RFP DoIT OSM Cybersecurity Assessments and Services.pdf

STATE OF MARYLAND

DEPARTMENT OF INFORMATION TECHNOLOGY (DOIT)

REQUEST FOR PROPOSALS (RFP)

CYBERSECURITY ASSESSMENTS AND SERVICES

RFP NUMBER: F50B4600024

ISSUE DATE: 12/6/2023

NOTICE

A Prospective Offeror that has received this document from a source other than eMarylandMarketplace

(eMMA) https://procurement.maryland.gov should register on eMMA. See Section 4.2.

MINORITY BUSINESS ENTERPRISES ARE ENCOURAGED TO

RESPOND TO THIS SOLICITATION.

Cybersecurity Assessments and Services Solicitation #: F50B4600024 RFP Document

RFP for the Department of Information Technology Page 2 of 87

VENDOR FEEDBACK FORM

To help us improve the quality of State solicitations, and to make our procurement process more responsive and business friendly, please provide comments and suggestions regarding this solicitation.

Please return your comments with your response. If you have chosen not to respond to this solicitation, please email or fax this completed form to the attention of the Procurement Officer (see Key Information Summary Sheet below for contact information).

Title: Cybersecurity Assessments and Services Solicitation No: F50B4600024

1. If you have chosen not to respond to this solicitation, please indicate the reason(s) below:

� Other commitments preclude our participation at this time

� The subject of the solicitation is not something we ordinarily provide

� We are inexperienced in the work/commodities required

� Specifications are unclear, too restrictive, etc. (Explain in REMARKS section)

� The scope of work is beyond our present capacity

� Doing business with the State is simply too complicated. (Explain in REMARKS section)

� We cannot be competitive. (Explain in REMARKS section)

� Time allotted for completion of the Proposal is insufficient

� Start-up time is insufficient

� Bonding/Insurance requirements are restrictive (Explain in REMARKS section)

� Proposal requirements (other than specifications) are unreasonable or too risky (Explain in REMARKS section)

� MBE or VSBE requirements (Explain in REMARKS section)

� Prior State of Maryland contract experience was unprofitable or otherwise unsatisfactory.

(Explain in REMARKS section)

� Payment schedule too slow

� Other: __________________________________________________________________

2. If you have submitted a response to this solicitation, but wish to offer suggestions or express concerns, please use the REMARKS section below. (Attach additional pages as needed.)

REMARKS:

Vendor Name: ________________________________ Date: _______________________

Contact Person: _________________________________ Phone (____) _____ - _________________

Address: ______________________________________________________________________

E-mail Address: ________________________________________________________________

RFP for the Department of Information Technology Page 3 of 87

STATE OF MARYLAND

DEPARTMENT OF INFORMATION TECHNOLOGY (DOIT)

KEY INFORMATION SUMMARY SHEET

Request for Proposals Services – Cybersecurity Assessments and Services

Solicitation Number: F50B4600024

RFP Issue Date: 12/6/2023

RFP Issuing Office: Department of Information Technology (DoIT or the "Department")

Procurement Officer: Carla Thompson 100 Community Place, Crownsville, MD e-mail:

Office Phone:

Carla.thompson2@maryland.gov

(410) 697-9667

Proposals are to be sent to: Submit via eMMA

Pre-Proposal Conference: 12/20/2023 @ 10:00 AM Local Time Virtual Please complete Attachment A and send to the Procurement Officer to receive a virtual invitation.

Questions Due Date and Time 12/27/2023 @ 2:00 PM Local Time

Proposal Due (Closing) Date and Time:

01/19/2024 at 2:00 PM Local Time Offerors are reminded that a completed Feedback Form is requested if a no-bid decision is made (see page iv).

Financial Proposal:

1. (Categories 1-3) After the conclusion of the Technical Evaluation, at the time and date to be stated by the Procurement Officer.

(Category 4) Key Personnel Labor Categories

MBE Subcontracting Goal: 20%, with no subgoals

VSBE Subcontracting Goal: 0%

Contract Type: Fixed Price (COMAR 21.06.03.02) / Indefinite Delivery Indefinite Quantity (IDIQ) (COMAR 21.06.03.06)

Contract Duration: Four (4) Year base period, with Two (2), Two (2) Year option periods

Primary Place of Performance:

The Contractor’s Location and possibly at various locations throughout the State of Maryland

SBR Designation: No

Federal Funding: No mailto:Carla.thompson2@maryland.gov

RFP for the Department of Information Technology Page 4 of 87

TABLE OF CONTENTS – RFP

1 Minimum Qualifications

1.1 Offeror Minimum Qualifications

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.2 Background, Purpose, and Goals

2.3 Responsibilities and Tasks

2.4 Deliverables

2.5 Service Level Agreement (SLA)

3 Contractor Requirements: General

3.1 Contract Type

3.2 Contract Initiation Requirements

3.3 End of Contract Transition

3.4 Invoicing

3.5 Liquidated Damages

3.6 Disaster Recovery and Data

3.7 Insurance Requirements

3.8 Security Requirements

3.9 Problem Escalation Procedure

3.10 SOC 2 Type 2 Audit Report

3.11 Experience and Personnel

3.12 Substitution of Personnel

3.13 Minority Business Enterprise (MBE) Reports

3.14 Veteran Small Business Enterprise (VSBE) Reports

3.15 Work Orders

3.16 Additional Clauses

4 Procurement Instructions

4.1 Pre-Proposal Conference

4.2 eMaryland Marketplace Advantage (eMMA)

4.3 Questions

4.4 Procurement Method

4.5 Proposal Due (Closing) Date and Time

RFP for the Department of Information Technology Page 5 of 87

4.6 Multiple or Alternate Proposals

4.7 Economy of Preparation

4.8 Public Information Act Notice

4.9 Award Basis

4.10 Oral Presentation

4.11 Duration of Proposal

4.12 Revisions to the RFP

4.13 Cancellations

4.14 Incurred Expenses

4.15 Protest/Disputes

4.16 Offeror Responsibilities

4.17 Acceptance of Terms and Conditions

4.18 Proposal Affidavit

4.19 Contract Affidavit

4.20 Compliance with Laws/Arrearages

4.21 Verification of Registration and Tax Payment

4.22 False Statements

4.23 Payments by Electronic Funds Transfer

4.24 Prompt Payment Policy

4.25 Electronic Procurements Authorized

4.26 MBE Participation Goal

4.27 VSBE Goal

4.28 Living Wage Requirements

4.29 Federal Funding Acknowledgement

4.30 Conflict of Interest Affidavit and Disclosure

4.31 Non-Disclosure Agreement

4.32 HIPAA - Business Associate Agreement

4.33 Nonvisual Access

4.34 Mercury and Products That Contain Mercury

4.35 Location of the Performance of Services Disclosure

4.36 Department of Human Services (DHS) Hiring Agreement

4.37 Small Business Reserve (SBR) Procurement

4.38 Maryland Healthy Working Families Act Requirements

5 Proposal Format

RFP for the Department of Information Technology Page 6 of 87

5.1 Two Part Submission

5.2 Proposal Delivery and Packaging

5.3 Volume I - Technical Proposal

5.4 Volume II – Financial Proposal

6 Evaluation and Selection Process

6.1 Evaluation Committee

6.2 Technical Proposal Evaluation Criteria

6.3 Financial Proposal Evaluation Criteria

6.4 Reciprocal Preference

6.5 Selection Procedures

6.6 Documents Required upon Notice of Recommendation for Contract Award

7 RFP ATTACHMENTS AND APPENDICES

Attachment A. Pre-Proposal Conference Response Form

Attachment B. Financial Proposal Instructions & Form

Attachment C. Proposal Affidavit

Attachment D. Minority Business Enterprise (MBE) Forms

Attachment E. Veteran-Owned Small Business Enterprise (VSBE) Forms

Attachment F. Maryland Living Wage Affidavit of Agreement for Service Contracts

Attachment G. Federal Funds Attachments

Attachment H. Conflict of Interest Affidavit and Disclosure

Attachment I. Non-Disclosure Agreement (Contractor)

Attachment J. HIPAA Business Associate Agreement

Attachment K. Mercury Affidavit

Attachment L. Location of the Performance of Services Disclosure

Attachment M. Contract

Attachment N. Contract Affidavit

Attachment O. DHS Hiring Agreement

Appendix 1. – Abbreviations and Definitions

RFP for the Department of Information Technology Page 7 of 87

Appendix 2. – Offeror Information Sheet

RFP for the Department of Information Technology Page 8 of 87

1 Minimum Qualifications

1.1 Offeror Minimum Qualifications

As part of the determination to be considered reasonably susceptible of being selected for award, the Offeror must document in its Proposal that, within the last seven (7) years, the following Minimum Qualifications have been met:

1.1.1 The Offeror for “CATEGORY 1: Cybersecurity Assessments” shall have five (5) years of experience performing concurrent cybersecurity assessments.

Required Documentation: The Offeror shall provide with its Proposal three or more references from the past five years that can collectively attest to the Offeror’s satisfaction of the requirement. In addition, the Offeror shall provide examples of completed assessments.

1.1.2 The Offeror for “CATEGORY 2: Adversary Emulation Program Development and Execution” shall have five (5) years of experience developing adversary emulation programs, performing purple-teaming using breach and attack simulation platforms, and executing external and internal penetration testing.

Required Documentation: The Offeror shall provide with its Proposal three or more references from the past five years that can collectively attest to the Offeror’s satisfaction of the requirement. In addition, the Offeror shall provide examples of completed purple-teaming engagement reports, external penetration testing reports, and internal penetration testing reports.

1.1.3 The Offeror for “CATEGORY 3: Authorization to Operate (ATO) Program Implementation” shall have five (5) years of experience developing an Authorization to Operate (ATO) program and performing system ATOs for a government organization.

Required Documentation: The Offeror shall provide with its Proposal three or more references from the past five years that can collectively attest to the Offeror’s satisfaction of the requirement. In addition, the Offeror shall provide examples of ATO frameworks and policies, ATO processes and procedures, and ATO documentation aligned to the NIST Risk Management Framework. The Offeror shall provide an example of a how they executed every step of an ATO aligned with the NIST Risk Management Framework using an ATO application or platform for the management of control attestation, documentation, findings, issues, and risks (e.g., ServiceNow IRM Pro CAM).

1.1.4 The Offeror for “CATEGORY 4: Cybersecurity Architecture, Engineering, and Program Services” shall have five (5) years of experience performing cybersecurity architecture, design, integration, engineering, administration, and program management services for IT and cybersecurity systems and networks.

Required Documentation: The Offeror shall provide with its Proposal three or more references from the past five years that can collectively attest to the Offeror’s satisfaction of the requirement. Offeror shall provide resumes of at least three (3) personnel on staff with either a Certified Information Security System Professional-Information Systems Security Architecture Professional (CISSP-ISSAP), and/or a Certified Information Security Systems Professional Information Security System Engineering Professional (CISSP- ISSEP).

Note: Documentation required above may be redacted to protect confidential information.

RFP for the Department of Information Technology Page 9 of 87

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.1.1 The Maryland Department of Information Technology (“DoIT” or the "Department") is issuing this Request for Proposals (RFP) in order to procure a variety of cybersecurity services which include cybersecurity assessment, penetration testing, authorization to operate, and architecture, engineering, and program services. The Contracts awarded as a result of this solicitation will provide the State with the flexible means of obtaining the required services quickly and efficiently through the issuance of Work Orders specific to its needs.

2.1.2 It is the State’s intention to obtain goods and services, as specified in this RFP, from a Contract between the selected Offeror(s) and the State.

2.1.3 DoIT intends to award a contract to no more than one (1) Contractor per category in categories one (1) through three (3) and to award a contract to up to three (3) Contractors in Category 4 for up to a total of six (6) awards. See RFP Section 4.9 Award Basis for more Contract award information. Offerors may propose to, and be awarded in, multiple categories, however, an award to Category 4 will preclude an Offeror from being awarded in any other Category. In Category 4, DoIT may, but is not obligated to, utilize a right of refusal work order process to provide services on an on-going as needed basis.

2.1.4 An Offeror must be able to meet the requirements of the proposed Category(ies) identified in the solicitation to which it is proposing, and the successful Offeror(s) (each a “Contractor”) shall remain responsible for Contract performance regardless of subcontractor participation in the work.

2.1.5 The Contract applies exclusively to all entities to which Subtitle 3 of Title 3A of the State Finance and Procurement Article is applicable pursuant to Section 3A-302 of the State Finance and Procurement Article.

2.1.6 A Contract award does not ensure a Contractor will receive all or any State business under the Contract.

2.1.7 Maryland State and local entities as defined in State Finance and Procurement Article, § 13- 110(a)(5)(i) and not-for-profit entities within the State of Maryland may purchase from the Contractor goods or services covered by the Contract at the same prices chargeable to the State.

All such purchases by non-executive branch entities, non-State governments, government agencies or not-for-profit entities:

A. Shall constitute Contracts between the Contractor and that government, agency or not-for-profit entity;

B. Shall not constitute purchases by the State or State agencies under the Contract;

C. Shall not be binding or enforceable against the State; and

D. May be subject to other terms and conditions agreed to by the Contractor and the purchaser.

2.1.8 All Contract prices, terms, and conditions must be provided to any Maryland local government or not-for-profit entity requesting services under the Contract. The Contractor bears the risk of determining whether or not a government, agency, or organization with which the Contractor is dealing is a State entity.

RFP for the Department of Information Technology Page 10 of 87

2.2 Background, Purpose, and Goals

2.2.1 Project Goals

A. One of Maryland’s top priorities is the protection of the Confidentiality, Integrity, and Availability (CIA) of State systems and data through the implementation of a defense-in-depth, zero-trust strategy that ensures the efficacy of cybersecurity processes, technologies, controls, and staffing. DoIT looks to satisfy four (4) specific goals:

1. Complete cybersecurity maturity assessments aligned with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) as required by State law,

2. Improve cyber readiness, defense, controls implementation, incident response, and vulnerability mitigation by conducting attack emulations, purple teaming, external penetration tests, and internal penetration tests,

3. Establish an Authorization to Operate (ATO) program and execute ATOs that follow National Institute of Standards and Technology Risk Management Framework (NIST RMF) and align to State policies, and

4. Improve the security and hardening of State networks and systems through engineering, architecture, and administrative/program services in order to implement technical configurations, integrations, and remediations.

B. DoIT also requires an established IT services provider to assist in the remediation of identified vulnerabilities and risks.

C. The services under this contract will also support the development of new and enhanced cybersecurity services.

2.2.2 State Staff and Roles

In addition to the Procurement Officer and Contract Monitor, the State will designate a State Project Manager who will be responsible for overseeing, directing, and prioritizing work. The State Project Manager will also monitor performance, review, and accept Work Orders and invoices.

2.2.3 Other State Responsibilities

A. The State will provide normal office working facilities and equipment reasonably necessary for Contractor performance under the Contract.

B. The State is responsible for providing required information, data, documentation, and test data to facilitate the Contractor’s performance of the work.

2.3 Responsibilities and Tasks

2.3.1 The State has divided the scope of work under this Contract into four (4) Categories.

Specific scopes of work will be provided and outlined in individual Work Orders. An Offeror awarded a Contract under Category 4 will be excluded from being awarded a Contract under Categories 1-3. CATEGORY #1: Cybersecurity Assessments

A. The Contractor shall conduct approximately seventy (70) cybersecurity assessments of units of State government within a twelve (12) month period. The purpose is to determine the overall security posture and maturity of each unit assessed.

B. The Contractor shall provide experienced personnel capable of conducting cybersecurity assessments to determine an organization’s cybersecurity maturity.

RFP for the Department of Information Technology Page 11 of 87

C. The Contractor shall independently scope each assessment, conduct interviews, assess documentation, rate functional area maturity levels, and present results, finding, and recommended remediations that emerge from each assessment. This includes, but is not limited to, security maturity assessment closeout meetings with each agency/unit of government.

D. All assessments shall be performed using a standardized assessment framework using a combination of staff/personnel interviews, workbooks, reports, and closeout presentations.

Cybersecurity assessments conducted by the Contractor shall use the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) controls and standards to assess organizational maturity. Cybersecurity assessments may be expanded to include controls in NIST 800-53 and NIST 800-171. Controls shall be scored using Capability Maturity Model Integration (CMMI) rating definitions: 0 – Non-Existent, 1-Performed, 2- Managed, 3-Defined, 4-Measured, and 5-Optimized. The Contractor shall update the cybersecurity assessment template if assessment requirements or control frameworks change.

E. The Contractor shall leverage the State’s Governance, Risk, and Compliance (GRC) platform to create and execute the assessments, track agency responses, report progress and key metrics, create real-time dashboards, identify risks, identify issues, and track agency issue response.

F. The Contractor shall develop and maintain real-time reporting dashboards. The data shall be capable of being imported into the State’s GRC platform. The reporting system shall display the following dashboards using cybersecurity assessment data at an aggregated (e.g., statewide) and disaggregated (e.g., agency-level) level:

1. Top control categories by maturity;

2. Most common constraints;

3. Top recommended areas of improvement;

4. Maturity levels across based on CMMI scoring (0-5) across all five areas (identify, protect, detect, respond, recover)

5. Top findings, top risks, and top issues, and issue response by agency.

G. All dashboards shall allow drill-down into underlying data. Dashboard filters for data disaggregation shall include: executive agencies (yes/no), employee size, DoIT enterprise agencies (yes/no), effort level, IT complexity, Maturity Group.

H. Agency-level dashboards shall display average maturity rating score by NIST CSF area (Protect, Respond, Recover, Detect, and Identify) using side-by-side bar chart comparison to statewide averages. Maturity level averages by CSF categories must also be displayed and compared to statewide averages (e.g., Communications, Maintenance, Access Control, etc.).

Agency level dashboards shall include recommended areas of improvement, top 10 findings, and percent completion of issues identified.

I. Comparison dashboards based on selecting one or more agencies shall create comparisons across ratings metrics for NIST CSF areas and categories.

J. The Contractor shall integrate previous NIST CSF assessment data from prior years to show year-over-year performance.

RFP for the Department of Information Technology Page 12 of 87

K. The Contractor shall enable agencies to leverage the ServiceNow GRC platform to provide a Plan of Action and Milestones (POAM) in response to a specific cybersecurity assessment once completed.

L. The Contractor shall use a summary of agency NIST assessment results to identify statewide remediation priorities and develop a statewide roadmap and strategies to improve the state’s overall security posture.

2.3.2 CATEGORY #2: Adversary Emulation Program Development and Execution

Adversary Emulation Program Development (Purple-Teaming)

A. The Contractor shall develop and execute a statewide Adversary Emulation Program (AEP) to prevent and detect cybersecurity breaches by developing a program framework, implementing enterprise-level, realistic Purple Team attack and defense engagements, and impersonating the actions and behaviors of skilled cyber threat actors or Advanced Persistent Threats (APTs) attacking a state government enterprise network.

B. The Contractor’s AEP Purple Team engagements shall use Cyber Threat Intelligence, TTPs related to government organizations, and integration of a Red Team (offensive penetration testers) and Blue Team (network defenders). The Contractor’s red team should work closely with the blue team throughout the engagement to test various tools, techniques, procedures, attack scenarios, and attack chains.

C. Each AEP Purple Team engagement shall include:

1. exercise scoping,

2. development of the exercise,

3. execution of threat emulations,

4. validation and improvement of detection capabilities, and

5. remediation of findings to close security defense gaps.

D. The Contractor’s Red Teams shall leverage custom and/or existing tools including but not limited to custom payloads, installed endpoint agents, Breach and Attack Simulation (BAS) platforms, Cyberthreat Intelligence (CTI) platforms, and Attack Surface Management (ASM) solutions.

E. The Contractor shall use the MITRE ATT&CK framework, Cyber Kill Chain, Vulnerability Assessments, and Risk Assessments to successfully execute attacks and automatically validate security controls.

F. The Contractor shall work with the Blue Team network defenders to actively improve detection and response capabilities, providing incident response analysis, control improvement recommendations, logging, and monitoring improvement, and other remediations to improve Security Operations efficacy and the organizational security posture.

G. The Contractor shall provide a findings and remediation report that can be integrated into the State’s ServiceNow IRM/GRC platform to generate issues and risks for agencies. The Contractor shall use an agency’s NIST CSF assessment, if available, to validate control ratings.

H. The Contractor shall provide a post-engagement report with risk-based recommendations and roadmaps for each adversary emulation engagement.

RFP for the Department of Information Technology Page 13 of 87

Internal and External Penetration Testing

A. The Contractor shall conduct Internal Penetration Testing focusing on testing attacks that could be carried out by an adversary who has already gained a foothold within an enterprise network and seeks to elevate privileges, maintain persistence, and move laterally. Internal Penetration Tests shall be conducted on-site and under the supervision of the unit’s security team to ensure proper detection and response mechanisms are in place.

B. The Contractor shall conduct External Penetration Testing of publicly accessible web applications, including both websites and APIs, and a remote organizational penetration test to identify potential weaknesses in organizational boundaries. Tests should be conducted using automated tools and manual tests.

C. The Contractor shall provide the following deliverables for each penetration test:

1. Scoping Questionnaire

2. Pre-engagement meeting

3. Project plan including rules of engagement, scope, assumptions and limitations, risks, continuation/termination conditions, points of contact, test schedule,

4. Engagement summary reports during discovery, reconnaissance, attack, and execution phases, detailing all discovered vulnerabilities discovered through the analysis period

5. Spot reports outlining any significant vulnerabilities discovered

6. Executive report and presentation for each client

7. Post-engagement final report detailing all vulnerabilities and security issues identified, including recommended remediation

8. Debriefing

9. Retesting as requested for specific findings

D. The Contractor shall follow a known framework for penetration testing such as OWASP, OSSTMM, PTES, ISSAF, or NIST.

E. The Contractor shall aggregate all findings for each agency tested including the following attributes: domain, IP, severity, vulnerability name, vulnerability type, vulnerability description, impact, exploited (yes/no), remediation, remediation level of effort, remediation status.

F. The Contractor shall use a summary of Adversary Emulation Program findings and Penetration test findings to develop a statewide roadmap and strategies to address critical, high-risk issues, tactical quick wins, near-term development, and long-term maturity.

2.3.3 CATEGORY #3: Authorization to Operate (ATO) Program Implementation

A. The Contractor shall develop and implement an ATO Program, including all policies, processes, procedures, guides, standards, and plans, that align with the NIST Risk Management Framework (RMF).

B. The Contractor shall develop the state’s ServiceNow IRM Continuous Authorization and Monitoring (CAM) system to document and develop an ATO process that allows for each step of the ATO process to be completed, including system categorization, control selection, control implementation, control assessment, system authorization, and system monitoring.

C. The Contractor shall develop a process for issuing interim ATOs if required.

RFP for the Department of Information Technology Page 14 of 87

D. The Contractor shall provide training to State employees for conducting ATOs as requested by the State.

E. The Contractor shall fully manage the ATO process including development and control implementation, within the ServiceNow Integrated Risk Management (IRM) Pro Continuous Authorization and Monitoring (CAM) solution.

2.3.4 CATEGORY #4: Cybersecurity Architecture, Engineering, and Program Services

A. Architecture & Design

1. The Contractor shall provide security architecture and design services for enterprise systems development, security service implementation, and remediation efforts.

Architecture and design services includes but is not limited to the creation of current-and future-state network topology diagrams, network segmentation diagrams, network architecture diagrams, physical and logical network topologies, data flow diagrams, and high-level enterprise architecture diagrams.

2. The Contractor shall review proposed network and system architecture plans to ensure proper system integration and system security, including design plans for the following:

LANs, WANs, VoIP Networks, Identity and Access Management systems, Mobile Device Management systems, VMWare systems, AWS cloud-based systems, Disaster Recovery backup systems, etc.

B. Integration, Engineering, Administration, and Program Management

1. The Contractor shall provide systems integration, engineering, administration, and program management for enterprise IT and security systems (e.g., Microsoft 365, Google Workspace, ServiceNow, Palo Alto Firewalls, etc.)

2. The Contractor shall integrate new security solutions into existing technology infrastructure to ensure systems and data are protected from cyber-attacks, breaches, and threats.

3. The Contractor shall assess and mitigate security risks, vulnerabilities, and configuration issues of current endpoints, systems, and networks by proposing and implementing new solutions, controls, and configurations, including the hardening of endpoints, systems, and networks.

4. The Contractor shall conduct testing and evaluations to ensure the efficacy of new solutions.

5. The Contractor shall provide documentation, training, and guidance to ensure new solutions are successfully adopted and transferred to operations and maintenance by current DoIT staff.

6. The Contractor shall perform system health checks for enterprise systems (e.g., Microsoft Azure AD, Google Workspace, ServiceNow) and compile reports for recommended risk-based remediation.

2.3.5 Contractor-Supplied Hardware, Software, and Materials

A. By responding to this RFP and accepting a Contract award, the Offeror specifically agrees that for any software, hardware, or hosting service that it proposes, the State will have the right to purchase such item(s) from another source, instead of from the selected Offeror(s).

RFP for the Department of Information Technology Page 15 of 87

B. SaaS applications provided to the State shall be accessible from various client devices through a thin client interface such as a Web browser (e.g., Web-based email) or a program interface.

C. The Contractor is responsible for the acquisition and operation of all hardware, software and network support related to the services being provided and shall keep all software current.

D. All Upgrades and regulatory updates shall be provided at no additional cost.

E. The State requires that the Offeror price individual software modules separately.

F. The State also requires that the Offeror provide fully functional, generally available software and multiple-user licenses for purchase as needed throughout the life of the Contract.

G. The Offeror shall install and provide all documentation for the software furnished under the Contract.

H. Hardware and software costs procured as part of the RFP cannot exceed 49 percent of the total Contract value.

I. Material costs shall be passed through with no mark-up by the Contractor.

2.3.6 Required Project Policies, Guidelines and Methodologies

The Contractor shall be required to comply with all applicable laws, regulations, policies, standards, and guidelines affecting Information Technology projects, which may be created or changed periodically. Offeror is required to review all applicable links provided below and state compliance in its response.

It is the responsibility of the Contractor to ensure adherence and to remain abreast of new or revised laws, regulations, policies, standards, and guidelines affecting project execution. These include, but are not limited to:

A. The State of Maryland System Development Life Cycle (SDLC) methodology at:

http://doit.maryland.gov/SDLC/Pages/agile-sdlc.aspx;

B. The State of Maryland Information Technology Security Policy and Standards at:

https://doit.maryland.gov/cybersecurity/Pages/policies-and-guidance.aspx;

C. The State of Maryland Information Technology Non-Visual Standards at:

https://doit.maryland.gov/policies/Pages/ContractPolicies.aspx;

2.3.7 Product Requirements

A. Offerors may propose software; however, the Offeror must provide operational support for the proposed software as part of its Proposal.

B. Offeror shall be authorized to furnish the proposed goods and services. Offerors proposing to resell services of another entity must be authorized by the other entity.

C. No international processing for State Data: As described in Section 3.7 Security Requirements, Offerors are advised that any processing or storage of data outside of the continental U.S. is prohibited.

D. Offeror consistent expiration dates: A PO for a service already being delivered to the Department under the Contract shall terminate on the same calendar day as the prior product/service. As appropriate, charges shall be pro-rated.

https://doit.maryland.gov/cybersecurity/Pages/policies-and-guidance.aspx https://doit.maryland.gov/policies/Pages/ContractPolicies.aspx

RFP for the Department of Information Technology Page 16 of 87

E. Any Contract award is contingent on the State’s agreement, during the Proposal evaluation process, to any applicable terms of use and any other agreement submitted.

Such agreed upon terms of use shall apply consistently across services ordered under the Contract.

F. The Contractor shall not establish any auto-renewal of services beyond the period identified in the Contract documents.

G. In addition to any notices of renewal sent to the Department, Contractors shall email notices of renewal to the e-mail address designated by the Contract Monitor.

2.4 Deliverables

2.4.1 Deliverable Submission

Specific deliverables will be provided and outlined in individual Work Orders.

2.5 Service Level Agreement (SLA)

THIS SECTION IS INAPPLICABLE TO THIS RFP.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

RFP for the Department of Information Technology Page 17 of 87

3 Contractor Requirements: General

3.1 Contract Type

The Contract(s) shall be Fixed Price and Indefinite Quantity Contract as defined in COMAR

21.06.03.02 and 21.06.03.06. Indefinite Quantity Contract as defined in COMAR 21.06.03.02

21.06.03.06. Fixed Price or Labor Hour Work Order awards (RFP §3.16 will be issued hereunder, as appropriate to the type of services being requested. The labor hour rates in the Financial Proposal provided by the Contractor(s) in response to this RFP establish the maximum rates allowable under any issued Work Order; when providing a response to a Work Order, a Contractor may propose rates lower than those submitted in its Financial Proposal. All rates proposed are fully burdened and inclusive of any travel expenses.

3.2 Contract Initiation Requirements

A. Contractor shall schedule and hold a kickoff meeting within 10 Business Days of NTP Date.

The Contractor shall introduce all key personnel who will be working with the State throughout the duration of the Contract. The Contractor shall furnish the required documentation within 5 days of the kickoff meeting.

3.3 End of Contract Transition

1.3.1 The Contractor shall provide transition assistance as requested by the State to facilitate the orderly transfer of services during the 60-day period prior to Contract end date, or the earlier termination thereof. Such transition efforts shall consist, not by way of limitation, of:

a) Provide additional services and support as requested to successfully complete the transition;

b) Maintain the services called for by the Contract at the required level of proficiency;

c) Provide updated System Documentation (see Appendix 1), as appropriate; and

d) Provide documentation of current operating procedures (as appropriate).

1.3.2 The Contractor shall work toward a prompt and timely transition, proceeding in accordance with the directions of the Contract Monitor. The Contract Monitor may provide the Contractor with additional instructions to meet specific transition requirements prior to the end of the Contract.

1.3.3 The Contractor shall ensure that all necessary knowledge and materials for the tasks completed are transferred to the custody of State personnel or a third party, as directed by the Contract Monitor.

1.3.4 The Contractor shall support end-of-Contract transition efforts with technical and project support to include but not be limited to:

a) The Contractor shall provide a draft Transition-Out Plan 120 Business Days in advance of the Contract end date that addresses, at a minimum, the following areas:

1) Any staffing concerns/issues related to the closeout of the Contract;

RFP for the Department of Information Technology Page 18 of 87

2) Communications and reporting process between the Contractor, the State and the Contract Monitor;

3) Security and system access review and closeout;

4) Any hardware/software inventory or licensing including transfer of any point of contact for required software licenses to the State or a designee;

5) Any final training/orientation of State staff;

6) Connectivity services provided, activities and approximate timelines required for Transition-Out;

7) Knowledge transfer, to include:

a) A working knowledge of the current system environments;

b) Review with the State the procedures and practices that support the business process and current system environments;

c) Working knowledge of all technical and functional matters associated with the solution, its architecture, data file structure, interfaces, any batch programs, and any hardware or software tools utilized in the performance of the Contract;

d) Documentation that lists and describes all hardware and software tools utilized in the performance of the Contract;

8) Plans to complete tasks and any unfinished work items (including open change requests, and known bug/issues); and

9) Any risk factors with the timing and the Transition-Out schedule and transition process. The Contractor shall document any risk factors and suggested solutions.

10) The Contractor shall ensure all documentation and data including, but not limited to, System Documentation and current operating procedures, is current and complete in a format prescribed by the Contract Monitor.

11) The Contractor shall provide copies of any current daily and weekly back-ups to the State, or a third party as directed by the Contract Monitor as of the final date of transition, but no later than the final date of the Contract.

12) Access to any data or configurations of the furnished product and services shall be available after the expiration of the Contract as provided for herein.

3.3.1 Return and Maintenance of State Data

A. Upon termination or the expiration of the Contract Term, the Contractor shall: (a) return to the State all State data in either the form it was provided to the Contractor or in a mutually agreed format along with the schema necessary to read such data; (b) preserve, maintain, and protect all State data until the earlier of a direction by the State to delete such data or the expiration of 90 days (“the retention period”) from the date of termination or expiration of the

RFP for the Department of Information Technology Page 19 of 87

Contract term; (c) after the retention period, the Contractor shall securely dispose of and permanently delete all State data in all of its forms, such as disk, CD/DVD, backup tape and paper such that it is not recoverable, according to National Institute of Standards and Technology (NIST)-approved methods with certificates of destruction to be provided to the State; and (d) prepare an accurate accounting from which the State may reconcile all outstanding accounts. The final monthly invoice for the services provided hereunder shall include all charges for the 90-day data retention period.

B. During any period of service suspension, the Contractor shall maintain all State data in its then existing form, unless otherwise directed in writing by the Contract Monitor.

C. In addition to the foregoing, the State shall be entitled to any post-termination/expiration assistance generally made available by Contractor with respect to the services.

3.4 Invoicing

3.4.1 General

A. The Contractor shall e-mail the original of each invoice to the Contract Monitor and Karen Poplewski at e-mail address: karen.poplewski@maryland.gov, with a cc to DoIT Fiscal Invoice Service at email address: doitfiscal.invoiceservice@maryland.gov.

B. All invoices for services shall be verified by the Contractor as accurate at the time of submission.

C. An invoice not satisfying the requirements of a Proper Invoice (as defined in COMAR

21.06.09.01 and .02) cannot be processed for payment. To be considered a Proper Invoice, invoices must include the following information, without error:

1. Contractor name and address;

2. Remittance address;

3. Federal taxpayer identification (FEIN) number, social security number, as appropriate;

4. Invoice period (i.e., time period during which services covered by invoice were performed);

5. Invoice date;

6. Invoice number;

7. State assigned Contract number;

8. State assigned (Blanket) Purchase Order number(s);

9. Goods or services provided;

10. Amount due; and

11. Any additional documentation required by regulation or the Contract.

D. Invoices that contain both fixed price and labor hours shall clearly identify each item as either fixed price or labor billing.

E. The Department reserves the right to reduce or withhold Contract payment in the event the Contractor does not provide the Department with all required deliverables within the time frame specified in the Contract or otherwise breaches the terms and conditions of the mailto:karen.poplewski@maryland.gov mailto:doitfiscal.invoiceservice@maryland.gov

RFP for the Department of Information Technology Page 20 of 87

Contract until such time as the Contractor brings itself into full compliance with the Contract.

F. Any action on the part of the Department, or dispute of action by the Contractor, shall be in accordance with the provisions of Md. Code Ann., State Finance and Procurement Article §§ 15-215 through 15-223 and with COMAR 21.10.04.

G. The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of Columbia sales taxes and transportation taxes. The Contractor; however, is not exempt from such sales and use taxes and may be liable for the same.

H. Invoices for final payment shall be clearly marked as “FINAL” and submitted when all work requirements have been completed and no further charges are to be incurred under the Contract. In no event shall any invoice be submitted later than 60 calendar days from the Contract termination date.

3.4.2 Invoice Submission Schedule

The Contractor shall submit invoices in accordance with the following schedule:

A. For items of work for which there is one-time pricing, e.g., deliverables, (see Attachment B – Financial Proposal Form) those items shall be billed in the month following the acceptance of the work by the Department.

B. For items of work for which there is annual pricing, see Attachment B– Financial Proposal Form, those items shall be billed in equal monthly installments for the applicable Contract year in the month following the performance of the services.

C. For work performed on a labor hour basis, the Contractor shall submit invoices no later than the fifteenth of the month following the month in which the hours were worked.

3.4.3 Deliverable Invoicing

A. Deliverable invoices shall be accompanied by notice(s) of acceptance issued by the State for all invoices submitted for payment. Payment of invoices will be withheld if a signed DPAF is not submitted (see online example at http://doit.maryland.gov/contracts/Documents/_procurementForms/DeliverableProductA cceptanceForm-DPAFsample.pdf).

B. Payment for deliverables will only be made upon completion and acceptance of the deliverables as defined in Section 2.4.

3.4.4 Labor Hour Invoicing

A. All labor hour invoices shall be accompanied by a signed timesheet as described below and notice(s) of acceptance issued by the State: DPAF for each time period invoiced (see online example at http://doit.maryland.gov/contracts/Documents/_procurementForms/DeliverableProductA cceptanceForm-DPAFsample.pdf). Include for each person covered by the invoice the following, individually listed per person: name, hours worked, hourly labor rate, invoice amount and a copy of each person’s timesheet for the period signed by the Contract Monitor.

B. Time Sheet Reporting

RFP for the Department of Information Technology Page 21 of 87

Within three (3) Business Days after the 15th and last day of the month, the Contractor shall submit a monthly timesheet for the preceding month providing data for all resources provided under the Contract.

At a minimum, each monthly timesheet shall show:

1) Title: “Time Sheet for <<xxxxx>>”;

2) Issuing company name, address, and telephone number;

3) For each employee /resource:

i. Employee / resource name, and

ii. For each Period ending date, e.g., “Period Ending: mm/dd/yyyy” (Periods run 1st through 15th, and 16th through last day of the month.):

1. Tasks completed that week and the associated deliverable names and ID#s;

2. Number of hours worked each day;

3. Total number of hours worked that Period;

4. Balance of hours remaining;

4) Annual variance to date (Sum of periodic variances); and

5) Signature and date lines for the Contract Monitor.

3.4.5 For the purposes of the Contract an amount will not be deemed due and payable if:

A. The amount invoiced is inconsistent with the Contract;

B. The proper invoice has not been received by the party or office specified in the Contract;

C. The invoice or performance is in dispute, or the Contractor has failed to otherwise comply with the provisions of the Contract;

D. The item or services have not been accepted;

E. The quantity of items delivered is less than the quantity ordered;

F. The items or services do not meet the quality requirements of the Contract;

G. If the Contract provides for progress payments, the proper invoice for the progress payment has not been submitted pursuant to the schedule;

H. If the Contract provides for withholding a retainage and the invoice is for the retainage, all stipulated conditions for release of the retainage have not been met; or

I. The Contractor has not submitted satisfactory documentation or other evidence reasonably required by the Procurement Officer or by the Contract concerning performance under the Contract and compliance with its provisions.

3.4.6 Travel Reimbursement

Travel will not be reimbursed under this RFP.

RFP for the Department of Information Technology Page 22 of 87

3.5 Liquidated Damages

3.5.1 MBE Liquidated Damages

MBE liquidated damages are identified in Attachment M.

3.5.2 Liquidated Damages other than MBE

3.6 Disaster Recovery and Data

3.6.1 Data Export/Import

A. The Contractor shall, at no additional cost or charge to the State, in an industry standard/non-proprietary format:

1. Perform a full or partial import/export of State data within 24 hours of a request; or

2. Provide the State the ability to import/export data at will and provide the State with any access and instructions which are needed for the State to import or export data.

B. Any import or export shall be in a secure format per the Security Requirements.

3.6.2 Data Ownership and Access

A. Data, databases, and derived data products created, collected, manipulated, or directly purchased as part of the RFP are the property of the State. The purchasing State agency is considered the custodian of the data and shall determine the use, access, distribution, and other conditions based on appropriate State statutes and regulations.

B. Public jurisdiction user accounts and public jurisdiction data shall not be accessed, except

(1) in the course of data center operations, (2) in response to service or technical issues,

(3) as required by the express terms of the Contract, including as necessary to perform the services hereunder or (4) at the State’s written request.

C. The Contractor shall limit access to and possession of State data to only Contractor Personnel whose responsibilities reasonably require such access or possession and shall train such Contractor Personnel on the confidentiality obligations set forth herein.

D. At no time shall any data or processes – that either belong to or are intended for the use of the State or its officers, agents, or employees – be copied, disclosed, or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the State.

E. The Contractor shall not use any information collected in connection with the services furnished under the Contract for any purpose other than fulfilling such services.

3.6.3 Provisions in Sections 3.5.1 – 3.5.3 shall survive expiration or termination of the Contract.

Additionally, the Contractor shall flow down the provisions of Sections 3.5.1-3.5.3 (or the substance thereof) in all subcontracts.

RFP for the Department of Information Technology Page 23 of 87

3.7 Insurance Requirements

The Contractor shall maintain, at a minimum, the insurance coverages outlined below, or any minimum requirements established by law if higher, for the duration of the Contract, including option periods, if exercised:

3.7.1 The following type(s) of insurance and minimum amount(s) of coverage are required:

A. Commercial General Liability - of $1,000,000 combined single limit per occurrence for bodily injury, property damage, and personal and advertising injury and $3,000,000 annual aggregate. The minimum limits required herein may be satisfied through any combination of primary and umbrella/excess liability policies.

B. Errors and Omissions/Professional Liability - $1,000,000 per combined single limit per claim and $3,000,000 annual aggregate.

C. Worker’s Compensation - The Contractor shall maintain such insurance as necessary or as required under Workers’ Compensation Acts, the Longshore and Harbor Workers’ Compensation Act, and the Federal Employers’ Liability Act, to not be less than one million dollars ($1,000,000) per occurrence (unless a state’s law requires a greater amount of coverage). Coverage must be valid in all states where work is performed.

D. Automobile or Commercial Truck Insurance - The Contractor shall maintain Automobile or Commercial Truck Insurance (including owned, leased, hired, and non-owned vehicles) as appropriate with Liability, Collision, and PIP limits no less than those required by the State where the vehicle(s) is registered, but in no case less than those required by the State of Maryland.

3.7.2 The State shall be listed as an additional insured on the faces of the certificates associated with the coverages listed above, including umbrella policies, excluding Workers’ Compensation Insurance and professional liability.

3.7.3 All insurance policies shall be endorsed to include a clause requiring the insurance carrier to provide to the Procurement Officer, by certified mail, not less than 30 days’ advance notice of any non-renewal, cancellation, or expiration.