RFP Document.pdf

STATE OF SOUTH DAKOTA

Dakota State University 917 N Washington Ave

Madison SD 57042

SecureSD Secure Email Solution PROPOSALS ARE DUE NO LATER THAN July 11, 2025

RFP #: DSU-25003-SecureSD State POC: Mike Waldner EMAIL: mike.waldner@dsu.edu

READ CAREFULLY

FIRM NAME: AUTHORIZED SIGNATURE:

ADDRESS: TYPE OR PRINT NAME:

CITY/STATE: TELEPHONE NO:

ZIP (9 DIGIT): FAX NO:

E-MAIL:

PRIMARY CONTACT INFORMATION

CONTACT NAME: TELEPHONE NO:

FAX NO: E-MAIL:

1.0 GENERAL INFORMATION

1.1 PURPOSE OF REQUEST FOR PROPOSAL (RFP)

The purpose of this RFP is to enhance the cybersecurity of communication and collaboration of our cities, counties, and municipalities in South Dakota by establishing a unified, scalable solution for a secured email solution.

This RFP supports a strategic cybersecurity initiative (SecureSD https://madlabs.dsu.edu/securesd/). This specific RFP is aimed at protecting South Dakota cities, counties, and municipalities from email-borne attacks while ensuring operational integrity, data confidentiality, and compliance with best practices.

Cities and counties across South Dakota rely on email infrastructure for essential government communications, public service coordination, and interagency collaboration. The rise in targeted phishing campaigns, email spoofing, malware delivery, and spam necessitates a unified, secure, and scalable solution that can be implemented for entities of varying size and technical capacity.

Currently, South Dakota cities and counties are using multiple public platforms (Gmail, Hotmail, Yahoo, personal email, etc.), making it difficult to identify the entity, secure, and protect them from cybersecurity attacks. We have a need for global address listings, calendaring, collaboration, etc. This solution will have employees on the same system so internal emails remain encrypted within the same email system and never go to the public internet or another email system.

The state is seeking proposals from qualified vendors to provide a Secure Email Solution to participating South Dakota cities, counties and municipal governments. The anticipated clients for these services include city & county law enforcement, auditors, treasurers, finance officers, municipal utility, street & highway, elected officials, other employees or accounts deemed necessary, etc.

Through this RFP, the state will establish a pool of qualified state-approved contractors that, in collaboration with the SecureSD team, participating cities, counties, and municipalities can choose from for their Secured Email Solution.

The proposed contract will be in force until 4/30/28. After which, if no additional state funding is available, the participating entities will be responsible for the costs beyond the contract period and the successful offeror will be responsible for working out the continuity of the services.

1.2 ISSUING OFFICE AND RFP REFERENCE NUMBER

The DSU Research & Economic Development Office, SecureSD is the issuing office for this document and all subsequent addenda relating to it, on behalf of the State of South Dakota. The reference number for the transaction is RFP # DSU-25003-SecureSD. This number must be referred to on all proposals, correspondence, and documentation relating to the RFP.

1.3 DEFINITIONS USED IN THIS RFP

The following definitions are used in this RFP:

Offeror – a company who has submitted a proposal in response to this RFP.

Contractor – An Offeror that has been awarded a contract as a result of this RFP.

State - State of South Dakota, DSU Research & Economic Development Office, SecureSD.

Entity – Any city, county, municipality, or local government.

https://madlabs.dsu.edu/securesd/

1.4 OFFEROR'S CONTACTS

Offerors and their agents (including subcontractors, employees, consultants, or anyone else acting on their behalf) must direct all of their questions or comments regarding the RFP, the evaluation, etc. to Mike Waldner as indicated above. Offerors and their agents may not contact any other state employee regarding any of these matters during the solicitation and evaluation process. Inappropriate contacts are grounds for suspension and/or exclusion from specific procurements. Offerors and their agents who have questions regarding this matter should contact Mike Waldner as indicated above.

1.5 SCHEDULE OF ACTIVITIES (SUBJECT TO CHANGE)

RFP Publication RFP Explanation Meeting Responses to Offeror’s Questions

06/13/2025 06/26/25 07/01/25

Proposal Submission 07/11/2025

Presentations/discussions (if required) At the state’s discretion

Anticipated Award Decision/Contract Negotiation 08/1/2025

1.6 PREPARING AND SUBMITTING YOUR PROPOSAL

Elaborate proposals (e.g., expensive artwork) beyond that sufficient to present a complete and effective presentation are not necessary or desired.

1.6.1 Incurring Costs

The State is not liable for any cost incurred by Offerors in replying to this RFP.

1.6.2 Submitting the proposal

All proposals must be completed and received in the DSU Research & Economic Development Office, SecureSD by the date and time indicated in the Schedule of Activities.

Proposals received after the deadline will be late and ineligible for consideration.

All proposals must be signed, in ink, preferably blue, by an officer of the responder, legally authorized to bind the responder to the proposal, and sealed in the form intended by the respondent. Proposals that are not properly signed may be rejected. The sealed envelope should be marked with the appropriate RFP Number and Title.

Proposals should be addressed and labeled as follows:

REQUEST FOR PROPOSAL # DSU-25003-SecureSD

PROPOSAL DUE 07/11/25

Mike Waldner, Director of SecureSD Dakota State University 917 N Washington Ave Madison, SD 57042

Offerors may not send the electronically formatted copy of their proposal via email. Offerors will mail one printed copy of their proposal with wet signatures, along with one electronic copy, including all attachments, in both Microsoft Word and PDF (this document should be formatted in a searchable Text-Based PDF file format) electronic formats.

All proposals and attachments must be either in Microsoft Word, MS Excel or PDF searchable format. A proposal cannot be a PDF derived from a scanned image which prevents search functionality. For more information regarding response format see below sections of this RFP.

The offeror may present the cost proposal or cost proposals in the electronic format of their choice, Word, PDF, or Excel are preferred. The cost proposal must be submitted in a separate sealed envelope and labeled “Cost Proposal.”

No proposal shall be accepted from, or no contract or purchase order shall be awarded to any person, firm or corporation that is in arrears upon any obligations to the State of South Dakota, or that otherwise may be deemed irresponsible or unreliable by the State of South Dakota.

1.7 CERTIFICATION REGARDING DEBARMENT, SUSPENSION, INELIGIBILITY AND VOLUNTARY

EXCLUSION – LOWER TIER COVERED TRANSACTIONS

By signing and submitting this proposal, the offeror certifies that neither it nor its principals is presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participation, by any Federal department or agency, from transactions involving the use of Federal funds. Where the offeror is unable to certify to any of the statements in this certification, the bidder shall attach an explanation to their offer.

1.8 NON-DISCRIMINATION STATEMENT

The State of South Dakota requires that all contractors, vendors, and suppliers doing business with any State agency, department, or institution, provide a statement of non-discrimination. By signing and submitting their proposal, the offeror certifies they do not discriminate in their employment practices with regard to race, color, creed, religion, age, sex, ancestry, national origin or disability.

1.9 CERTIFICATION RELATING TO PROHIBITED ENTITY

For contractors, vendors, suppliers, or subcontractors who enter into a contract with the State of South Dakota by submitting a response to this solicitation or agreeing to contract with the State, the bidder or offeror certifies and agrees that the following information is correct:

The bidder or offeror, in preparing its response or offer or in considering proposals submitted from qualified, potential vendors, suppliers, and subcontractors, or in the solicitation, selection, or commercial treatment of any vendor, supplier, or subcontractor, is not an entity, regardless of its principal place of business, that is ultimately owned or controlled, directly or indirectly, by a foreign national, a foreign parent entity, or foreign government from China, Iran, North Korea, Russia, Cuba, or Venezuela, as defined by SDCL 5-18A. It is understood and agreed that, if this certification is false, such false certification will constitute grounds for the State to reject the bid or response submitted by the bidder or offeror on this project and terminate any contract awarded based on the bid or response. The successful bidder or offeror further agrees to provide immediate written notice to the contracting executive branch agency if during the term of the contract it no longer complies with this certification and agrees such noncompliance may be grounds for contract termination.

1.10 RESTRICTION OF BOYCOTT OF ISRAEL

For contractors, vendors, suppliers, or subcontractors with five (5) or more employees who enter into a contract with the State of South Dakota that involves the expenditure of one hundred thousand dollars ($100,000) or more, by submitting a response to this solicitation or agreeing to contract with the State, the bidder or offeror certifies and agrees that the following information is correct:

The bidder or offeror, in preparing its response or offer or in considering proposals submitted from qualified, potential vendors, suppliers, and subcontractors, or in the solicitation, selection, or commercial treatment of any vendor, supplier, or subcontractor, has not refused to transact business activities, has not terminated business activities, and has not taken other similar actions intended to limit its commercial relations, related to the subject matter of the bid or offer, with a person or entity on the basis of Israeli national origin, or residence or incorporation in Israel or its territories, with the specific intent to accomplish a boycott or divestment of Israel in a discriminatory manner. It is understood and agreed that, if this certification is false, such false certification will constitute grounds for the State to reject the bid or response submitted by the bidder or offeror on this project and terminate any contract awarded based on the bid or response. The successful bidder or offeror further agrees to provide immediate written notice to the contracting executive branch agency if during the term of the contract it no longer complies with this certification and agrees such noncompliance may be grounds for contract termination.

1.11 CERTIFICATION OF NO STATE LEGISLATOR INTEREST

Offeror (i) understands neither a state legislator nor a business in which a state legislator has an ownership interest may be directly or indirectly interested in any contract with the State that was authorized by any law passed during the term for which that legislator was elected, or within one year thereafter, and (ii) has read South Dakota Constitution Article 3, Section 12 and has had the opportunity to seek independent legal advice on the applicability of that provision to any Agreement entered into as a result of this RFP. By signing an Agreement pursuant to this RFP, Offeror hereby certifies that the Agreement is not made in violation of the South Dakota Constitution Article 3, Section 12.

1.12 MODIFICATION OR WITHDRAWAL OF PROPOSALS

Proposals may be modified or withdrawn by the offeror prior to the established due date and time.

No oral, telephonic, telegraphic or facsimile responses or modifications to informal, formal bids, or Request for Proposals will be considered.

1.13 OFFEROR INQUIRIES

Offerors may email inquiries concerning this RFP to obtain clarification of requirements. No inquiries will be accepted after the date and time indicated in the Schedule of Activities. Inquiries must be emailed to Mike Waldner at mike.waldner@dsu.edu with the subject line “RFP # DSU-25003-SecureSD”.

Dakota State University will respond to offeror’s inquiries (if required) via e-mail. All Offerors will be informed of any inquiries and the State’s response. In addition, all inquiries and the State’s response will be posted on the state’s e-procurement system. Offerors may not rely on any other statements, either of a written or oral nature, that alter any specification or other term or condition of this RFP. Offerors will be notified in the same manner as indicated above regarding any modifications to this RFP.

Offerors are expected to raise any questions, exceptions, or additions they have concerning the RFP document by the deadline for submission for written inquiries as indicated in the Schedule of Activities. If an Offeror discovers any significant ambiguity, error, conflict, discrepancy, omission or other deficiency in this RFP, the Offeror should immediately notify Mike Waldner at mike.waldner@dsu.edu with the subject line “RFP # DSU-25003-SecureSD, of such error and request modification or clarification of the RFP.

1.14 PROPRIETARY INFORMATION

The proposal of the successful offeror(s) becomes public information. Proprietary information can be protected under limited circumstances such as client lists and non-public financial statements. An entire proposal may not be marked as proprietary. Offerors must clearly identify in the Executive Summary and mark in the body of the proposal any specific proprietary information they are requesting to be protected.

The Executive Summary must contain specific justification explaining why the information is to be protected.

Proposals may be reviewed and evaluated by any person at the discretion of the State. All materials submitted become the property of the State of South Dakota and may be returned only at the State's option.

1.15 LENGTH OF CONTRACT

This proposed contract will be in force until 4/30/28. After which, if no additional state funding is available, the participating entities will be responsible for the costs beyond the contract period and the successful offeror will be responsible for working out the continuity of the services.

1.16 GOVERNING LAW

This RFP shall be governed by and construed in accordance with the laws of the State of South Dakota, without regard to any conflicts of law principles, decisional law, or statutory provision which would require or permit the application of another jurisdiction’s substantive law. Venue for any lawsuit regarding or arising out of the transaction covered herein shall be in the Circuit Court, Sixth Judicial Circuit, Hughes County, South Dakota.

1.17 DISCUSSIONS WITH OFFERORS (ORAL PRESENTATION/NEGOTIATIONS)

An oral presentation by an offeror to clarify a proposal may be required at the sole discretion of the State.

However, the State may award a contract based on the initial proposals received without discussion with the Offeror. If oral presentations are required, they will be scheduled after the submission of proposals. Oral presentations will be made at the offeror’s expense.

This process is a Request for Proposal/Competitive Negotiation process. The review process for each proposal will begin as soon as the proposal has been received. Each Proposal shall be evaluated, and each respondent shall be available for negotiation meetings at the State’s request. The State reserves the right to negotiate on any and/or all components of every proposal submitted. From the time the proposals are submitted until the formal award of a contract, each proposal is considered a working document and as such, will be kept confidential. The negotiation discussions will also be held as confidential until such time as the award is completed.

2.0 STANDARD CONTRACT TERMS AND CONDITIONS

Any contract or agreement resulting from this RFP will include, at a minimum, the substance of the contract terms and conditions as set forth in Appendix A. However, as part of the negotiation process, the language of a specific term or condition listed in Appendix A could be modified upon agreement between the State and the vendor.

Additional terms and conditions may be required. The Offeror should indicate in their response any issues they have with specific contract terms. If the Offeror does not indicate that there are any issues with any contract terms, the State will assume those terms are acceptable to the Offeror.

3.0 SCOPE OF WORK

Cities and counties across South Dakota rely on a reliable email infrastructure for essential government communications, public service coordination, and interagency collaboration. The rise in targeted phishing campaigns and other cyber-attacks necessitates a unified, secure, and scalable solution that can be implemented across jurisdictions of varying size and technical capacity.

The Scope of Work for this contract will be to establish and manage a unified, scalable, comprehensive, cloud-based Secure Email Solution for participating entities. This project will require the creation/management of Microsoft 365 Government Community Cloud (GCC) tenants utilizing a minimum of Microsoft 365 Government G3 licenses with added security provided by Microsoft Defender for Office 365 Plan 2. GCC data centers are in the Continental US as mandated by FedRAMP and offer robust security to government data.

Currently, South Dakota cities and counties are using a mix of in-house, IT Vendor supported, ISP supported, and/or multiple public email platforms (Gmail, Hotmail, Yahoo, personal email, etc.), making it difficult to identify the entity, secure, and protect them from cybersecurity attacks. We have a need for global address listings, calendaring, collaboration, etc. This solution will have employees on the same email system so internal emails remain encrypted and never go to the public internet or another email system. The anticipated end-user clients for these services include city & county law enforcement, auditors, treasurers, finance officers, municipal utility, street & highway, elected officials, other employees or accounts deemed necessary, etc.

Given that South Dakota comprises 66 counties, around 309 municipalities, and various local government entities, we are obtaining bids to provide these services to those cities, counties or municipalities who participate in the initiative.

The participation is voluntary thus the exact number of entities and end-users is unknown. The entities, in collaboration with SecureSD, will select the contractor of their choice and may join the initiative through the length of this award.

Through this RFP, the state will establish a pool of qualified state-approved contractors that, in collaboration with the SecureSD team, participating cities, counties, and municipalities can choose from for their Secured Email Solution.

This email solution for the participating cities, counties and municipalities will be done remotely as much as possible.

We encourage and will accept the offeror’s experience in determining the cost structure for this service. Please be sure to provide this in the proper sections of your bid information.

Requirements:

The list below is a minimum (non-inclusive) detailed list of work to be done to give the offeror some of the items we expect the service to provide. The offeror can add to this list based on their expertise, but this is a minimum list of required items.

In layman terms, the state wants to establish a pool of qualified state-approved contractors that are capable of managing a Secured Microsoft Exchange Email system for each entity. The entities (city/county/municipality), in collaboration with SecureSD, will then select the contractor that would work best for their specific needs.

A. Secure Email Solution – Microsoft Exchange Online & Defender for Office 365

The selected vendor will deploy and manage a Secured Email Solution for all participating entities. The email solution will require the creation/management of Microsoft 365 Government Community Cloud (GCC) tenants utilizing a minimum of Microsoft 365 Government G3 licenses with added security provided by Microsoft Defender for Office 365 Plan 2.

Requirements:

• The Secure Email Solution will be built using the minimum of a Microsoft 365 G3 license.

o Utilize the comprehensive suite designed for enterprise-level organizations, particularly government entities, offering a robust set of productivity, collaboration, and security features.

• Configure a Microsoft 365 Government Community Cloud (GCC) tenant for each entity.

o Tenant provisioning and email policy setup in GCC.

o Integrate with participating entities Microsoft suite of applications currently being used.

• Procure & deploy required licensing:

o Avoid duplicate purchases of any licenses.

▪ Work with participating entities to balance any existing Microsoft licensing so SecureSD can append onto the expiration of existing licenses.

o Collaborate as needed with SecureSD on required licensing.

• Security Requirements:

o Microsoft Defender for Office 365 Plan 2 Security Controls:

▪ Anti-phishing and impersonation detection.

▪ Real-time scanning (Safe Links, Safe Attachments).

▪ Automated Anti-Phishing policies, and automated threat investigation, quarantine and response.

▪ Configure system for phishing simulations.

• Create simulated phishing campaigns with link-based, attachment-based, and credential-based threats.

o Threat Explorer and detailed incident reports.

o Adhere to industry standards and best practices for any DNS operations for email domain names.

o Use Microsoft and CISA best practices for productivity and security.

o Align with NIST CSF, CIS Controls, and CISA guidance for municipal cybersecurity Email Encryption

▪ Office Message Encryption for sensitive data.

▪ Implement authenticated and encrypted email channels (SPF, DKIM, DMARC).

• Archiving & Retention: (Aligned with policies of the entity) o Policy-aligned record retention.

o Compliance with electronic discovery policies of the entity.

• User Experience Requirements:

o Must allow for integration with various end user access methods

▪ Outlook desktop client, web based access, mobile devices, and etc.

o Configure Multi-factor Authentication (MFA).

B. Implementation & Onboarding

Vendors must deliver a phased rollout plan with structured onboarding for each entity. Ensure adequate handoff to the participating entities with minimal disruption to daily operations.

• Migration/Transition of existing entities email to new system.

o Utilize best efforts to transfer existing email.

o If tools exist to easily migrate old/past/existing email/contacts we will accept funding it.

o If tools do not exist, and it will take many (mutually agreed between contractor and SecureSD) hours we will not fund that.

• Testing, validation, proper handoff in full coordination with the entity.

• Provide your plan/ideas/proposal for assisting the end-user client during the onboarding.

• Provide training on how to effectively use the new Email Solution.

o Quick start guides/help/support for end users and entity point of contact/administrator.

C. Monitoring, Management, and Ongoing Support

The Secured Email Solution will require daily operational management and on-going support.

• System/Entity Operational Management:

o Ongoing configuration and security updates and optimization post-deployment.

o Change management process/system:

▪ Account Additions, Deletions, Modifications

▪ Creation/updates of email efficiencies capabilities.

• Distribution Lists (i.e. ALL Police Department, ALL Water Dept employees)

• Shared Email Accounts (i.e. FinanceOffice@MyCityName.sdcity.gov)

• Shared calendars, Public Folders, etc.

▪ Configure/update Multi-factor Authentication (MFA).

o Phishing simulator

▪ Create simulated phishing campaigns with link-based, attachment-based, and credential-based threats.

o Trouble shooting / tiered escalation plan.

• Ongoing end-user support.

o Support Services:

▪ Helpdesk availability with tiered escalation.

▪ Provide the hours support services are available.

▪ Provide your plan for after-hours support.

▪ What is the waiting time for assistance?

o Response to end-user assistance o Support Materials as necessary/needed (i.e. Step by step instructions or FAQs).

o Contact matrix.

▪ How & who does an entity local Point of Contact/administrator contact for support if they have issues.

▪ How & who does an end-user contact for support if they have issues.

▪ List any options if the larger cities/counties have the ability to use their own IT support.

• Would this be a cost savings to SecureSD?

• Monitoring/Reporting/Deliverables: (To Entity and the State) o Email Policy Configuration Documentation per municipality.

o Meaningful activity reports:

▪ Monthly, annual, ad-hoc. covering multiple KPI’s as mutually determined.

• Based on what is available by the state and the contractor.

o All monitoring/reporting will be aggregated and granular to the individual entity

▪ I.e. Total email volume (malicious, safe, spam, etc.), phishing attempts, quarantined messages, simulated phishing reports, any incident response, number of threats mitigated based on specific threats.

• Financial reporting:

o Costs available to the entity to demonstrate the value and allow to prepare future budgets

▪ Delivered Monthly.

o Cost reports delivered to the state (DSU/SecureSD)

D. Optional Services/Solutions

Knowing the expertise of the industry and keeping pace with the changing threat landscape, we would entertain optional solutions or add-ons beyond the requirements. Be sure to separate these expenses from the requirements, unless they are included and noted in the overall cost.

Optional examples:

• Email Security Solution/platform:

o That would be a separate system that is above and beyond the requirements and adds additional security

4.0 PROPOSAL REQUIREMENTS AND COMPANY QUALIFICATIONS

4.1 The offeror is cautioned that it is the offeror's sole responsibility to submit information related to the evaluation categories and that the State of South Dakota is under no obligation to solicit such information if it is not included with the proposal. The offeror's failure to submit such information may cause an adverse impact on the evaluation of the proposal.

4.2 Provide the following information related to at least three previous and current service/contracts, performed by the offeror’s organization, which are similar to the requirements of this RFP. The state prefers client references from the public sector or similarly structured entities.

a. Name, address and telephone number of client/contracting agency and a representative of that agency who may be contacted for verification of all information submitted.

b. Dates of the service/contract.

c. A brief, written description of the specific prior services performed and requirements thereof. Any similar requirements of this RFP such as familiarity with municipal or public-sector security compliance (NIST, CISA, CIS), any innovative support models and SLAs, cost proposals (including licensing, implementation, and ongoing support).

4.3 Provide the following information.

4.3.1 Detailed Technical Solution.

• Full detailed description of your proposed technical solution.

4.3.2 Specialized expertise, capabilities, and technical competence as demonstrated by the proposed approach and methodology to meet the project requirements including the depth of experience and reliability.

• Your ability and/or experience implementing Microsoft Exchange Online across multi-tenant environments.

• Your ability to scale across municipalities of varying sizes.

4.3.3 Record of past performance, including price and cost data from previous projects, quality of work, ability to meet schedules, cost control, and contract administration. Cost-effectiveness and transparency in pricing.

4.3.4 List all relevant product and industry cybersecurity certifications (e.g., ISO 27001, CISA, CISSP, Microsoft SC-200).

4.3.5 Resources available to perform the work, including:

• Any specialized services, within the specified time limits for the project.

• Capability to support geographically distributed municipalities with varying IT capacities.

4.3.6 Ability and proven history in handling special project constraints. Such as:

• Familiarity with municipal or public-sector security compliance (NIST, CISA, CIS).

4.3.7 Proposed project management techniques.

4.3.8 Availability to the project locale.

4.3.9 Familiarity with the project locale.

4.3.10 Implementation Timeline.

5.0 PROPOSAL RESPONSE FORMAT

5.1 The Contractor shall submit one (1) electronic copy of its entire proposal, including all attachments, in Microsoft Word or PDF electronic format (this document should be formatted in a searchable Text-Based PDF file format).

5.1.1 The proposal should be paginated and have an index and/or a table of contents referencing the appropriate page number.

5.2 All proposals must be organized and/or tabbed with labels for the following headings:

5.2.1 RFP Form. The State’s Request for Proposal form (1st page of RFP) completed and signed, preferably in blue ink.

5.2.2 Executive Summary. The one-to-two-page executive summary is to briefly describe the offeror's proposal. This summary should highlight the major features of the proposal. It must indicate any requirements that cannot be met by the offeror. The reader should be able to determine the essence of the proposal by reading the executive summary. Proprietary information requests should be identified in this section.

5.2.3 Detailed Response. This section should constitute the major portion of the proposal and must contain at least the following information:

5.2.3.1 A complete narrative of the offeror's assessment of the work to be performed, the offeror’s ability and approach, and the resources necessary to fulfill the requirements. This should demonstrate the offeror's understanding of the desired overall performance expectations.

5.2.3.2 A specific point-by-point response, in the order listed to each requirement in the RFP. The response should identify each requirement being addressed as enumerated in the RFP. Offerors must utilize the Compliance Matrix in Appendix B listing each technical requirement and indicating 'Meets Fully,' 'Meets Partially,' or 'Does Not Meet,' with clarifications if partial. This should also include the required information in Section 4.0.

5.2.3.3 A clear description of any options or alternatives proposed.

5.2.4 Cost Proposal. Cost will be evaluated independently from the technical proposal. Offerors may submit multiple cost proposals. All costs related to the provision of the required services must be included in each cost proposal offered.

See section 7.0 for more information related to the cost proposal.

5.3 Offerors are cautioned that use of the State Seal in any of their documents is illegal as per South Dakota

Codified Law § 1-6-3.1. Use of seal or facsimile without authorization prohibited--Violation as misdemeanor.

No person may reproduce, duplicate, or otherwise use the official seal of the State of South Dakota, or its facsimile, adopted and described in §§ 1-6-1 and 1-6-2 for any for-profit, commercial purpose without specific authorization from the secretary of state. A violation of this section is a Class 1 misdemeanor.

6.0 PROPOSAL EVALUATION AND AWARD PROCESS

6.1 Evaluation Team: All proposals shall be evaluated by an evaluation team. Evaluation and potential selection of the Offeror shall be based on the information submitted in the proposals. The team may review references, require oral presentations, and conduct on-site visits to Offeror accounts and use the results in evaluating the proposals.

6.2 Meeting Terms and Conditions: Proposals will be reviewed to determine if required terms and conditions are met. Failure to meet the required terms and conditions may result in the proposal being rejected. If all Offerors fail to meet one or more of the required terms and conditions, the State reserves the right to continue the evaluation of proposals and to select the proposal that provides the best value to the State of South Dakota as determined by the evaluation team.

6.3 Qualification Criteria: Each proposal shall be evaluated on whether required qualification criteria are met. The qualification criteria that will be used to determine if the Offeror will be considered for an award is based on the information provided in response to Section 4.0, as well as the Cost Proposal set forth in Section 7.0 of this RFP.

6.4 Evaluation Criteria: After determining that a proposal satisfies the mandatory requirements stated in the Request for Proposal, the evaluator(s) shall use subjective judgment in conducting a comparative assessment of the proposal by considering each of the following criteria:

6.4.1 Detailed Technical Solution.

• Full detailed description of your proposed technical solution.

6.4.2 Specialized expertise, capabilities, and technical competence as demonstrated by the proposed approach and methodology to meet the project requirements including the depth of experience and reliability.

• Your ability and/or experience implementing Microsoft Exchange Online across multi-tenant environments.

• Your ability to scale across municipalities of varying sizes.

6.4.3 Record of past performance, including price and cost data from previous projects, quality of work, ability to meet schedules, cost control, and contract administration. Cost-effectiveness and transparency in pricing.

6.4.4 List all relevant product and industry cybersecurity certifications (e.g., ISO 27001, CISA, CISSP, Microsoft SC-200).

6.4.5 Resources available to perform the work, including:

• Any specialized services, within the specified time limits for the project.

• Capability to support geographically distributed municipalities with varying IT capacities.

6.4.6 Ability and proven history in handling special project constraints. Such as:

• Familiarity with municipal or public-sector security compliance (NIST, CISA, CIS).

6.4.7 Proposed project management techniques.

6.4.8 Availability to the project locale.

6.4.9 Familiarity with the project locale.

6.4.10 Implementation Timeline.

6.5 Offeror to Submit Complete Information: The evaluation and potential selection of a Contractor will be based on the information submitted in the Offeror's proposal. Each Offeror shall furnish a complete description of capabilities to meet or exceed the Scope of Work as described in Section 3 herein. Failure to respond to each of the requirements in the RFP may be the basis for rejecting a response.

6.6 Offeror to Submit Information Related to Evaluation Categories: The Offeror is cautioned that it is the Offeror's sole responsibility to submit information related to the evaluation categories and that the State of South Dakota is under no obligation to solicit such information if it is not included with the proposal. The Offeror's failure to submit such information may cause an adverse impact on the evaluation of the proposal.

6.7 Information Relating to Past Performance and Success: Experience and reliability of the offeror's organization are considered subjectively in the evaluation process. Therefore, the offeror is advised to submit any information which documents successful and reliable experience in past performances, especially those performances related to the requirements of this RFP.

6.8 Qualifications of Personnel: The qualifications of the personnel proposed by the offeror to perform the requirements of this RFP, whether from the offeror's organization or from a proposed subcontractor, will be subjectively evaluated. Therefore, the offeror should submit detailed information and project team bios related to the experience and qualifications, including education and training, of proposed personnel.

6.9 Rejection of Proposals: The State reserves the right to reject any or all proposals, waive technicalities, and make award(s) as deemed to be in the best interest of the State of South Dakota.

7.0 COST PROPOSAL

Offerors may submit multiple cost proposals, for example you may propose fixed per-seat/account, per-migration, or per-entity pricing options. We encourage our industry partners to use their expertise and creativity when producing their cost proposal and will accept the offeror’s experience/expertise in determining the cost structure for this service.

One common approach to the bid may be to break down the costs for the one-time implementation/onboarding costs, then the ongoing (monthly) costs for licenses, monitoring, management, and ongoing support.

As part of your cost proposal, please fill out the following table:

ONE-TIME Expenses ONE-TIME Cost

Clarifications if needed

Onetime per Entity cost Install/config/setup/DNS settings, etc.

$ 00.00

Onetime per User/Account cost For Implementation & Onboarding Users

$ 00.00

Other ONE-TIME expenses $ 00.00 Please identify what these are

MONTHLY Ongoing expenses MONTHLY Cost

License Costs (per user/account) Minimum of Microsoft 365 Government G3 licenses

$ 00.00

Microsoft Defender for Office 365 Plan 2 $ 00.00

Monitoring, Management, and Ongoing Support Monthly MSP Support and Maintenance

Be sure to identify if this is Per Entity or per User.

$ 00.00

Other MONTHLY expenses $ 00.00 Please identify what these are

Totals $ 00.00

Be sure to include any Service Level Agreements (SLAs) you may wish to implement.

The State reserves the right to negotiate with the highest ranked offeror(s) to develop a cost structure that effectively satisfies all the State’s requirements as outlined in this RFP.

8.0 AWARD

8.1 This RFP is intended to create a pool of contractors to select from. There is no guarantee that any offeror selected through this process will be invited to enter into contract with the State. Any individual contract entered into will contain a negotiated scope of work which may include all or any portion of the scope of work described herein.

8.2 The requesting agency and any selected offeror may mutually discuss and refine the scope of services to be performed and shall negotiate terms, including compensation and performance schedule.

8.2 The negotiation process may continue through successive offerors, according to agency ranking, until the requesting agency determines their needs are met or they decide to terminate the contracting process.

APPENDIX A

STATE OF SOUTH DAKOTA

CONTRACT FOR SERVICES

Between

State of South Dakota

[NAME OF CONTRACTOR]

[CITY, STATE, ZIP CODE]

[TELEPHONE NUMBER]

Referred to as Contractor Referred to as State

The State hereby enters into this agreement (Agreement) for services with Contractor in consideration of and pursuant to the terms and conditions set forth herein.

1. SCOPE OF SERVICES:

The purpose of this contract is to__________. Contractor will perform those services described in the Work Plan, attached hereto as Exhibit A and by this reference incorporated herein.

2. PERIOD OF PERFORMANCE: This Agreement shall be effective on __________ and will end on

_________, unless sooner terminated pursuant to the terms of this Agreement.

Upon mutual agreement, the contract may be renewed for up to five (5) additional one-year option periods.

3. USE OF EQUIPMENT, SUPPLIES AND FACILITIES:

Contractor will not use State equipment, supplies or facilities.

4. CONTRACTOR IDENTIFICATION:

Upon execution of this Agreement, Contractor will provide the State with Contractor’s Employer

Identification Number, Federal Tax Identification Number or Social Security Number.

5. CONTRACT AMOUNT AND PAYMENT:

The State will make payment for services upon satisfactory completion of the services. The TOTAL

CONTRACT AMOUNT is an amount not to exceed $__________. The State will not pay Contractor's expenses, including but not limited to travel, lodging and meals, as a separate item. Payment will be made pursuant to itemized invoices submitted with a signed state voucher. Payment will be made consistent with

SDCL Ch. 5-26. Any overpayment of this Agreement shall be returned to the State within thirty (30) days after written notification to Contractor.

6. INDEMNIFICATION:

Contractor agrees to indemnify the State of South Dakota, its officers, agents, and employees, from and against all claims or proceedings for actions, suits, damages, liabilities, other losses or equitable relief that may arise at least in part as a result of an act or omission in performing services under this Agreement. Contractor shall defend the State of South Dakota, its officers, agents, and employees against any claim, including any claim, action, suit, or other proceeding related to the claim. Contractor’s obligation to indemnify includes the payment of attorney fees and other costs of defense. In defending the State of South Dakota, its officers, agents, and employees, Contractor shall engage other professionals, subject to the written approval of the

State which shall not be unreasonably withheld. Notwithstanding the foregoing, the State may, in its sole discretion and at the expense of Contractor, engage attorneys and other professionals to defend the State of

South Dakota, its officers, agents, and employees, or to assist Contractor in the defense. This section does not require Contractor to be responsible for or defend against claims or proceedings for damages, liabilities, losses or equitable relief arising solely from errors or omissions of the State, its officers, agents or employees.

7. INSURANCE:

At all times during the term of this Agreement, Contractor shall obtain and maintain in force insurance coverage of the types and with the limits as follows:

A. Commercial General Liability Insurance:

Contractor shall maintain occurrence-based commercial general liability insurance or equivalent form of coverage with a limit of not less than one million dollars ($1,000,000) for each occurrence. If such insurance contains a general aggregate limit it shall apply separately to this Agreement or be no less than two times the occurrence limit. The insurance policy shall name the State of South Dakota, its officers and employees, as additional insureds, but liability coverage is limited to claims not barred by sovereign immunity. The State of South

Dakota, its officers and employees do not hereby waive sovereign immunity for discretionary conduct as provided by law.

B. Professional Liability Insurance or Miscellaneous Professional Liability Insurance:

Contractor agrees to procure and maintain professional liability insurance or miscellaneous professional liability insurance with a limit not less than one million dollars ($1,000,000).

C. Business Automobile Liability Insurance:

Contractor shall maintain business automobile liability insurance or equivalent form with a limit of not less than one million dollars ($1,000,000) for each accident. This insurance shall include coverage for owned, hired and non-owned vehicles.

D. Worker’s Compensation Insurance:

Contractor shall procure and maintain workers’ compensation and employers’ liability insurance as required by South Dakota or federal law.

Before beginning work under this Agreement, Contractor shall furnish the State with properly executed Certificates of Insurance which shall clearly evidence all insurance required in this

Agreement including naming the State, its officers and employees, as additional insureds, as set forth above. In the event of a substantial change in insurance, issuance of a new policy, cancellation or nonrenewal of the policy, Contractor agrees to provide immediate notice to the

State and provide a new certificate of insurance showing continuous coverage in the amounts required. Contractor shall furnish copies of insurance policies if requested by the State.

8. TERMINATION:

This Agreement may be terminated by either party hereto upon thirty (30) days written notice. In the event

Contractor breaches any of the terms or conditions hereof, this Agreement may be terminated by the State at any time with or without notice. If termination for a breach is affected by the State, any payments due to

Contractor at the time of termination may be adjusted to cover any additional costs to the State because of

Contractor's breach. Upon termination the State may take over the work and may award another party a contract to complete the work contemplated by this Agreement. If after the State terminates for a breach by

Contractor it is determined that Contractor was not at fault, then Contractor shall be paid for eligible services rendered and expenses incurred up to the date of termination.

9. SURVIVAL FOLLOWING TERMINATION:

Any terms of this Agreement that would, by their nature or through the express terms of this Agreement, survive the expiration or termination of this Agreement shall so survive including but not limited to the indemnification, controlling law and venue, and sovereign immunity provisions.

10. FUNDING:

This Agreement depends upon the continued availability of appropriated funds and expenditure authority from the Legislature for this purpose. If for any reason the Legislature fails to appropriate funds or grant expenditure authority, or funds become unavailable by operation of law or federal funds reductions, this

Agreement will be terminated by the State upon five (5) business days written notice. Contractor agrees that termination for any of these reasons is not a default by the State nor does it give rise to a claim against the

State or any officer, agent or employee of the State, and Contractor waives any claim against the same.

11. CERTIFICATIONS

A. COMPLIANCE WITH EXECUTIVE ORDER 2020-01:

Executive Order 2020-01 provides that for contractors, vendors, suppliers or subcontractors with five

(5) or more employees who enter into a contract with the State that involves the expenditure of one hundred thousand dollars ($100,000) or more, by signing this Agreement Contractor certifies and agrees that it has not refused to transact business activities, has not terminated business activities, and has not taken other similar actions intended to limit its commercial relations, related to the subject matter of this Agreement, with a person or entity that is either the State of Israel, or a company doing business in or with Israel or authorized by, licensed by, or organized under the laws of the State of Israel to do business, or doing business in the State of Israel, with the specific intent to accomplish a boycott or divestment of Israel in a discriminatory manner. It is understood and agreed that, if this certification is false, such false certification will constitute grounds for the State to terminate this Agreement. Contractor further agrees to provide immediate written notice to the State if during the term of this Agreement it no longer complies with this certification and agrees such noncompliance may be grounds for termination of this Agreement.

B. COMPLIANCE WITH SDCL Ch. 5-18A:

Contractor certifies and agrees that the following information is correct:

The bidder or offeror is not an organization, association, corporation, partnership, joint venture, limited partnership, limited liability partnership, limited liability company, or other entity or business association, including all wholly-owned subsidiaries, majority-owned subsidiaries, parent companies, or affiliates, of those entities or business associations, regardless of their principal place of business, which is ultimately owned or controlled, directly or indirectly, by a foreign parent entity from, or the government of, the People’s Republic of China, the Republic of

Cuba, the Islamic Republic of Iran, the Democratic People’s Republic of Korea, the Russian

Federation, or the Bolivarian Republic of Venezuela.

It is understood and agreed that, if this certification is false, such false certification will constitute grounds for the purchasing agency to reject the bid or response submitted by the bidder or offeror on this project and terminate any contract awarded based on the bid or response, and further would be cause to suspend and debar a business under SDCL § 5-18D-12.

The successful bidder or offeror further agrees to provide immediate written notice to the purchasing agency if during the term of the contract it no longer complies with this certification and agrees such noncompliance may be grounds for contract termination and would be cause to suspend and debar a business under SDCL § 5-18D-12.

C. CERTIFICATION REGARDING DEBARMENT, SUSPENSION, INELIGIBILITY, AND

VOLUNTARY EXCLUSION:

By signing this Agreement, Contractor certifies that neither Contractor nor its principals are presently debarred, suspended, proposed for debarment or suspension, or declared ineligible from participating in transactions by the federal government or any state or local government department or agency. Contractor further agrees that it will immediately notify the State if during the term of this Agreement Contractor or its principals become subject to debarment, suspension or ineligibility from participating in transactions by the federal government, or by any state or local government department or agency.

D. CERTIFICATION OF NO STATE LEGISLATOR INTEREST:

Contractor (i) understands neither a state legislator nor a business in which a state legislator has an ownership interest may be directly or indirectly interested in any contract with the State that was authorized by any law passed during the term for which that legislator was elected, or within one year thereafter, and (ii) has read South Dakota Constitution Article 3, Section 12 and has had the opportunity to seek independent legal advice on the applicability of that provision to this Agreement. By signing this

Agreement, Contractor hereby certifies that this Agreement is not made in violation of the South Dakota

Constitution Article 3, Section 12.

12. NOTICE:

Any notice or other communication required under this Agreement shall be in writing and sent to the address set forth above.