability Insurance

The Contractor will procure and maintain professional liability insurance or miscellaneous professional liability insurance with a limit not less than $1 million.

C. Business Automobile Liability Insurance

The Contractor will maintain business automobile liability insurance or equivalent form with a limit of not less than $1 million for each accident. Such insurance will include coverage for owned, hired, and non-owned vehicles.

D. Worker’s Compensation Insurance

The Contractor will procure and maintain workers’ compensation and employers’ liability insurance as required by South Dakota or federal law.

E. Cyber Liability Insurance

The Contractor will maintain cyber liability insurance with liability limits in the amount of $3 million to protect any and all State Data the Contractor receives as part of this

UPDATED JANUARY 2025 V2.0 17

MSA and any SOW entered into as a result of this MSA. This includes State Data that may reside on devices, including laptops and smart phones, utilized by the Contractor’s employees, whether the device is owned by the employee or the Contractor. If the

Contractor has a contract with a third-party to host any State Data received as a result of entering into this MSA, then the Contractor must include a requirement for cyber liability insurance as part of the contract between the Contractor and the third-party hosting the data in question. The third-party cyber liability insurance coverage must include State Data that resides on devices, including laptops and smart phones, utilized by third-party employees, whether the device is owned by the employee or the third-party. The cyber liability insurance will cover expenses related to the management of a data breach incident, the investigation, recovery and restoration of lost data, data subject notification, call management, credit checking for data subjects, legal costs, and regulatory fines. The cyber liability insurance will stay in effect for three years after the termination of this MSA.

Before beginning work under this MSA or any SOW, the Contractor must furnish the State with properly executed Certificates of Insurance which clearly evidence all insurance required in this MSA or any SOW. In the event a substantial change in insurance, issuance of a new policy, cancellation, or nonrenewal of the policy, the Contractor agrees to provide immediate notice to the State and provide a new certificate of insurance showing continuous coverage in the amounts required. The Contractor will furnish copies of insurance policies if requested by the State.

Section XI. Reporting

The Contractor agrees to report to the State any event encountered in the course of the performance of this MSA or a SOW which results in injury to the person or property of third parties, or which may otherwise subject the Contractor or the State to liability. The Contractor will report any such event to the State immediately upon discovery.

The Contractor's obligation under this section will only be to report the occurrence of any event to the State and to make any other report provided for by its duties or applicable law. The

Contractor's obligation to report will not require disclosure of any information subject to privilege or confidentiality under law (e.g., attorney-client communications). Reporting to the

State under this section will not excuse or satisfy any obligation of the Contractor to report any event to law enforcement or other entities under the requirements of any applicable law.

Section XII. Termination

A. This MSA or any SOW entered into as a result of this MSA may be terminated by either party upon 30 days’ written notice.

B. If the Contractor breaches any term of this MSA or any SOW entered into as a result of this MSA, the State may terminate this MSA or applicable SOW at any time with or without notice. If the State terminates this MSA or a SOW due to a breach by the

Contractor, any payments due to the Contractor at the time of termination may be adjusted to cover any additional costs to the State because of the Contractor's breach. If the State exercises its right of termination pursuant to this subsection and it is later

UPDATED JANUARY 2025 V2.0 18

determined that the Contractor was not at fault, then the State will pay the Contractor for eligible services rendered and expenses incurred up to the date of termination.

C. Upon termination of this MSA or any SOW entered into as a result of this MSA, the

Contractor acknowledges the State’s right to take over the work or may award the work to another party.

Section XIII. Confidentiality of Information

A. Definition: “Confidential Information” includes all information disclosed by the State to the Contractor, including but not limited to: names, social security numbers, employee numbers, addresses, other data about applicants, employees, and clients to whom the State provides services of any kind, and any other nonpublic, sensitive information disclosed by the State. Notwithstanding the foregoing, Confidential

Information does not include information that:

1. was in the public domain at the time it was disclosed;

2. was known to the Contractor without restriction at the time of disclosure by the

State;

3. The Contractor received written approval by the State to disclose;

4. was independently developed by the Contractor without the benefit or influence of the State’s information; or

5. becomes known to the Contractor without restrictions from a source not connected to the State.

B. Nondisclosure: The Contractor will not use Confidential Information for any purpose other than to facilitate the transactions contemplated by this MSA or an applicable

SOW (“Purpose”). The Contractor will not disclose Confidential Information to:

1. any employee or contractor of the Contractor unless such person needs access in order to facilitate the Purpose and executes a nondisclosure agreement with the employee or contractor with terms no less restrictive than those of this MSA or an applicable SOW; and

2. any other third party without the State’s prior written consent.

Without limiting the generality of the foregoing, the Contractor must protect

Confidential Information with the same degree of care it uses to protect its own confidential information of similar nature and importance, but with no less than reasonable care. The Contractor must promptly notify the State of any misuse or misappropriation of Confidential Information that comes to the Contractor’s attention.

Notwithstanding the foregoing, the Contractor may disclose Confidential Information as required by applicable law or by proper legal or governmental authority. The

Contractor must give the State prompt notice of any such legal or governmental demand and reasonably cooperate with the State in any effort to seek a protective order or otherwise to contest such required disclosure, at the State’s expense.

C. Injunction, Termination, and Retention of Rights:

1. Injunction. The Contractor agrees that breach of this Section XIII would cause the State irreparable injury, for which monetary damages would not provide adequate compensation, and that in addition to any other remedy, the State will be entitled to injunctive relief against such breach or threatened breach, without proving actual damage or posting a bond or other security.

2. Return upon Termination. Upon termination of this MSA or an applicable

UPDATED JANUARY 2025 V2.0 19

SOW, the Contractor will return all copies of Confidential Information to the

State or certify, in writing, the destruction thereof.

3. Retention of Rights. This MSA or an applicable SOW does not transfer ownership of Confidential Information or grant a license thereto. Except to the extent that another section of this MSA or an applicable SOW specifically provides to the contract, the State will retain all right, title, and interest in and to all Confidential Information.

Section XIV. State Data

A. Data Location: The Contractor agrees to provide its services to the State and access and storage of State data solely from data centers in the continental United States. The

Contractor will not provide or allow access to State data to any person or entity outside the continental United States without prior written permission from the State. This restriction also applies to disaster recovery; any disaster recovery plan must provide for data storage entirely within the continental United States.

B. The Contractor will not allow its employees or subcontractors to store State data on portable devices, including personal computers, except for devices that are password protected, encrypted, and used and kept only at the Contractor’s data centers. The

Vendor may allow its employees or subcontractors to access State data remotely only as required to provide technical support or to fulfill the terms of this MSA or an applicable SOW. If the State data in question includes data that is legally protected or considered sensitive by the State, then remote access is only allowed if:

1. the device used to remotely access the data must be password protected;

2. multifactor authentication must be used;

3. the data is encrypted to at least AES 256 both in transit and in storage;

4. the data is not transferred to mobile media;

5. no non-electronic copies are made of the data;

6. the Contractor maintains a log on what data was accessed, when it was accessed, and by whom it was accessed; and

7. the State’s Data Sanitization policies are followed when the data is no longer needed on the device used to access the data remotely.

C. Data Protection: Protection of personal privacy and data will be an integral part of the business activities of the Contractor to ensure there is no inappropriate or unauthorized use of State data at any time. To this end, the Contractor must safeguard the confidentiality, integrity, and availability of State data and comply with the following conditions:

1. The Contractor must implement and maintain appropriate administrative, technical, and organizational security measures to safeguard against unauthorized access, disclosure, or theft of Personally Identifiable Information

(PII), data protected under the Family Educational Rights and Privacy Act

(FERPA), Protected Health Information (PHI), Federal Tax Information (FTI), or any information that is confidential under federal or state law. Such security measures will be in accordance with recognized industry practices and not less protective than the measures the Contractor applies to its own non-public data.

2. At no time will any State data be copied, disclosed, or retained by the

Contractor or any party related to the Contractor for subsequent use in any

UPDATED JANUARY 2025 V2.0 20

transaction that does not include the State.

3. The Contractor will not use State data for the Contractor’s own benefit and will not engage in data mining of State data or communications, whether through automated or manual means, except as specifically and expressly required by law or authorized in writing by the State through a State employee or officer specifically authorized to grant such use of State data.

D. Non-Disclosure and Separation of Duties: The Contractor will enforce separation of job duties and require non-disclosure agreements of all employees that have or can have access to State data or the hardware that State data resides on. The Contractor will limit staff knowledge to those staff whose duties require them to have access to

State data or the hardware State data resides on.

E. Securing of Data: All facilities used to store, and process State data will employ industry best practices, including appropriate administrative, physical, and technical safeguards, to secure such data from unauthorized access, disclosure, alteration, and use. Such measures will be no less protective than those used to secure the Contractor’s own data of a similar type, and in no event less than commercially reasonable in view of the type and nature of the data involved. Without limiting the foregoing, the

Contractor warrants that all State data will be encrypted in transmission (including via web interface) and in storage at no less than AES256 level encryption with SHA256 or

SHA2 hashing.

F. Lost or Damaged Data Liability: If State data is lost or damaged as a result of any failure by the Contractor, its employees, or its agents to exercise reasonable care to prevent such loss or damage, then the Contractor’s liability will not exceed the reasonable cost of reproducing the lost or damaged data. The Parties agree this limitation of liability will trump any limitation of liability found in a SOW as it relates to lost or damaged State data.

G. Rights and License in and to State Data: The Parties agree all rights, including all intellectual property rights, in and to State data will remain the exclusive property of the State, and the Contractor has a limited, nonexclusive license to use the data as provided in this MSA or a SOW solely for the purpose of performing its obligations hereunder. This MSA or a SOW does not give a Party any rights, implied or otherwise, to the other’s data, content or intellectual property, except as expressly stated in this

MSA or the SOW.

H. Continued Access to State Data: The Contractor agrees it will not hinder the State’s access to the State data if there is a contract dispute between the Parties, if there is a billing dispute between the Parties, or if the Contractor merges with or is acquired by another entity. In addition, the Contractor must maintain all security requirements and disaster recovery commitments of this MSA and any active SOW during such incidents.

I. Legal Requests for State Data: Except as otherwise expressly prohibited by law, the

Contractor will:

1. immediately notify the State of any subpoenas, warrants, or other legal order, demand, or request received by the Contractor seeking State data;

2. consult with the State regarding the Contractor’s response to the order, demand, or request;

3. cooperate with the State in efforts by the State to intervene and quash or modify the order, demand, or request; and

UPDATED JANUARY 2025 V2.0 21

4. provide the State with a copy of the order, demand, or request and the

Contractor’s proposed or actual response to the order, demand, or request.

J. eDiscovery: The Contractor will notify the State upon receipt of any electronic discovery, litigation holds, discovery searches, and expert testimonies related to, or which in any way might reasonably require access to State data. The Contractor agrees to not respond to service of process and other legal requests related to the State without first notifying the State unless prohibited by law from providing such notice.

K. Data Sanitization: At the end of a project covered by a SOW, the Contractor is responsible for returning all State data to the State or securely disposing of all State data in all forms, which can include State data on media such as paper, punched cards, magnetic tape, magnetic disks, solid state devices, or optical discs. State data must be permanently deleted by either purging the data or destroying the medium on which the

State data is found according to the methods given in the most current version of

National Institute of Standards and Technology (NIST) Special Publication 800-88.

The Contractor must complete and provide to the State point of contact a completed

Certificate of Sanitization for Offsite Data, attached to this MSA as Appendix A. The

State will review the completed Certificate. If the State is not satisfied by the data sanitization, then the Vendor will use a method that does satisfy the State. Contractor

Section XV. Security Processes

The Contractor will disclose its non-proprietary security processes and technical limitations to the State so adequate protection and flexibility can be attained between the State and the

Contractor, e.g. virus checking and port sniffing.

Section XVI. Password Policies

Password policies for the Contractor’s employees will be documented annually and provided to the State to ensure adequate password protections are in place. Logs and administrative settings will be provided to the State upon request to demonstrate such policies are actively enforced.

The process used to reset a password must include security questions or Multi-factor

Authentication.

Section XVII. Adverse Event

For purpose of this MSA and any SOW, “Adverse Event” is the unauthorized use of system privileges, unauthorized access to State data, execution of malware, or physical or electronic intrusion that may include network, applications, servers, workstations, and social engineering of staff. The Contractor must notify the State point of contact within two business days if the

Contractor becomes aware that an Adverse Event has occurred. If the Adverse Event was the result of the Contractor’s actions or inactions, the State can require a risk assessment of the

Contractor and can mandate the scope and methodology used for the risk assessment. The State can require the risk assessment to be performed by a third party at the Contractor’s expense.

UPDATED JANUARY 2025 V2.0 22

Section XVIII. Threat Notification

For purposes of this MSA and any SOW, “Credible Security Threat” means the discovery of an exploit that a person who is considered an expert on information technology security believes could be used to breach at least one aspect of a system that is holding State data. The

Contractor will notify the State within two business days upon becoming aware of a Credible

Security Threat with the Contractor’s or a subcontractor’s product or service being used by the

State to fulfill the Contractor’s obligation under this MSA or any SOW. Upon request, the

Contractor will provide the State with information regarding the nature of the Credible

Security Threat.

Section XIV. Access Attempts

All access attempts, whether failed or successful, to any system connected to a system which can access, read, alter, intercept, or otherwise impact the hosted system or its data or data integrity will be logged by the Contractor. For all systems, the log must include at least: log-in page used, username used, time and date stamp, incoming IP for each authentication attempt, and the authentication status, whether successful or not. Logs must be maintained not less than seven years in a searchable database in an electronic format that is un-modifiable. At the request of the State, access must be granted to search those logs as needed to demonstrate compliance with the terms of this MSA or any SOW and any audit requirements related to the hosted system.

Section XX. Access to Protected Data

For the purposes of this MSA and any SOW, “Protected Data” means data protected by any law, regulation, industry standard, or has been designated as sensitive by the federal or a state government. The Parties agree that if a SOW provides the Contractor access to the State’s

Protected Data, then the following contract clauses apply to that SOW:

A. Security Incident Notification: For purposes of this MSA and any SOW, “Security

Incident” is a violation of any Bureau of Information and Telecommunications (BIT) security or privacy policy or contract agreement involving Protected Data or the imminent threat of a violation. The BIT security and privacy policies can be found in the Information Technology Security Policy (ITSP), attached to this MSA and fully incorporated in this MSA as Appendix B. The Contractor will implement, maintain, and update Security Incident procedures that comply with all state standards and federal and state requirements. The Contractor agrees to notify the State of a Security Incident.

To the extent probes and reconnaissance scans common to the industry constitute

Security Incidents, the Parties agree that this MSA constitutes notice by the Contractor of the ongoing existence and occurrence of such Security Incidents for which no additional notice to the State is required. Probes and reconnaissance scans include, but are not limited to, pings and other broadcast attacks on the Contractor’s firewall, port scans, and unsuccessful log-on attempts if such probes and reconnaissance scans do not result in a Security Incident as defined above. Except as required by a legal requirement, the Contractor will provide notice of the Security Incident to only the

State. The State will determine if notification to the public will be made by the State or

UPDATED JANUARY 2025 V2.0 23

by the Contractor. The method and content of the notification of the affected parties will be coordinated with, and is subject to approval by the State, unless required otherwise by legal requirements. If the State decides that the Contractor will be distributing, broadcasting to, or otherwise releasing information on the Security

Incident to the news media, the State will decide to whom the information will be sent and must approve the content of the information. The Contractor must reimburse the

State for any costs associated with the notification, distributing, broadcasting, or otherwise releasing information on the Security Incident.

1. The Contractor must notify the State point of contact within 12 hours of the

Contractor becoming aware that a Security Incident has occurred. If notification to the State is delayed because it may impede a criminal investigation or jeopardize homeland or federal security, notification must be given to the State within 12 hours after law enforcement grants permission for the release of information on the Security Incident.

2. At a minimum, notification of a Security Incident state the nature of the

Protected Data exposed, the time the Incident occurred, and a general description of the circumstances of the Incident. If any of the preceding information is not available within the notification time period, the Contractor must provide the State with all available information along with the reason for the incomplete notification. The Contractor must provide the missing information to the State immediately upon the information becoming available.

3. At the State’s discretion, within five business days of a Security Incident, the

Contractor must provide to the State all data available including: (i) contact information for the Contractor’s point of contact for the Incident: (ii) date and time of the Incident; (iii) date and time the Incident was discovered: (iv) description of the Incident including the Protected Data involved, being as specific as possible; (v) the potential number of records or, if unknown, the range of records; (vi) address where the Incident occurred: and, (vii) the nature of the technologies involved. If any of the preceding information is not available within the specified time period, the Contractor must provide the State with all available information along with the reason for the incomplete information. The Contractor must provide the missing information to the State immediately upon the information becoming available.

4. The Contractor is responsible for complying with South Dakota Codified Law

Chapter 22-40 when applicable to a Security Incident. This legal requirement does not replace the Contractor’s obligations found in the preceding three subsections.

B. Handling of Security Incident: At the State’s discretion, the Contractor may be required to preserve all evidence regarding a Security Incident including, but not limited to, communications, documents, and logs. In addition, the Contractor will:

1. fully investigate each Security Incident;

2. cooperate fully with the State’s investigation and analysis of and response to the

Security Incident;

3. make a best effort to implement necessary remedial measure as soon as it is possible; and

4. document responsive actions taken related to the Incident, including any post-

Incident review of events and actions taken to implement changes in business

UPDATED JANUARY 2025 V2.0 24

practices in providing the services covered by the applicable SOW.

If the State determines the Security Incident was due to the actions or inactions of the

Contractor, the Contractor must pay for and use a…