RFQ_1439_Main_Doc_On-Line_Certs_2026.pdf

STATE OF IDAHO

Idaho Department of Juvenile Corrections

RFQ 1439

On-Line Certifications Software Program

Note the insurance requirements within the attached Exhibit C – Insurance Requirements and make sure that you can obtain the required insurance and will obtain it if you are awarded a Contract.

Also, make sure to read all of the State of Idaho Contract Terms and Conditions.

1. Purpose The Idaho Department of Juvenile Corrections (IDJC) is requesting quotes for an On-Line Certifications Software Program (the Program), as further detailed below.

The contact for this Request for Quote (RFQ) is: Jason Urquhart, Purchasing Agent, IDJC; phone: 208-577- 5426; email: jason.urquhart@idjc.idaho.gov.

2. Time Lines

Written questions due (by 11:59:59 p.m. Mountain time): September 18, 2026

Quotes Due (by 5 p.m. Mountain time): September 25, 2026

(If you cannot meet any of the specifications listed in this RFQ, you may submit a question in writing to the contact for this RFQ by the written questions due date. After the quotes are due and before the contract is awarded, IDJC will not consider requests for changes to the specifications and will not accept quotes that don’t meet all of the specifications; however, see the specifications regarding certain requested, but not required, specifications.)

3. Specifications See Exhibit A – Specifications.

4. Provision of the Program The Contractor shall provide the Program, during the period identified at section 15, Award Basis and Term below, coordinating the provision of the Program and all implementation and training activities with the IDJC Education Director. Contact information is as follows: Kathleen Schatz; phone: 208-577-5423; email:

kathleen.schatz@idjc.idaho.gov.

mailto:jason.urquhart@idjc.idaho.gov mailto:kathleen.schatz@idjc.idaho.gov

5. No Software Development IDJC will not accept quotes that include software development.

6. Configuration of Program for IDJC Use If the Vendor quotes a program that needs to be configured to meet this RFQ’s specifications and requirements, the Vendor will not be paid to make those configurations. Additionally, the configurations must be complete and the Program completely ready for IDJC use no more than sixty (60) calendar days after award of Contract, and the Vendor must require no more than ten (10) hours of IDJC staff time during configuration.

7. Software Demonstrations IDJC may require the Vendor with the apparent successful quote to provide a demonstration of the software that it has quoted, demonstrating that it meets the specifications that require the software to have certain functionality. Demonstrations will take place remotely via Microsoft Teams or another virtual meeting platform.

8. Vendor-Submitted Documents If the Vendor desires any of its documents containing terms and conditions to become part of the Contract, it must submit them as part of its quote.

IDJC will not sign those documents and will only incorporate those documents as attachments to the Contract, and the terms, conditions and requirements in such documents will be without effect.

(NOTE: We cannot enter into negotiations (except in very limited circumstances and only after obtaining certain authorization), even to edit terms and conditions, after the RFQ has closed (after the date that quotes are due). Therefore, Vendors should submit individual terms and conditions, not entire documents, as written questions by the written questions due date, and IDJC may consider such terms and conditions for inclusion in the Contract.)

9. Third-Party Agreements, Terms and Conditions IDJC can only contract with one party and so cannot agree to third-party terms and conditions. Any third-party terms and conditions or other documents submitted by the Vendor with its quote may be incorporated into the Contract as exhibits, but the terms, conditions and requirements in such documents will be without effect.

10. References IDJC reserves the right to require a list of references. If IDJC identifies to the vendor that this is required, in order to be considered for award (in part), the vendor must provide a list of at least three (3) but no more than five (5) references for which the vendor has provided the software it is quoting within the last three (3) years on a similar scale (or larger scale) to that required in this RFQ. The list must include the client’s business name, the name of a contact that currently works for the client that is familiar with vendor’s work and software, and that client’s current business phone number and email address.

Additionally, in order to be considered for award (in part) if IDJC requires a reference list, the Vendor’s references must provide feedback to IDJC that, in its sole discretion, is satisfactory, in particular regarding the Vendor’s quality of work, the quality of the software, ability to meet schedules, and communications.

11. Solution Security Questionnaire IDJC will review the information provided in response to Exhibit D – Solution Security Questionnaire, and the Office of Information Technology Services (ITS) may as well. This information may be used to vet the Program quoted. If it is determined through a vetting process that the Program quoted does not pass this vetting (in IDJC’s sole discretion, as advised by ITS), that may be cause for the quote to not be considered for award. (If you are quoting the software offered by CareerSafe, LLC that meets the specifications within Exhibit A – Specifications, IDJC has been using that software under a contract, and so you would not need to submit a completed Security Solution Questionnaire.)

12. Accessibility Documentation If quoting a Consumer Off the Shelf (COTS) solution, including Software as a Service (SaaS), submit as a part of the quote accurate Accessibility Conformance Reports (ACRs) created using the applicable sections of the Voluntary Product Accessibility Template® (VPAT®) Revised Section 508 Edition (Version 2.3 or higher) or links to ACRs located on Vendor websites for each proposed product or product family (as applicable).

Instructions on how to complete this document are included in the template itself.

• ACR will need to be based on the current product version.

• ACR will need to be evaluated on current WCAG standards as of the date that quotes are due.

• ACRs will need to be based on earlier versions of the product must be made available to the state upon request.

If quoting a customized COTS solution, submit as a part of your quote an ACR and complete and submit the Vendor Accessibility Development Services Questionnaire, which documents Vendor's ability to produce accessible electronic and information resources.

If quoting a non-COTS solution (such as IT-related development services, services that include user-accessed online components, etc.), please complete and submit a Vendor Accessibility Development Services Questionnaire, which documents the Vendor’s ability to produce accessible electronic and information resources.

13. Changes to Solicitation Instructions to Vendors

13.1 References to “State of Idaho Standard Terms and Conditions” in section 6, Administrative Fee of the Solicitation Instructions to Vendors are changed to read “State of Idaho Contract Terms and Conditions”.

13.2 The reference to “State of Idaho Standard Contract Terms and Conditions” in section 15.1 (Submission Forms) of the Solicitation Instructions to Vendors is changed to read “State of Idaho Contract Terms and Conditions”.

13.3 References to “State of Idaho Standard Contract Terms and Conditions” in section 18, Terms and Conditions of Ensuing Contract of the Solicitation Instructions to Vendors are changed to read “State of Idaho Contract Terms and Conditions”.

14. Kick-Off Meeting IDJC reserves the right to require that the Contractor attend a kick-off meeting after award but before the start of implementation. The meeting may be in-person or via conference call or virtual meeting platform, in IDJC’s sole discretion. A company officer of the Contractor and the Contractor’s lead for the services must attend the meeting, if required.

15. Award Basis and Term

15.1 Award will be made ALL OR NONE to the responsive responsible vendor with the lowest Total Price, as provided on Exhibit B - Price Sheet.

15.2 The term of the resulting Contract will be one (1) year, and may be amended, renewed or extended upon mutual agreement of the parties.

16. Response Complete Exhibit A – Specifications, Exhibit B – Price Sheet and the signature page, and email, fax, mail, hand-deliver/courier* or submit your quote (Quotation as defined in the Solicitation Instructions to Vendors) via IPRO (IPRO LOGIN) so that it is received at the location specified on the Signature Page prior to the deadline established above. (*If you hand-deliver/courier your quote, you will need to deliver it here:

Idaho Department of Juvenile Corrections 11351 W Chinden Blvd Building 6 Boise, ID 83714)

Quotes must be accompanied by a signed Signature Page and must include all Required Submittal Items (see below).

If submitting via IPRO complete Exhibit B – Price Sheet AND in enter the Total Price from Exhibit B – Price Sheet in IPRO, and UPLOAD all Required Submittal Items.

List of Attachments Required Submittal Items

• Exhibit A – Specifications

• Exhibit A.1 – Specifications Checklist

• Exhibit B – Price Sheet

• Exhibit C – Insurance Requirements

• Exhibit D – Solution Security Questionnaire

• Appendix A – Idaho Terms and Conditions

Background and Limitations

• Signature Page

• Solicitation Instructions to Vendors

• State of Idaho Contract Terms and Conditions

• No Public Funds for Abortion Act Letter Sample

(see section 1.21.4 in the State of Idaho Contract Terms and Conditions)

Exhibit A.1 – Specifications Checklist

Exhibit B – Price Sheet

Exhibit D – Solution Security Questionnaire (If you are quoting the software offered by CareerSafe, LLC that meets the specifications within Exhibit A – Specifications, IDJC has been using that software under a contract, and so you would not need to submit a completed Security Solution Questionnaire.)

Signature Page https://purchasing.idaho.gov/information-for-vendors/

Exhibit A – Specifications

Below are the specifications for this RFQ.

The software that you quote must meet all of the specifications.

If you cannot meet any of the specifications listed in this RFQ, you may submit a question in writing to the contact for this RFQ by the written questions due date. After the quotes are due and before the contract is awarded, IDJC will not consider requests for changes to the specifications and will not accept quotes that don’t meet all of the specifications; however, see the specifications regarding certain requested, but not required, specifications.

Specifications for the Program:

(SPEC-1) Each course required below must be designed for middle school and high school students. All Employability Skills courses combined must have a total of approximately twenty (20) hours of course instruction and result in a certification (certifications do not have to be accredited). When a student completes an OSHA course, that must enable the student to obtain a state approved OSHA card.

(SPEC-2) Employability Skills: The Program you quote must provide an Interview Skills course.

(SPEC-3) Employability Skills: The Program you quote must provide a Communication Skills course.

(SPEC-4) Employability Skills: The Program you quote must provide a Cybersecurity Essentials for Work course.

(SPEC-5) Employability Skills: The Program you quote must provide a Time Management course.

(SPEC-6) Employability Skills: The Program you quote must provide a Human Resource Management course.

(SPEC-7) Employability Skills: The Program you quote must provide a Teamwork course.

(SPEC-8) Employability Skills: The Program you quote must provide a Written Communication course.

(SPEC-9) Employability Skills: The Program you quote must provide a Materials Management course.

(SPEC-10) Employability Skills: The Program you quote must provide a Workplace Financial Management course.

(SPEC-11) Employability Skills: The Program you quote must provide a Personal Financial Management course.

(SPEC-12) Employability Skills: The Program you quote must provide a Critical Thinking course.

(SPEC-13) Employability Skills: The Program you quote must provide a Start Safe, Stay Safe: Preparing for Work-Based Learning course.

(SPEC-14) Employability Skills: The Program you quote must provide a Cyber Safety course.

(SPEC-15) OSHA: The Program you quote must provide an OSHA 10-Hour Construction Industry course.

(SPEC-16) OSHA: The Program you quote must provide an OSHA 10-Hour General Industry course.

(SPEC-17) OSHA: The Program you quote must provide an OSHA 10-Hour General Industry (Healthcare) course.

(SPEC-18) OSHA: The Program you quote must provide an OSHA 10-Hour General Industry (Agriculture) course.

(SPEC-19) OSHA: The Program you quote must provide an OSHA 10-Hour General Industry (Cosmetology) course.

(SPEC-20) OSHA: The Program you quote must provide an OSHA 10-Hour General Industry (Manufacturing) course.

(SPEC-21) OSHA: The Program you quote must provide an OSHA 10-Hour General Industry (Culinary) course.

(SPEC-22) OSHA: The Program you quote must provide an OSHA 10-Hour General Industry (Automotive) course.

(SPEC-23) OSHA: The Program you quote must provide an OSHA 10-Hour General Industry (Veterinary) course.

(SPEC-24) OSHA: The Program you quote must provide an OSHA 10-Hour General Industry (Public Safety:

EMS) course.

(SPEC-25) The Program must be accessible with a variety of devices (desktop, laptop, mobile).

(SPEC-26) The Program must be accessible with a variety of operating systems including but not limited to Windows, Mac and iOS.

(SPEC-27) The Program must be accessible with a variety of web browsers including but not limited to Edge, Firefox, Chrome, Chromium, Safari, and Opera.

(SPEC-28) The Contractor must take reasonable precautions to ensure that the Program and data are protected against viruses, worms, hackers, etc. IDJC is the designated owner of all data and shall have the right to approve or disapprove access to that data. The Contractor shall not have ownership of IDJC data at any time. At all times, the Contractor shall be in compliance with privacy policies established by governmental agencies, by state law and by federal law.

(SPEC-29) In the event that the relationship between IDJC and the Contractor is severed, such as by termination or expiration of Contract, all IDJC data must be destroyed no later than five (5) years after the relationship is severed.

(SPEC-30) The Contractor must comply with privacy policies established by IDJC, state and federal law. It is understood that authorized OSHA providers must maintain student completion data for five (5) years from the date of completion and authorized OSHA providers must share that student completion data with OSHA.

(SPEC-31) The Program must be hosted off-site on Contractor-owned or operated systems and hardware, must have no footprint internal to the State of Idaho network and must not access or interface with the State of Idaho network. The Contractor is responsible for all maintenance of systems and hardware.

(SPEC-32) For non-OSHA courses, the Program must have functionality that provides for the juvenile to take the test for each course at least three (3) times, and then the administrator can make the juvenile retake the course if failed all three (3) times. (This shall be at no additional cost for taking the course again one (1) time. The Contractor may charge for any retaking of the course by the same student beyond that.)

(SPEC-33) For OSHA courses, the Program must provide each juvenile with a minimum of three (3) attempts to successfully complete the final course assessment. If the juvenile does not successfully complete the final course assessment within three (3) attempts, the Program must provide for course remediation with instructor assistance and one (1) course reset at no additional cost. The course reset must provide the juvenile with the opportunity to repeat the required course content and associated assessments in accordance with applicable OSHA requirements. The Contractor may not charge IDJC an additional course enrollment, licensing, or course fee until the juvenile has exhausted the initial three (3) assessment attempts and the one (1) included course reset.

(SPEC-34) The Program must have functionality for administrators to create a progress report for each juvenile, a combined progress report per site (sites are located at the Juvenile Correction Center - Nampa, the Juvenile Correction Center - Lewiston and the Juvenile Correction Center - Saint Anthony) and a historical report, all of which must be exportable to Microsoft Excel.

(SPEC-35) The Program must have functionality so that juveniles have access to history of their progress and have both view and download access after the juvenile is no longer under IDJC jurisdiction.

(SPEC-36) The Program must have a ninety-eight percent (98%) uptime or greater.

(SPEC-37) The Program must be hosted at a secure location.

(SPEC-38) The Program must be generically and universally upgradeable as a result of natural product evolution. This requirement is inclusive of the Program's underlying infrastructure.

We request, but do not require, that the Program you quote has the following:

(SPEC-39) For as long as IDJC uses the Program it maintains historical versions of tests as the individual questions change.

(SPEC-40) The Program has functionality that provides an administrator the flexibility to control the timing of a test to include releasing a test to the juvenile, and, within a year of releasing a test to a juvenile, pausing a test, and ending the test based upon the dynamic nature of the classroom.

(SPEC-41) If possible, the Program should support integration with ClassLink for single sign-on (SSO) and rostering purposes.

Exhibit A.1 – Specifications Checklist

For SPEC-1, confirm by entering a checkmark to the right that the software you are quoting meets this specification:

“Each course required below must be designed for middle school and high school students. All Employability Skills courses combined must have a total of approximately twenty (20) hours of course instruction and result in a certification (certifications do not have to be accredited).

When a student completes an OSHA course, that must enable the student to obtain a state approved OSHA card.”

For SPEC-2, confirm by entering a checkmark to the right

“Employability Skills: The Program you quote must provide an Interview Skills course.”

For SPEC-3, confirm by entering a checkmark to the right provide a Communication Skills course.”

For SPEC-4, confirm by entering a checkmark to the right provide a Cybersecurity Essentials for Work course.”

For SPEC-5, confirm by entering a checkmark to the right provide a Time Management course.”

For SPEC-6, confirm by entering a checkmark to the right provide a Human Resource Management course.”

For SPEC-7, confirm by entering a checkmark to the right provide a Teamwork course.”

For SPEC-8, confirm by entering a checkmark to the right provide a Written Communication course.”

For SPEC-9, confirm by entering a checkmark to the right provide a Materials Management course.”

For SPEC-10, confirm by entering a checkmark to the right provide a Workplace Financial Management course.”

For SPEC-11, confirm by entering a checkmark to the right provide a Personal Financial Management course.”

For SPEC-12, confirm by entering a checkmark to the right provide a Critical Thinking course.”

For SPEC-13, confirm by entering a checkmark to the right

“Employability Skills: The Program you quote must provide a Start Safe, Stay Safe: Preparing for Work-Based Learning course.”

For SPEC-14, confirm by entering a checkmark to the right

“Employability Skills: The Program you quote must provide a Cyber Safety course.”

For SPEC-15, confirm by entering a checkmark to the right

“OSHA: The Program you quote must provide an OSHA 10- Hour Construction Industry course.”

For SPEC-16, confirm by entering a checkmark to the right

Hour General Industry course.”

For SPEC-17, confirm by entering a checkmark to the right

Hour General Industry (Healthcare) course.”

For SPEC-18, confirm by entering a checkmark to the right

Hour General Industry (Agriculture) course.”

For SPEC-19, confirm by entering a checkmark to the right

Hour General Industry (Cosmetology) course.”

For SPEC-20, confirm by entering a checkmark to the right

Hour General Industry (Manufacturing) course.”

For SPEC-21, confirm by entering a checkmark to the right

Hour General Industry (Culinary) course.”

For SPEC-22, confirm by entering a checkmark to the right

Hour General Industry (Automotive) course.”

For SPEC-23, confirm by entering a checkmark to the right

Hour General Industry (Veterinary) course.”

For SPEC-24, confirm by entering a checkmark to the right

Hour General Industry (Public Safety: EMS) course.”

For SPEC-25, confirm by entering a checkmark to the right

“The Program must be accessible with a variety of devices (desktop, laptop, mobile).”

For SPEC-26, confirm by entering a checkmark to the right

“The Program must be accessible with a variety of operating systems including but not limited to Windows, Mac and iOS.”

For SPEC-27, confirm by entering a checkmark to the right

“The Program must be accessible with a variety of web browsers including but not limited to Edge, Firefox, Chrome, Chromium, Safari, and Opera.”

For SPEC-28, confirm by entering a checkmark to the right

“The Contractor must take reasonable precautions to ensure that the Program and data are protected against viruses, worms, hackers, etc. IDJC is the designated owner of all data and shall have the right to approve or disapprove access to that data. The Contractor shall not have ownership of IDJC data at any time. At all times, the Contractor shall be in compliance with privacy policies established by governmental agencies, by state law and by federal law.”

For SPEC-29, confirm by entering a checkmark to the right

“In the event that the relationship between IDJC and the Contractor is severed, such as by termination or expiration of Contract, all IDJC data must be destroyed no later than five (5) years after the relationship is severed.”

For SPEC-30, confirm by entering a checkmark to the right

“The Contractor must comply with privacy policies established by IDJC, state and federal law. It is understood that authorized OSHA providers must maintain student completion data for five (5) years from the date of completion and authorized OSHA providers must share that student completion data with OSHA.”

For SPEC-31, confirm by entering a checkmark to the right

“The Program must be hosted off-site on Contractor-owned or operated systems and hardware, must have no footprint internal to the State of Idaho network and must not access or interface with the State of Idaho network.

The Contractor is responsible for all maintenance of systems and hardware.”

For SPEC-32, confirm by entering a checkmark to the right that the software you are quoting meets this specification:

“For non-OSHA courses, the Program must have functionality that provides for the juvenile to take the test for each course at least three (3) times, and then the administrator can make the juvenile retake the course if failed all three (3) times. (This shall be at no additional cost for taking the course again one (1) time. The Contractor may charge for any retaking of the course by the same student beyond that.)”

For SPEC-33, confirm by entering a checkmark to the right

“For OSHA courses, the Program must provide each juvenile with a minimum of three (3) attempts to successfully complete the final course assessment. If the juvenile does not successfully complete the final course assessment within three (3) attempts, the Program must provide for course remediation with instructor assistance and one (1) course reset at no additional cost. The course reset must provide the juvenile with the opportunity to repeat the required course content and associated assessments in accordance with applicable OSHA requirements. The Contractor may not charge IDJC an additional course enrollment, licensing, or course fee until the juvenile has exhausted the initial three (3) assessment attempts and the one (1) included course reset.”

For SPEC-34, confirm by entering a checkmark to the right

“The Program must have functionality for administrators to create a progress report for each juvenile, a combined progress report per site (sites are located at the Juvenile Correction Center - Nampa, the Juvenile Correction Center

- Lewiston and the Juvenile Correction Center - Saint Anthony) and a historical report, all of which must be exportable to Microsoft Excel.”

For SPEC-35, confirm by entering a checkmark to the right

“The Program must have functionality so that juveniles have access to history of their progress and have both view and download access after the juvenile is no longer under IDJC jurisdiction.”

For SPEC-36, confirm by entering a checkmark to the right

“The Program must have a ninety-eight percent (98%) uptime or greater.”

For SPEC-37, confirm by entering a checkmark to the right

“The Program must be hosted at a secure location.”

For SPEC-38, confirm by entering a checkmark to the right

“The Program must be generically and universally upgradeable as a result of natural product evolution. This requirement is inclusive of the Program's underlying infrastructure.”

We request, but do not require, that the Program you quote has the following:

For SPEC-39, confirm by entering a checkmark to the right that the software you are quoting meets this specification:

“For as long as IDJC uses the Program it maintains historical versions of tests as the individual questions change.”

For SPEC-40, confirm by entering a checkmark to the right

“The Program has functionality that provides an administrator the flexibility to control the timing of a test to include releasing a test to the juvenile, and, within a year of releasing a test to a juvenile, pausing a test, and ending the test based upon the dynamic nature of the classroom.”

For SPEC-41, confirm by entering a checkmark to the right

“If possible, the Program should support integration with ClassLink for single sign-on (SSO) and rostering purposes.”

(If the product you are quoting varies from the above specifications in any way, identify how it varies, and how its either a functional equivalence or a minor deviation, and how so. Use the right-hand checklist cells above and the rest of this page to enter that information, if any.)

Exhibit B – Price Sheet

On-Line Certifications Software Program

This Exhibit B - Price Sheet must be submitted as part of your quote.

All prices must be firm and fixed. (See section 1.3.2, Price Increases, in the State of Idaho Contract Terms and Conditions as well.)

All prices must be fully burdened including, but not limited to, all operating and personnel expenses, such as:

overhead, salaries, administrative expenses, travel, lodging, profit, out-of-pocket expenses and supplies.

Only prices entered on Exhibit B – Price Sheet will be part of the Contract, and the Contractor shall not assess any other fees or charges other than those listed on this Exhibit B - Price Sheet.

Do not alter this Exhibit B - Price Sheet. Altering this Exhibit B - Price Sheet may be cause for your quote to not be considered for award.

Do not submit pricing on any form or in any document other than this Exhibit B - Price Sheet. Providing your pricing on any form or in any document other than this Exhibit B - Price Sheet may be cause for your quote to not be considered for award.

We estimate approximately one hundred (100) students per year will be enrolling in the courses provided under the Contract.

Additionally, we estimate that we will purchase three hundred (300) OSHA courses, one (1) Employability Skills license and one (1) Start Safe, Stay Safe license (see SPEC-13 in Exhibit A – Specifications) per year. (IDJC’s experience has been that one (1) Employability Skills license provides access to an unlimited number of Employability Skills courses, and that one (1) Start Safe, Stay Safe license provides access to an unlimited number of Start Safe/Stay Safe courses. We do not have an estimated number of non-OSHA courses to be taken per year.)

IDJC does not guarantee any number of students, any number of courses to be purchased or any number of licenses to be purchased.

Product and version number quoted for the Program: _________________________________________

Enter the system requirements for the devices that can be used to access the Program here:

Line Item 1. Price for IMPLEMENTATION of the Program.

(Leaving the space directly above blank means that you do not charge anything for implementation.)

(If you are quoting the software offered by CareerSafe, LLC that meets the specifications within Exhibit A – Specifications, IDJC has been using that software under a contract, and so there would be no need for implementation.)

Describe how you will provide implementation of the Program you are quoting here:

(Include in the description how long you anticipate implementation will take after the Contract is awarded, the resources such as IDJC staff time you will need for implementation.)

Line Item 2. Price for TRAINING on the use of the Program.

(Leaving the space directly above blank means that you do not charge anything for training.)

(If you are quoting the software offered by CareerSafe, LLC that meets the specifications within Exhibit A – Specifications, IDJC has been using that software under a contract, and so there would be no need for training.)

Describe how you will provide training within ten (10) business days after implementation is complete here:

(At a minimum, the Contractor must provide one (1) virtual meeting per IDJC Juvenile Correction Center (JCC)* to provide training to IDJC’s Education Director, the IDJC teachers, the IDJC program information coordinator and possibly other IDJC staff that will have an administrator role covering how to use the Program.

* There are three JCCs: one located in Lewiston, Idaho, one in Nampa, Idaho and one in Saint Anthony, Idaho.)

Line Item 3. Price for one full year (Year 1; the initial term) of providing the Program in accordance with the specifications and other requirements in the Contract.

For Line Item 3, on the lines directly below, describe your pricing in detail for all of the courses listed in the specifications, and enter the total one full year cost on the line directly above. (We request, but do not require, as much as possible that there be no limit on the number of students, and that the costs you describe below and provide under the Contract be costs per site.)

Line Item 4. Price for one full year (Year 2; a renewal term) of providing the Program in accordance with the

For Line Item 4, on the lines directly below, describe your pricing in detail for all of the courses listed in the specifications, and enter the total one full year cost on the line directly above. (We request, but do not require, as much as possible that there be no limit on the number of students, and that the costs you describe below and

Line Item 5. Price for one full year (Year 3; a renewal term) of providing the Program in accordance with the

For Line Item 5, on the lines directly below, describe your pricing in detail for all of the courses listed in the specifications, and enter the total one full year cost on the line directly above. (We request, but do not require, as much as possible that there be no limit on the number of students, and that the costs you describe below and

Line Item 6. Price for one full year (Year 4; a renewal term) of providing the Program in accordance with the

For Line Item 6, on the lines directly below, describe your pricing in detail for all of the courses listed in the specifications, and enter the total one full year cost on the line directly above. (We request, but do not require, as much as possible that there be no limit on the number of students, and that the costs you describe below and

Line Item 7. Price for one full year (Year 5; a renewal term) of providing the Program in accordance with the

For Line Item 7, on the lines directly below, describe your pricing in detail for all of the courses listed in the specifications, and enter the total one full year cost on the line directly above. (We request, but do not require, as much as possible that there be no limit on the number of students, and that the costs you describe below and

Total Price: $ _________________________ (The Total Price is the sum of Line Items 1 through 7.)

Company Name (Vendor Name):

Contact Name/Phone:

Contact Email:

Exhibit C – Insurance Requirements

On-Line Certifications Software Program

C.1 Insurance Within five (5) business days of award of the Contract (or such other time as designated by the Purchasing Activity; IDJC), the Contractor must provide certificates of insurance required herein and must maintain the insurance for the entire term of the Contract, including any renewal and extension terms. There are no provisions for exceptions to this requirement. Failure to provide the certificates of insurance within the five (5) business day period may be cause for your Contract to be terminated.

The Contractor shall carry liability and property damage insurance that will protect it and the state of Idaho (the State) from claims for damages for bodily injury, including accidental death, as well as for claims for property damages, which may arise from operations under the Contract whether such operations be by themselves or by anyone directly or indirectly employed by either of them.

The Contractor shall not commence work under the Contract until it obtains all insurance required under this provision and furnishes a certificate or other form showing proof of current coverage to the State. All insurance policies and certificates must be signed copies.

C.1.1 Commercial General and Umbrella Liability Insurance. The Contractor shall maintain Commercial General Liability (CGL) and, if necessary, Commercial Umbrella insurance with a limit of not less than $1,000,000 each occurrence. If such CGL insurance contains a general aggregate limit, it shall apply separately to the Contract.

C.1.1.1 CGL insurance shall be written on ISO occurrence form CG 00 01 (or a substitute form providing equivalent coverage) and shall cover liability arising from premises, operations, Contractors, products-completed operations, personal and advertising injury, and liability assumed under an insured contract (including the tort liability of another assumed in a business contract).

C.1.2 Commercial Automobile and Commercial Umbrella Liability Insurance. The Contractor shall maintain Commercial Automobile Liability and, if necessary, Commercial Umbrella Liability insurance with a limit of not less than $1,000,000 each accident. Such insurance shall cover liability arising out of any auto (including owned, hired, and non-owned autos).

C.1.2.1 Vendor may request a waiver from providing Commercial Automobile and Commercial Umbrella Liability Insurance in its quote if the Vendor will not use any owned, hired or non-owned vehicles to conduct business under the Contract, if it is awarded the Contract, and the State will consider the request. If the Vendor submits a request to waive the provision of Commercial Automobile and Commercial Umbrella Liability Insurance after the due date and time for receipt of quotes, the State may not consider the request.

C.1.3 Workers Compensation Insurance and Employer's Liability. The Contractor shall maintain workers compensation in statutory amounts and employer's liability. The employer's liability shall have limits not less than $1,000,000 each accident for bodily insurance by accident, $1,000,000 disease policy limit, and $1,000,000 disease, each employee.

C.1.3.1 The Contractor must provide either a certificate of workers compensation insurance issued by a surety licensed to write workers compensation insurance in the State of Idaho, as evidence that the Contractor has in effect a current Idaho workers compensation insurance policy, or an extraterritorial certificate approved by the Idaho Industrial Commission from a state that has a current reciprocity agreement with the Idaho Industrial Commission.

C.1.4 Cyber Insurance. The Contractor must maintain Cyber Insurance covering claims resulting from wrongful acts committed in the performance of, or failure to perform, all services under the agreement, including, without limitation, claims, demand, and any other payments related to electronic or physical security, breaches of confidentiality and invasion of or breaches of privacy.

This coverage must include Internet Media Liability including cloud computing and mobile devices, for protection of private or confidential information whether electronic or non-electronic, network security and privacy; privacy against liability for system attacks, digital asset loss, denial or loss of service, introduction, implantation or spread of malicious software code, security breach, unauthorized access and use; including regulatory action expenses; and notification and credit monitoring expenses with at least the minimum limits as listed below.

Each Occurrence – $1,000,000 Network Security / Privacy Liability –$1,000,000 Breach Response/ Notification Sublimit – A minimum limit of 50% of the policy aggregate.

For claims-made policies the Retroactive Date must be shown and must be before the date of the contract or the beginning of contract work; insurance must be maintained and evidence of insurance must be provided for at least five (5) years after termination or expiration of the contract; if coverage is canceled or non-renewed, and not replaced with another claims-made policy form with a Retroactive Date prior to the contract effective date, the Contractor must purchase “extended reporting” coverage for a minimum of five

(5) years after termination or expiration of the contract.

C.1.5 State of Idaho as Additional Insured: The liability insurance coverage required for performance of the Contract shall include the State, IDJC and their divisions, officers and employees as additional insured, but only with respect to the Contractor’s activities to be performed under the Contract.

C.1.5.1 The Contractor must provide proof of to the State, IDJC and their divisions, officers and employees being additional insured by providing endorsements to the liability insurance policies showing the State, IDJC and their divisions, officers and employees as additional insured. The endorsements must also show the policy numbers and the policy effective dates.

C.1.5.2 If a liability insurance policy provides for automatically endorsing additional insured when required by contract, then, in that case, the Contractor must provide proof of the State, IDJC and their divisions, officers and employees being additional insured by providing copies of the policy pages that clearly identify the blanket endorsement.

C.1.6 Notice of Cancellation or Change: The Contractor shall ensure that should any of the above described policies be cancelled before the expiration date thereof, or if there is a material change, potential exhaustion of aggregate limits or intent not to renew insurance coverage(s), that written notice will be delivered to the Purchasing Activity in accordance with the policy provisions.

C.1.7 The Contractor shall further ensure that all policies of insurance are endorsed to read that any failure to comply with the reporting provisions of this insurance, except for the potential exhaustion of aggregate limits, shall not affect the coverage(s) provided to the State, IDJC and their divisions, officers and employees.

C.1.8 Acceptable Insurers and Deductibles: Insurance coverage required under the Contract shall be obtained from insurers rated A-VII or better in the latest Bests Rating Guide and in good standing and authorized to transact business in Idaho. The Contractor shall be financially responsible for all deductibles, self-insured retention’s and/or self-insurance included hereunder. The coverage provided by such policy will be primary to any coverage of the State on or related to the Contract and shall provide that the insurance afforded applies separately to each insured against whom a claim is made, except with respect to the limitation of liability.

C.1.9 Waiver of Subrogation: All policies shall contain waivers of subrogation. The Contractor waives all rights against the State, IDJC and their divisions, officers and employees for recovery of damages to the extent these damages are covered by the required policies. Policies may contain deductibles but such deductibles will not be deducted from any damages due to the State.

Exhibit D – Solution Security Questionnaire

State of Idaho - Office of Information Technology Services NOTE: If applicable, please answer questions from the perspective of an enterprise solution

General Information

1. Software Name:

2. Vendor Name:

3. Completed By (person’s name):

4. Email address:

5. Phone Number:

6. Date on which this questionnaire was completed:

Solution Background

7. Is the solution currently and actively being developed?

Circle your answer: YES NO

8. How is the solution deployed? (e.g. Local install, local server install, SaaS, Cloud, other) Enter your answer here:

9. What is the frequency for solution updates? (e.g. monthly, quarterly, other)

Enter your answer here:

10. What is the process for solution updates?

Circle your answer: MANUAL AUTOMATIC

11. If manual, is the installer's hash made available to verify the file's integrity?

Circle your answer: YES NO

12. If automatic, how are the updates securely pushed?

Enter your answer here:

13. When was the last solution update released?

Enter your answer here:

14. Is the vendor also the developer of the solution?

Circle your answer: YES NO

15. If no, who is the developer?

Enter your answer here:

16. Is the developer of the solution based outside the United States?

Circle your answer: YES NO

17. If yes, where?

Enter your answer here:

18. What country's laws is the EULA governed by?

19. If the EULA is not under the sole legal jurisdiction of the United States, does the EULA contain a provision for US customers to by adjudicated by US law?

Circle your answer: YES NO

20. What is the solution's licensing model?

Enter your answer here:

21. If free, is it free for government use?

Circle your answer: YES NO

22. If free, are there restrictions?

Circle your answer: YES NO

23. Does the software solution incorporate open-source components or community sourced code?

Circle your answer: YES NO

24. Are the open-source component or community sourced code reviewed for malicious code or content?

Circle your answer: YES NO

25. Please provide a list of the open-source components and their versions.

Data Management

28. If the solution is a local installation, does it transmit data over the internet?

Circle your answer: YES NO

29. Is Idaho data stored locally on workstations, state servers, or external vendor servers?

Circle your answer: Workstations State servers External vendor servers

30. Is Idaho data encrypted at rest and/or in transit?

Circle your answer: YES NO

31. If yes, what encryption standard is used?

Enter your answer here:

32. Will Idaho data be stored or transmitted outside of the United States at any point?

Circle your answer: YES NO

33. If yes, where?

Enter your answer here:

34. If yes, Idaho data will be stored on

Circle your answer: Private servers Public servers US government compliant servers.

35. What is the process to request Idaho data be erased or retrieved?

Enter your answer here:

37. Will support personnel or contractor need remote access to the solution or Idaho data?

Circle your answer: YES NO

38. If yes, where are they located?

39. If Idaho data is stored within a database, what solution and version is used?

40. Is customer data or usage data collected?

Circle your answer: YES NO

41. If yes, is this data sold, traded, transferred, or shared?

Enter your answer here:

42. If yes, what can it be used for?

Enter your answer here:

43. Is the solution equipped to address regulatory requirements?

Circle your answer: YES NO

44. Solution has been certified for (circle all that apply):

PCI-DSS CJIS FTI SSA PHI \ HIPAA PII

Other (please describe if other)

Security

45. Is the solution digitally signed?

Circle your answer: YES NO

46. If yes, please provide the signing certificate SHA hash.

47. In the event of a breach originating with the solution, what is the standard operating procedure? (e.g. timelines, notification requirements, remediation requirements, etc.)

Enter your answer here:

49. Does the developer conduct penetration testing or security assessments on the solution?

Circle your answer: YES NO

50. If yes, when was the last one conducted?

Enter your answer here:

51. Does the vendor/developer hold any current security accreditations?

Circle your answer: YES NO

52. If yes, which accreditation? (e.g. ISO 27001, FedRAMP, other)

Enter your answer here:

53. Are there any known security products that the solution is incompatible with?

Circle your answer: YES NO

54. If yes, which?

Enter your answer here:

55. Does the vendor/developer have Cyber Risk insurance?

Circle your answer: YES NO

56. If yes, what is the amount?

Generative AI

57. Does the solution use AI?

Circle your answer: YES NO

58. What are the inputs to the generative AI?

Enter your answer here:

59. What are the outputs of the generative AI?

Enter your answer here:

60. What generative AI models does the product use?

Enter your answer here:

61. What large language models does the product use?

Enter your answer here:

62. Can the output of the GAI be used for fraudulent purposes?

Circle your answer: YES NO

63. What data does the AI require for training?

Enter your answer here:

64. How do you ensure the AI model’s accuracy?

65. How does the solution handle bias and fairness?

66. How is the AI model updated and improved over time?

Enter your answer here:

67. What are the solutions interpretability and transparency like?

Enter your answer here:

69. Can the AI model be customized to our specific needs?

Circle your answer: YES NO

70. Has the solution been evaluated for bias?

Circle your answer: YES NO

71. Is the solution designed to improve over time?

Circle your answer: YES NO

APPENDIX A – IDAHO TERMS AND CONDITIONS BACKGROUND AND LIMITATIONS

Idaho Terms and Conditions – Background The Division of Purchasing issues solicitations on behalf of State of Idaho agencies. As public entities, the Division and the agencies it serves are subject to statutes, rules and policies that result in terms and conditions unlike those common in contracts between private parties. The Division of Purchasing does not have authority to vary many of these terms and in some instances variations are void under Idaho law. See IDAPA 38.05.01.112.

Idaho is not unique. Many of the terms in the State of Idaho Contract Terms and Conditions are similar to terms offered by most federal, state, and local government agencies. Vendors who seek to work with government agencies should become familiar with these terms. The discussion below is provided to assist you in becoming familiar with the legal and policy basis for the terms and to provide information for you to evaluate the risks and benefits of working with public entities.

Termination – Costs of Re-procurement The State of Idaho Contract Terms and Conditions provision concerning termination specifically identifies the costs of re-procurement as a damage arising from a breach of the contract by a vendor. This damage is identified because of the public agency budgeting process and the competitive solicitation process required by Idaho’s purchasing laws. The Idaho purchasing laws provide a preference for open, competitive procurements. These procurements come at a cost to the agency, which is generally included in the agency budget requested from the Idaho Legislature more than twelve months prior to incurring the expense. Unlike a private business, public agencies cannot independently pass through the costs of re-procurement to Idaho taxpayers, who are the customers of government. Instead, Idaho agencies must submit a request for the costs to the Idaho Legislature in a subsequent budget year, which is usually after the need to secure a replacement vendor for the breaching contractor arises. As a matter of public policy, the contractor whose breach caused the damage of requiring re-procurement must pay those costs at the time of breach so that the public can receive the benefit of the contract made on its behalf through re-procurement of a new contract. This policy is reflected in the State of Idaho Contract Terms and Conditions provision concerning termination and the Division of Purchasing does not generally vary this requirement.

Termination – Fiscal Necessity Idaho Constitution Article VII, section 11 prohibits an expenditure in excess of a legislative appropriation. Idaho Code section 59-1015 prohibits state agencies and officers from entering into contracts that create any expense or liability in excess of an appropriation. Idaho Code section 59-1016 provides that any such contract is void.

IDAPA 38.05.01.112 contains the same provisions. An appropriation can be reduced under Idaho law through “give backs” and “hold backs” issued by the executive branch. When the Division of Purchasing enters into a contract, it must contain the term allowing for termination for fiscal necessity to comply with these provisions.

Variation of this term is not offered.

Anti-Discrimination/Equal Employment Opportunity Many of the Idaho agencies served by the Division of Purchasing receive federal funding that is subject to a requirement concerning a pass-through to vendors of the obligation to comply with federal civil rights and anti-discrimination laws. The pass-through obligation may extend beyond the specific federal funds to all agency contracts.