RFP Document.pdf

STATE OF SOUTH DAKOTA

DEPARTMENT OF CORRECTIONS

3200 E HWY 34

PIERRE, SOUTH DAKOTA 57501

South Dakota Department of Corrections Website Redevelopment & Maintenance to include:

redevelopment and construction of a new website as well as the intranet, user testing & maintenance.

PROPOSALS ARE DUE NO LATER THAN JUNE 9, 2023

RFP#: 23RFP8586 CONTACT: Danna.Humig@state.sd.us EMAIL: Danna.Humig@state.sd.us

READ CAREFULLY

FIRM NAME: AUTHORIZED SIGNATURE:

ADDRESS: TYPE OR PRINT NAME:

CITY/STATE: TELEPHONE NO:

ZIP (9 DIGIT):

FEDERAL TAX ID#: E-MAIL:

PRIMARY CONTACT INFORMATION

CONTACT NAME: TELEPHONE NO:

E-MAIL:

mailto:Danna.Humig@state.sd.us

1.0 GENERAL INFORMATION

1.1 BIT SECURITY STANDARDS

Any contract or agreement resulting from this RFP will need to incorporate and conform to the necessary security standards required by the South Dakota Bureau of Information and Telecommunications (BIT). In addition, any contract or agreement resulting from this RFP will include the State’s standard I/T contract terms listed in Attachment A and the State’s standard contract terms and conditions as identified in Section 2.0 below, along with any additional contract terms as negotiated by the parties. As part of the negotiation process the contract terms listed in Attachment A may be altered or deleted. The vendor must indicate in its response any issues it has with specific contract terms. If the vendor does not indicate that there are any issues with any contract terms, then the State will assume those terms are acceptable to the vendor. There is also a list of technical questions, Security and Vendor Questions which is attached as Attachment B, the vendor must complete. These questions may be used in the proposal evaluation. It is preferred that the vendor’s response to these questions is provided as a separate document from the RFP response. If the vendor will be hosting the solution, the file name must be “(Your Name) Hosted Security and Vendor Questions Response”. If the solution will be hosted by the State, the file must be named “(Your Name) Security and Vendor Questions Response State Hosted”. This document cannot be a scanned document but must be an original.

If the vendor elects to make the Security and Vendor Questions part of its response, the questions must be clearly indicated in the proposal’s Table of Contents. A single numbering system must be used throughout the proposal.

1.2 PURPOSE OF REQUEST FOR PROPOSAL (RFP)

1.2.1 Background and Overview of Scope of Work:

The South Dakota Department of Corrections (DOC) website is due for a redesign. While navigation of the website, search-ability, content and continuity have been maintained, the time has come for an overhaul of doc.sd.gov to ensure customer expectations; connecting them with informational content that generates a meaningful and useful experience. Additionally, this overhaul includes rewriting the DOC intranet site – which is for internal staff use only.

The vendor will design, code, and populate a responsive internet and intranet website application. The vendor will work with DOC and the Bureau of Information and Telecommunications (BIT) to meet its technology and security requirements in all stages. In addition, they will design a new content management system (CMS) to populate all current and new content. The initial project plan is laid out in more detail below and in Section 3.0 of the Scope of Work, however, the State requests that the final contract be extended for three years after the final launch date with the option to renew the contract and an annual basis for up to three years after that.

1.3 ISSUING OFFICE AND RFP REFERENCE NUMBER

The South Dakota Department of Corrections is the issuing office for this document and all subsequent addenda relating to it, on behalf of the South Dakota Department of Corrections, Administration. The reference number for the transaction is 23RFP8586. This number must be referred to on all proposals, correspondence, and documentation relating to the RFP.

1.4 SCHEDULE OF ACTIVITIES

RFP Publication April 12, 2023 Letter of Intent to Respond with Vendor Questions May 15, 2023 Responses to Vendor Questions May 29, 2023 Proposal Submission BIT Review Award Decision/Contract Negotiation Contract Start Date

June 9 by 5:00 PM CST June 15, 2023 July 6, 2023 July 21, 2023

Launch Date October 6, 2023

1.5 SUBMITTING YOUR PROPOSAL

All proposals must be completed and received by June 9, 2023 by 5pm CST. Proposals received after the deadline will be ineligible for consideration.

1. An electronic PDF version must be emailed to Danna.Humig@state.sd.us o Please place the following in the subject line:

DOC WEBSITE - 23RFP8586

2. If the file is too large to send via email, please provide an alternative option through an

FTP site or DropBox with secured access. Please inform Danna Humig of this in an email with instructions on accessing.

Note: No proposal shall be accepted from, or no contract or purchase order shall be awarded to any person, firm or corporation that is in arrears upon any obligations to the State of South Dakota, or that otherwise may be deemed irresponsible or unreliable by the State of South Dakota.

1.6 CERTIFICATION REGARDING DEBARMENT, SUSPENSION, INELIGIBILITY AND VOLUNTARY

EXCLUSION – LOWER TIER COVERED TRANSACTIONS

By signing and submitting this proposal, the offeror certifies that neither it nor its principals is presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participation, by any Federal department or agency, from transactions involving the use of Federal funds. Where the offeror is unable to certify to any of the statements in this certification, the bidder shall attach an explanation to their offer.

1.7 NON-DISCRIMINATION STATEMENT

The State of South Dakota requires that all contractors, vendors, and suppliers doing business with any State agency, department, or institution, provide a statement of non-discrimination. By signing and submitting their proposal, the offeror certifies they do not discriminate in their employment practices with regard to race, color, creed, religion, age, sex, ancestry, national origin or disability.

1.8 MODIFICATION OR WITHDRAWAL OF PROPOSALS

Proposals may be modified or withdrawn by the offeror prior to the established due date and time. No oral, telephonic, telegraphic or facsimile responses or modifications to informal, formal bids, or Request for Proposals will be considered.

1.9 OFFEROR INQUIRIES

Only emailed questions will be accepted. All questions should be sent to:

Danna.Humig@state.sd.us. Offeror may not rely on any other statements, either of a written or oral nature, that alter any specification or other term or condition of this RFP that have not originated from the DOC Point of Contact.

1.10 PROPRIETARY INFORMATION

The proposal of the successful offeror(s) becomes public information. Proprietary information can be protected under limited circumstances such as client lists and non-public financial statements. Pricing and service elements are not considered proprietary. An entire proposal may not be marked as proprietary. Offerors must clearly identify in the Executive Summary and mark in the body of the proposal any specific proprietary information they are requesting to be protected. The Executive Summary must contain specific justification explaining why the information is to be protected. Proposals may be reviewed and evaluated by any person at the discretion of the State. All materials submitted become the property of the State of South Dakota and may be returned only at the State's option.

1.11 LENGTH OF CONTRACT

The contract will begin July 21, 2023, or as mutually agreed upon by the two parties.

1. The launch date of both the Internet and Intranet must be no later than October 6, 2023.

2. The State requests that final contract terms be extended for three years after the final launch date with the option to renew the contract on an annual basis for up to three years after that.

1.12 RFP PROCESS

Any presentation or demonstration by an Offeror to clarify a proposal may be required at the sole discretion of the State. However, the State may award a contract based on the initial proposals received without a presentation or demonstration by the Offeror. If presentations and or demonstrations are required, they will be scheduled after the submission of proposals.

Presentations and demonstrations will be made at the Offeror’s expense.

At the State’s discretion the Offeror may or may not be invited to have discussions with the State.

The discussions can be before or after the RFP has been submitted. Discussions will be made at the Offeror’s expense.

This process is a Request for Proposal/Competitive Negotiation process. Each proposal shall be evaluated, and each respondent shall be available for negotiation meetings at the State’s request.

The State reserves the right to negotiate on any and/or all components of every proposal submitted. From the time the proposals are submitted until the formal award of a contract, each proposal is considered a working document and as such, will be kept confidential. The negotiation discussions will also be held as confidential until such time as the award is completed.

2.0 STANDARD CONTRACT TERMS AND CONDITIONS. Any contract or agreement resulting from this RFP will include the State’s standard terms and conditions as listed below and the State’s standard I/T contract terms listed in Attachment A, along with any additional terms and conditions as negotiated by the parties:

2.1 The Contractor will perform those services described in the Scope of Work in Section 3.

2.2 The Contractor’s services under this Agreement must launch on July 21, 2023, or as mutually agreed upon. The State requests that the final contract terms be extended for three years after the final launch date with the option to renew the contract and an annual basis for up to three years after that.

2.3 The Contractor will not use State equipment, supplies or facilities – unless otherwise discussed with the State for purposes such as the focus groups. The Contractor will provide the State with its Employer Identification Number, Federal Tax Identification Number or Social Security Number upon execution of this Agreement.

2.4 The State will make payment for services upon satisfactory completion of the services. The State will not pay Contractor's expenses as a separate item. Payment will be made pursuant to itemized invoices. Payment will be made consistent with SDCL chapter 5-26. Payment schedule based on project deliverables as outlined in the cost proposal and development of the project timeline of milestones.

2.5 The Contractor agrees to indemnify and hold the State of South Dakota, its officers, agents and employees, harmless from and against any and all actions, suits, damages, liability or other proceedings that may arise as the result of performing services hereunder. This section does not require the Contractor to be responsible for or defend against claims or damages arising solely from errors or omissions of the State, its officers, agents or employees.

2.6 The Contractor, at all times during the term of this Agreement, shall obtain and maintain in force insurance coverage of the types and with the limits as follows:

A. Commercial General Liability Insurance: The Contractor shall maintain occurrence based commercial general liability insurance or equivalent form with a limit of not less than $1,000,000.00 for each occurrence. If such insurance contains a general aggregate limit it shall apply separately to this Agreement or be no less than two times the occurrence limit.

B. Professional Liability Insurance or Miscellaneous Professional Liability Insurance: The

Contractor agrees to procure and maintain professional liability insurance or miscellaneous professional liability insurance with a limit not less than $1,000,000.00.

C. Business Automobile Liability Insurance: The Contractor shall maintain business automobile liability insurance or equivalent form with a limit of not less than $1,000,000.00 for each accident. Such insurance shall include coverage for owned, hired and non-owned vehicles.

D. Worker’s Compensation Insurance: The Contractor shall procure and maintain workers’ compensation and employers’ liability insurance as required by SD law.

Before beginning work under this Agreement, Contractor shall furnish the State with properly executed Certificates of Insurance which shall clearly evidence all insurance required in this Agreement. In the event a substantial change in insurance, issuance of a new policy, cancellation or nonrenewal of the policy, the Contractor agrees to provide immediate notice to the State and provide a new certificate of insurance showing continuous coverage in the amounts required.

Contractor shall furnish copies of insurance policies if requested by the State.

2.7 While performing services hereunder, the Contractor is an independent contractor and not an officer, agent, or employee of the State of South Dakota.

2.8 Contractor agrees to report to the State any event encountered in the course of performance of this Agreement which results in injury to the person or property of third parties, or which may otherwise subject Contractor or the State to liability. Contractor shall report any such event to the State immediately upon discovery.

Contractor's obligation under this section shall only be to report the occurrence of any event to the State and to make any other report provided for by their duties or applicable law. Contractor's obligation to report shall not require disclosure of any information subject to privilege or confidentiality under law (e.g., attorney-client communications). Reporting to the State under this section shall not excuse or satisfy any obligation of Contractor to report any event to law enforcement or other entities under the requirements of any applicable law.

2.9 This Agreement may be terminated by either party hereto upon thirty (30) days written notice.

In the event the Contractor breaches any of the terms or conditions hereof, this Agreement may be terminated by the State at any time with or without notice. If termination for such a default is effected by the State, any payments due to Contractor at the time of termination may be adjusted to cover any additional costs to the State because of Contractor's default. Upon termination the State may take over the work and may award another party an agreement to complete the work under this Agreement. If after the State terminates for a default by Contractor it is determined that Contractor was not at fault, then the Contractor shall be paid for eligible services rendered and expenses incurred up to the date of termination.

2.10 This Agreement depends upon the continued availability of appropriated funds and expenditure authority from the Legislature for this purpose. If for any reason the Legislature fails to appropriate funds or grant expenditure authority, or funds become unavailable by operation of law or federal funds reductions, this Agreement will be terminated by the State. Termination for any of these reasons is not a default by the State nor does it give rise to a claim against the state.

2.11 This Agreement may not be assigned without the express prior written consent of the State.

This Agreement may not be amended except in writing, which writing shall be expressly identified as a part hereof, and be signed by an authorized representative of each of the parties hereto.

2.12 This Agreement shall be governed by and construed in accordance with the laws of the State of South Dakota. Any lawsuit pertaining to or affecting this Agreement shall be venued in Circuit Court, Sixth Judicial Circuit, Hughes County, South Dakota.

2.13 The Contractor will comply with all federal, state and local laws, regulations, ordinances, guidelines, permits and requirements applicable to providing services pursuant to this Agreement, and will be solely responsible for obtaining current information on such requirements.

2.14 If the vendor chooses to subcontract any one part of the components listed in section 3.1 to complete the requirements of this RFP, DOC must be notified and reserves the right to veto. The Contractor will include provisions in its subcontracts requiring its subcontractors to comply with the applicable provisions of this Agreement, to indemnify the State, and to provide insurance coverage for the benefit of the State in a manner consistent with this Agreement. The Contractor will cause its subcontractors, agents, and employees to comply, with applicable federal, state and local laws, regulations, ordinances, guidelines, permits and requirements will adopt such review and inspection procedures as are necessary to assure such compliance.

2.15 Contractor hereby acknowledges and agrees that all reports, plans, specifications, technical data, miscellaneous drawings, software system programs and documentation, procedures, or files, operating instructions and procedures, source code(s) and documentation, including those necessary to upgrade and maintain the software program, and all information contained therein provided to the State by the Contractor in connection with its performance of services under this Agreement shall belong to and is the property of the State and will not be used in any way by the Contractor without the written consent of the State. Papers, reports, forms, software programs, source code(s) and other material which are a part of the work under this Agreement will not be copyrighted without written approval of the State.

2.16 The Contractor certifies that neither Contractor nor its principals are presently debarred, suspended, proposed for debarment or suspension, or declared ineligible from participating in transactions by the federal government or any state or local government department or agency.

Contractor further agrees that it will immediately notify the State if during the term of this Agreement Contractor or its principals become subject to debarment, suspension or ineligibility from participating in transactions by the federal government, or by any state or local government department or agency.

2.17 Any notice or other communication required under this Agreement shall be in writing and sent to the address set forth above. Notices or communications to or between the parties shall be deemed to have been delivered when mailed by first class mail, provided that notice of default or termination shall be sent by registered or certified mail, or, if personally delivered, when received by such party.

2.18 In the event that any court of competent jurisdiction shall hold any provision of this Agreement unenforceable or invalid, such holding shall not invalidate or render unenforceable any other provision hereof.

2.19 All other prior discussions, communications and representations concerning the subject matter of this Agreement are superseded by the terms of this Agreement, and except as specifically provided herein, this Agreement constitutes the entire agreement with respect to the subject matter hereof.

2.20 For contractors, vendors, suppliers, or subcontractors with five (5) or more employees who enter into a contract with the State of South Dakota that involves the expenditure of one hundred thousand dollars ($100,000) or more, by submitting a response to this solicitation or agreeing to contract with the State, the bidder or offeror certifies and agrees that the following information is correct:

The bidder or offeror, in preparing its response or offer or in considering proposals submitted from qualified, potential vendors, suppliers, and subcontractors, or in the solicitation, selection, or commercial treatment of any vendor, supplier, or subcontractor, has not refused to transact business activities, has not terminated business activities, and has not taken other similar actions intended to limit its commercial relations, related to the subject matter of the bid or offer, with a person or entity on the basis of Israeli national origin, or residence or incorporation in Israel or its territories, with the specific intent to accomplish a boycott or divestment of Israel in a discriminatory manner. It is understood and agreed that, if this certification is false, such false certification will constitute grounds for the State to reject the bid or response submitted by the bidder or offeror on this project and terminate any contract awarded based on the bid or response.

The successful bidder or offeror further agrees to provide immediate written notice to the contracting executive branch agency if during the term of the contract it no longer complies with this certification and agrees such noncompliance may be grounds for contract termination.

2.21 In preparing its response or offer or in considering proposals submitted from qualified, potential vendors, suppliers, and subcontractors, or in the solicitation, selection, or commercial treatment of any vendor, supplier, or subcontractor, Contractor is not an entity, regardless of its principal place of business, that is ultimately owned or controlled, directly or indirectly, by a foreign national, a foreign parent entity, or foreign government from China, Iran, North Korea, Russia, Cuba, or Venezuela, as defined by South Dakota Executive Order 2023-02.

Contractor further agrees that, if this certification is false, such false certification will constitute grounds for the State to terminate this Agreement. Contractor further agrees to provide immediate written notice to the State if during the term of this Agreement it no longer complies with this certification and agrees such noncompliance may be grounds for termination of this Agreement.

3.0 SCOPE OF WORK

The vendor will design, code, and populate a responsive internet and intranet website application. The vendor will work with DOC to meet its technology and security requirements in all stages. In addition, they will design a new content management system (CMS) to populate all current and new content.

Proposals must reference all components listed below and in the Scope of Work to be included in the selection review process. If the vendor chooses to subcontract any one part of the key components listed below to complete the requirements of this RFP, DOC must be notified and reserves the right to veto.

(See additional language in 2.14.)

3.1 Project components:

1. Website design, testing, and execution (includes Internet and Intranet sites).

2. User and security testing and feedback integration.

3. Maintenance agreement and future recommendations.

4. Project management role to be completed by the vendor.

5. Photo library of new images to choose from for website layout and design.

6. Responsive design to render on any handheld or tablet device.

7. Development, testing and implementation of the DOC Intranet website.

8. Landing page for correctional industries business/online ordering.

9. Payment option for outstanding bills.

10. Offender locator which needs to interface with Syscon offender management system.

3.2 Key Website Features:

1. Search engine functionality must be modernized and set to the highest standard of excellence to offer an enhanced customer experience.

2. Content management system programming and implementation.

3. Enhanced newsroom/press release archive.

4. Staff directory/contact page consolidated through and features first and second tier leadership profiles.

5. Ability to focus in on key audience types who will visit and navigate the site (example: family member, parolee, victim, etc.).

6. Live data and graphics through Power BI or similar program.

7. Utilization of fillable forms on the website and Intranet.

8. Incorporate DOC policies on intranet in user-friendly format.

3.3 Additional Areas of Work

1. Vendor meetings – TBD – and coordinated by the vendor project manager.

a. Includes face to face and virtual meetings as agreed upon by the DOC and the vendor.

b. Weekly meetings throughout the length of the project between the DOC workgroup and vendor project manager.

c. These meetings will include status updates, percent of project complete, issues impacting target completion date and action items.

2. Internal DOC workgroup will co-lead the content development with insight and feedback from the vendor.

3. The DOC workgroup will work collectively with the vendor to ensure written content fits the program scope, action and audience appropriately.

4. Outline project management milestones.

a. Identify when test sessions will occur during major components of development along with all other details associated with the major components listed in the previous section.

5. Identify and share other creative enhancements and opportunities for the Department to embark on during this development process.

6. Quarterly report on website usage and performance.

7. Explain your recommendation for hosting on State of South Dakota servers vs. vendor-hosted servers.

8. Security scans and assessments (see 3.9 for more details on IT requirements) conducted prior to launch date.

a. What this means is that we will need the website near completion (90-95 percent complete) by September 22, 2023. Launch date no later than October 6, 2023.

3.4 Goals

1. Begin work in July 2023 with a comprehensive timeline and project management outline associate with the scope of work.

2. Develop a maintenance agreement.

3. Design and share a minimum of three mock website templates (include secondary page designs) for the new doc.sd.gov and similar Intranet style.

4. Code and construct the new doc.sd.gov.

5. Code and construct the new doc.sd.gov Intranet site.

6. Assist with content creation and page development of doc.sd.gov.

o DOC will provide a comprehensive review of content we wish to carry over from current website to new website.

o Help support imagery, design and layout of all pages of the site.

7. Prepare a style guide for doc.sd.gov.

8. Facilitate user testing in partnership with DOC.

9. Work with DOC and the state’s IT agency to successfully launch the new doc.sd.gov.

3.5 Hosting and Data Access Requirements

The contract doubles as an agreement for the State to own the data tables and is able to manipulate data, run reports as needed, pull code tables, access raw data, and develop dashboards as needed through Microsoft Power BI, ESRI, Tableau and associated platforms.

3.6 Single Sign-On Requirements

As part of the State’s Identity and Access Management (IAM) strategy, the proposed solution will need to integrate with the State of South Dakota’s standard identity management service single sign-on (SSO) which enables custom control of how citizens and state employees sign up, sign in, and manage their profiles. SSO is required to login and to enter the CMS application and to perform updates and routine edits to the Internet and Intranet websites.

The SSO supports two industry-standard protocols: OpenID Connect and OAuth 2.0 (preferred). This identity management will handle password recovery. Multi-factor Authentication (MFA) is required for all application Administrators and may be required for other users.

If the vendor is not able to fulfill this identity management standard they will be excluded from the list.

3.7 Interfaces and Integration

The vendor must describe how the system can adapt to business necessary interfaces using widely adopted open APIs and standards. Additionally, Department of Corrections expects that the vendor will make available/expose software services and publish documentation for those software services that would enable third party developers to interface other business applications. A detailed description of system capability shall be included in the proposal.

3.8 Project Deliverables/Approach/Methodology

If the State will be hosting the solution the vendor will provide a system diagram. The diagram must be detailed enough that the State can understand the components, the system flow, and system requirements. It is preferred that the diagram be provided as a separate document or attachment. The file must be named “(Your Name) System Diagram and Requirements”. If the vendor elects to make the diagram part of the proposal, then the location of the diagram must be clearly indicated in the Table of Contents.

3.9 For state-hosted systems that reside in a state-managed cloud:

To minimize impacts to project schedules, vendors are required to provide architectural plans, resource needs, permission plans, and all interfaces – both internal to the state and internet facing for cloud hosted systems. The documentation provided will be reviewed as part of the initial assessment process. If selected for award of a contract, and once the state has approved the submitted materials, a test environment will be provided after contract signature. Systems will be reviewed again before being moved to a production environment. Any usage or processes that are deemed out of compliance with what was approved or represent excessive consumption or risk will require remediation before being moved to production.

If the vendor is hosting the solution, provide a diagram giving an overview of the proposed system. It is preferred that this diagram be provided as a separate document or attachment. The file must be named

“(Your Name) Hosted System Diagram”. If the vendor elects to make the diagram part of the proposal, then the location of the diagram must be clearly indicated in the Table of Contents.

The vendor should state whether its proposed solution will operate in a virtualized environment. Vendor also should identify and describe all differences, restrictions or limitations of its proposed solution with respect to operation, licensing, support, certification, warranties, and any other details that may impact its proposed solution when hosted in a virtualized environment. This information must be included with the solution diagram for the vendor hosted solution.

Application must be developed in the Microsoft Technology Stack (Asp.net, Razor, MVC, etc). The CMS recommended is Umbraco, for any other CMS to be considered, they must be within the Microsoft Technology Stack. Database (for the data repository) must be MS SQL or MS compliant database.

This section identifies tasks and deliverables of the project as described in Section 3 above. The selected vendor is responsible for providing the required deliverables. These deliverables will be the basis against which the vendor’s performance will be evaluated.

The vendor is required to include a test system for its application. This test system will be used at the discretion of BIT. All resource costs associated with keeping the test system available must be borne by the project owner or the vendor. Any licensing costs for the test system must be included with the costs.

At BIT’s discretion, any code changes made by the vendor, either during this project or thereafter, will be placed in the above test system first. It is at BIT’s discretion if the code changes are applied by BIT or the vendor. If the code testing delays a project’s timeline, a change management process should be followed, and the State will not be charged for this project change. If the test and production systems are to be hosted by the State, the schedule for the testing of the code changes is to be decided by BIT. Testing of emergency code changes will be scheduled by BIT based on the severity and resource availability.

The test system will be maintained by the vendor as a mirror image of the production system code base.

At BIT’s discretion, updates to the production system will be made by copying code from the test system after the test system passes BIT certification requirements.

If BIT determines that the application must be shut down on the production system, for any reason, the vendor will, unless approved otherwise by BIT, diagnosis the problem and make all fixes on the test system. The vendor is expected to provide proof, to BIT, of the actions taken to remediate the problem that lead to the application being denied access to the production system before the application can go back into production. This proof can be required by BIT even if the fix passes all BIT certification criteria.

BIT is willing to sign a non-disclosure agreement with the vendor if the vendor feels that revealing the fix will put the vendor’s intellectual property at risk.

All solutions acquired by the State that are hosted by the vendor, including Software as a Service, or hosted by a third-party for the vendor will be subjected to security scans by BIT or preapproved detailed security scan report provided by the vendor. The scan report sent in with the proposal can be redacted by the vendor. The State’s goal at this point is to see if the contents of the report will be acceptable, not to review the contents themselves. If the vendor will be providing a security scan report, one must be sent with the proposal for approval. Approval is not guaranteed. If the scan report is not acceptable, the State must scan the vendor’s solution. The actual scanning by the State or the submission of a security scan report will be done if the proposal is considered for further review. A detailed security report must consist of at least:

1. The system that was evaluated (URL if possible, but mask it if needed).

2. The categories that were evaluated (example: SQL injection, cross site scripting, etc.)

3. What were the general findings, (meaning how many SQL injection issues were found, what was the count per category)

4. Technical detail of each issue found. (where was it found – web address, what was found, the http response if possible)

The cost of any scans done by the vendor or the vendor’s costs associated with the State’s scans must be part of the vendor’s bid. If the vendor is sending a security scan report, it should price the product both as if the State was to do the security scan or if the vendor was to do the security scan.

Security scanning will be performed during the software development phase and during pre-production review. These scans and tests can be time consuming and should be allowed for in project planning documents and schedules. Products that do not meet BIT’s security and performance requirements will not be allowed to go into production and may be barred from UAT until all issues are addressed to the State’s satisfaction. The State urges the use of industry scanning/testing tools and secure development methods be employed to avoid unexpected costs and project delays. Costs to produce and deliver secure and reliable applications are the responsibility of the software entity producing or delivering an application to the State. Unless expressly indicated in writing, the State assumes all price estimates and bids are for the delivery and support of applications and systems that will pass security and performance testing. If the State determines the hardware, website(s), software, and or cloud services have security vulnerabilities that must be corrected, the State will inform the offeror of the nature of the issue and the offeror will be required to respond in writing regarding mitigation plans for the security vulnerabilities. If the product(s) does not pass the initial security scan, additional security scans may be required to reach an acceptable level of security. The vendor must pass a final follow-up security scan for the website(s), software or cloud services for the product(s) to be acceptable products to the State. The State may suspend or cancel payments for hardware, website(s), software, or cloud services that do not pass a final security scan.

Any website or web application hosted by the vendor that generates email cannot use “@state.sd.us” as the originating domain name per state security policy.

As part of this project, the vendor will provide a monitoring tool the State can utilize to monitor the operation of the proposed solution as well as all systems and all subcomponents and connections. It is required that this tool be easy to use and provide a dashboard of the health of the proposed solution. The effectiveness of this monitoring tool will be a component of the acceptance testing for this project.

As part of the project plan, the vendor will include development of an implementation plan that includes a back out component. Approval of the implementation plan by BIT should be a project milestone. Should the implementation encounter problems that cannot be resolved and the implementation cannot proceed to a successful conclusion, the back out plan will be implemented. The Implementation and back out documentation will be included in the project documentation.

The successful vendor will use the approved BIT processes and procedures when planning its project, including BIT’s change management process. Work with the respective agency’s BIT Point of Contact on this form. The Change Management form is viewable only to BIT employees. The purpose of this form is to alert key stake holders (such as: Operations, Systems Support staff, Desktop Support staff, administrators, Help Desk personnel, client representatives, and others) of changes that will be occurring within state resources and systems to schedule the:

• Movement of individual source code from test to production for production systems

• Implementation of a new system

• A major enhancement to a current system or infrastructure changes that impact clients

• Upgrades to existing development platforms

If as part of the project the state will be acquiring software the proposal should clearly state if the software license is perpetual or a lease. If both are options, the proposal should clearly say so and state the costs of both items separately.

Include in your submission details on your:

• Data loss prevention methodology;

• Identity and access management;

• Security intelligence;

• Annual security training and awareness;

• Manual procedures and controls for security;

• Perimeter controls;

• Security certifications and audits.

If the vendor will have State data on its system(s) or on a third-party’s system and the data cannot be sanitized at the end of the project, the vendor’s proposal must indicate this and give the reason why the data cannot be sanitized as per the methods in NIST 800-88.

The vendor’s solution cannot include any hardware or hardware components manufactured by Huawei Technologies Company or ZTE Corporation or any subsidiary or affiliate of such entities. This includes hardware going on the State’s network as well as the vendor’s network if the vendor’s network is accessing the State’s network or accessing State data. This includes Infrastructure as a Service, Platform as a Service or Software as a Service situations. Any company that is considered to be a security risk by the government of the United States under the International Emergency Economic Powers Act, in a United States appropriation bill, an Executive Order, or listed on the US Department of Commerce’s Entity List will be included in this ban.

If the vendor’s solution requires accounts allowing access to State systems, then the vendor must indicate the number of the vendor’s staff or subcontractors that will require access, the level of access needed, and if these accounts will be used for remote access. These individuals will be required to use Multi- Factor Authentication (MFA). The State’s costs in providing these accounts will be a consideration when assessing the cost of the offeror’s solution. If the vendor later requires accounts that exceed the number of accounts that was originally indicated, the costs of those accounts will be borne by the offeror and not passed onto the State. All State security policies can be found in the Information Technology Security Policy (ITSP) attached to this RFP. The offeror should review the State’s security policies regarding authorization, authentication, and, if relevant, remote access (See ITSP 230.67, 230.76, and 610.1). Use of Remote Access Devices (RAD) by contractors to access the State’s system must be requested when an account is requested. The vendor should be aware that access accounts given to non-state employees, Non-State (NS) accounts, will be disabled if not used within 90 days. A NS account will be deleted after Y days if it is not used.

The State, at its sole discretion, may consider a solution that does include all or any of these deliverables or consider deliverables not originally listed. A vendor must highlight any deliverable it does not meet and give any suggested “work-around” or future date that it will be able to provide the deliverable.

4.0 RESOURCES AND STATE ORGANIZATIONAL STRUCTURE

The Bureau of Information and Telecommunications (BIT) is the state organization that provides IT services for the state and will be part of the testing and security scans along with their own information technology review. However, will not play a role in routine development, creative process, or regular meetings between the State and the selected vendor.

4.1. DOC Team Organization:

• DOC Division Director of Finance & Administration –Brittni Skipper

• DOC Public Information Officer – Michael Winder – main POC with vendor project manager

• DOC Team Members o Michael Winder – content specialist, web manager, information officer, digital strategist o Bridget Coppersmith – data & planning analysis associate director, grants manager o Justin Winters – correctional industries manager o Danna Humig – contract compliance/RFP POC, business operations associate director o Nicole Gednalske – constituent services o Joy Ellefson – data systems manager

• DOC Internal Workgroup – TBD - program area experts, content creators and reviewers

5.0 FORMAT OF SUBMISSION

All proposals should be prepared simply and provide a direct, concise explanation of the Offeror’s proposal and qualifications. Offerors are required to provide an electronic copy of their response as previously mentioned. The offeror is cautioned that it is the offeror's sole responsibility to submit information related to the evaluation categories and that the State of South Dakota is under no obligation to solicit such information if it is not included with the proposal. The offeror's failure to submit such information may cause an adverse impact on the evaluation of the proposal. Offerors and their agents (including subcontractors, employees, consultants, or anyone else acting on their behalf) must direct all of their questions or comments regarding the RFP, the evaluation, etc. to Danna Humig. Inappropriate contacts are grounds for suspension and/or exclusion from specific procurements. Offerors and their agents who have questions regarding this matter should contact Danna.Humig@state.sd.us.

The offeror may be required to submit a copy of their most recent audited financial statements upon the State’s request. The proposal should be page numbered and should have an index and/or a table of contents referencing the appropriate page number.

Proposals should be prepared using the order of the following headings.

1. Understanding of Project

2. Deliverables/Goals

4. Project Plan and Detailed Timeline

5. Project Team Organizational Structure and Experience

a. Identify who will be the project manager working to ensure all deliverables of the contract are met.

6. Overall Project Cost Proposal

a. Outline each component as a line item to indicate the cost of each.

b. Note that cost will be considered as a factor in the decision-making process.

6.0 UNDERSTANDING OF PROJECT

To demonstrate your comprehension of the project, please summarize your understanding of what the work is and what the work will entail. This should include, but not be limited to your understanding of the purpose and scope of the project, critical success factors and potential problems related to the project and your understanding of the deliverables. Your specialized expertise, capabilities, and technical competence as demonstrated by the proposed approach and methodology to meet the project requirements should be included.

7.0 CORPORATE QUALIFICATIONS

Please provide responses to the each of the following questions in your proposal.

A. What year was your parent company (if applicable) established?

B. What is the business of your parent company?

C. What is the total number of employees in the parent company?

D. What are the total revenues of your parent company?

E. How many employees of your parent company have the skill set to support this effort?

F. How many of those employees are accessible to your organization for active support?

G. What year was your firm established?

H. Has your firm ever done business under a different name and if so what was the name?

I. How many employees does your firm have?

J. How many employees in your firm are involved in this type of project?

K. How many of those employees are involved in on-site project work?

L. What percent of your parent company’s revenue (if applicable), is produced by your firm?

M. Corporate resources available to perform the work, including any specialized services, within the specified time limits for the project N. Availability to the project locale O. Familiarity with the project locale P. Has your firm ever done business with other governmental agencies? If so, please provide references.

Q. Has your firm ever done business with the State of South Dakota? If so, please provide references.

R. Has your firm ever done projects that are like or similar to this project? If so, how many clients are using your solution? Please provide a list of four or more locations of the same approximant nature as the State where your application is in use along with contact names and numbers for those sites.

S. Provide third party security audits of the four projects you provided for R above (if applicable). The State will sign a non-disclosure statement, as needed, to receive these audits, within the limits of the State’s open records law. If there are no audits of these projects then provide, unedited and un-redacted results of such security testing/scanning from third-party companies and/or tools that has been run within the past 90 days. To protect proprietary or confidential information, the state will agree to non-disclosure of any information provided as a result of such a request as appropriate.

8.0 PROJECT PLAN AND TIMELINE

Provide a project plan that indicates how you will complete the required scope of work and project requirements and deliverables as outlined in section 3.0. See DOC proposed timeline and high-level expectations.

1. Proposed project management techniques and project manager identified

2. Number of Vendor staff needed

3. Tasks to be performed (within phase as applicable)

4. Deliverables created by each task

5. Dates by which each task will be completed

6. Resources assigned to each task

7. Required state agency support

8. Show task dependencies

9. Training (if applicable)

9.0 COST PROPOSAL

Include a cost proposal as part of the RFP submission. Please also note that cost will be considered as a factor in the decision-making process.

10.0 PROPOSAL EVALUATION AND AWARD PROCESS

After determining that a proposal satisfies the mandatory requirements stated in the Request for Proposal, the evaluator(s) shall use subjective judgment in conducting a comparative assessment of the proposal by considering each of the following criteria:

• Specialized expertise, capabilities, and technical competence as demonstrated by the proposed approach and methodology to meet the project requirements;

• Resources available to perform the work, including any specialized services, within the specified time limits for the project;

• Record of past performance, including price and cost data from previous projects, quality of work, ability to meet schedules, cost control, and contract administration;

• Availability and familiarity of project locale;

• Proposed project management techniques;

• Ability and proven history in handling special project constraints;

• Experience and reliability of the offeror's organization are considered subjectively in the evaluation process;

• The qualifications of the personnel proposed by the offeror to perform requirements of RFP;

• The State reserves the right to reject any or all proposals, waive technicalities, and make award(s) as deemed to be in the best interest of the State of South Dakota;

• The requesting agency and the highest ranked offeror shall mutually discuss and refine the scope of services for the project and shall negotiate terms, including compensation and performance schedule;

• If the agency and the highest ranked offeror are unable for any reason to negotiate a contract at a compensation level that is reasonable and fair to the agency, the agency shall, either orally or in writing, terminate negotiations with the contractor. The agency may then negotiate with the next highest ranked contractor; and

• The negotiation process may continue through successive offerors, according to agency ranking, until an agreement is reached, or the agency terminates the contracting process.

11.0 NON-STANDARD HARDARE AND SOFTWARE

State standard hardware and software should be utilized unless there is a reason not to. If your proposal will use non-standard hardware or software, you must first obtain State approval. If your proposal recommends using non-standard hardware or software, the proposal should very clearly indicate what non-standard hardware or software is being proposed and why it is necessary to use non-standard hardware or software to complete the project requirements. The use of non-standard hardware or software requires use of the State’s New Product Process. This process can be found through the Standards’ page and must be performed by State employees. The costs of such non-standard hardware or software should be reflected in your cost proposal. The work plan should also account for the time needed to complete the New Product Process. See https://bit.sd.gov/bit?id=bit_standards_overview, for lists of the State’s standards.