RFQ 20-00526 - EOTSS NetApp Hardware Upgrade_Final 12.23.19.docx

PCR 20-00526

Commonwealth of Massachusetts Executive Office of Technology Services and Security

Commonwealth of Massachusetts Executive Office of Technology Services and Security

Request for Quotation EOTSS RFQ 20-00526

EOTSS NetApp Hardware Upgrade

COMMBUYS Bid Number: BD-20-1060-ITD00-ITD00-46870

December 23, 2019

IN ACCORDANCE WITH M.G.L. C. 66 AND M.G.L. C. 4, § 7 (26), THIS RFQ AND ALL RESPONSES HERETO INCLUDING THE WINNING BID SHALL BECOME PUBLIC RECORD, AND CAN BE OBTAINED FROM THE EXECUTIVE OFFICE OF TECHNOLOGY SERVICES AND SECURITY BY SENDING AN EMAIL TO MICHELLE.BURWELL@STATE.MA.US. ANY PORTIONS OF A RESPONSE THAT ARE LABELED AS CONFIDENTIAL WILL STILL BE CONSIDERED PUBLIC RECORD.

1. General Procurement Information

A. General Information Purchasing Agency: Executive Office of Technology Services and Security (“EOTSS”) or (“Agency”)

Address: One Ashburton Place, Eighth Floor, Boston, MA 02108

Procurement Contact: Shawn Johnson

Telephone: 617-626-4593

E-Mail Address: shawn.johnson@mass.gov

RFQ File Number and Title: RFQ 20-00526 EOTSS NetApp Hardware Upgrade

This Request for Quotes (“RFQ”) does not commit the Commonwealth of Massachusetts (“Commonwealth”) or the Agency to pay any costs incurred in the preparation of a Bidder’s response to this RFQ or to purchase any products or services. The Agency may: (i) accept or reject any and all bids received as a result of this RFQ; (ii) contract for some, all, or none of the products and services offered by Bidders in response to this RFQ; (iii) negotiate with one or more qualified Bidders; or (iv) cancel, in part or in its entirety, this RFQ if it is in the best interest of the Commonwealth to do so.

The Agency may amend this RFQ at any time prior to the date the responses are due. Any such amendment will be posted to the Commonwealth’s procurement website, CommBUYS (www.commbuys.com).

Bidders must submit their bids through the Commonwealth’s online procurement system, COMMBUYS, as detailed in Attachment A. Bidders are advised to check this site (Commbuys.com) regularly, as this will be the sole method used for notification of changes.

B. Eligible Bidders

This RFQ is restricted to vendors on the following Statewide Contracts:

☒ ITC47 (IT Hardware and Related Services) Category 4 Storage Solutions and Category 6 Authorized Resellers

C. Event Calendar

All times in this RFQ are in prevailing Eastern Time. Responses must be received no later than the response due date and time indicated below or they will not be evaluated. Bidders must have their responses fully loaded and accepted in COMMBUYS prior to the RFQ Response Due date and time listed below. Bidders are urged to allow sufficient time to upload their entire response.

1. Purchasing Entity

The Executive Office of Technology Services and Security is responsible for the provision of infrastructure services, development of IT policy, and implementation and oversight of all information technology investments for the Commonwealth and its respective agencies. In addition, EOTSS provides the processing and application programming services for many state departments using some of the most advanced hardware and software available.

1. Description and Purpose of Procurement

A. Background

EOTSS is modernizing the NetApp storage platform and is issuing this RFQ to solicit proposals from qualified Bidders to provide NetApp hardware, software, and services for MITC at 200 Arlington St., Chelsea, MA 02150.

B. Description of Good and Services

The Agency is issuing this RFQ to purchase the items in Table 1. All hardware must be delivered within 30 days of purchase order issuance. Bidders must provide all of the following:

TABLE 1 – Description of Goods and Services

Maintenance: If maintenance is listed in the table above, Bidder must clearly indicate the level of maintenance offered and any maintenance options (e.g., silver, gold, platinum). Bidder must hold maintenance rates fixed with no price increases for three years and agree that the rate of maintenance for each successive year beyond three (3) years will not increase more than 3% of the rate for maintenance for the previous year. Maintenance, support, and extended warranty following the initial term may be purchased for as long as such services are available.

Services: This RFQ is for hardware solicitations only. Except for maintenance or standard installation and configuration services, no professional services should be included in any response to this RFQ. If services of any kind become necessary, they shall be governed by EOTSS’ standard template statement of work, as attached hereto (Attachment B).

Hardware: All units sold shall have a remaining lifetime of no less than five years of life. Bidder agrees that it shall not discontinue support for any hardware sold under this RFQ for the five-year period. In its response, Bidder must include a detailed description of warranty terms and any plans they offer for post-warranty maintenance and support, including but not limited to the ability to purchase an extended warranty at the time of system purchase.

Software: This RFQ is for hardware solicitations only. Except for firmware, and other embedded software necessary to operate hardware products, no software should be included in any response to this RFQ. If a Bidder or original equipment manufacturer includes license agreements for any firmware or other embedded software as part of a hardware sale, then Bidders should include copies of such agreements in their responses. Notwithstanding the preceding language, any provisions of these licensing agreements that are the contrary to the terms of this RFQ and the applicable RFR shall be null and void.

III. Estimated Term

The estimated term of any contract entered into under this RFQ shall consist of an initial 36 month term and may be renewed or extended upon written agreement by the awarded Bidder and the Agency. The initial term and all renewals or extensions shall be referred to collectively as the “Term.”

IV. Warranties

The Bidder must agree to provide the following warranties. Additional warranties may be agreed to in the contract resulting from this RFQ.

1) Bidder must provide all warranties required by the applicable Statewide Contract.

2) Bidder warrants that all hardware, software, maintenance, and services shall be provided in accordance with applicable State and Federal laws and in accordance with industry standards.

3) Bidder warrants that all personnel performing services shall act with due diligence and care and are qualified to perform such services in accordance with industry standards. Bidder warrants that it shall be responsible for the actions and omissions of all subcontractors and shall ensure all subcontractors’ compliance with the terms of an agreement resulting from this RFQ.

4) Bidder warrants that for a minimum of six (6) months (the “Warranty Period”) after the Agency accepts any hardware, software, maintenance, or services pursuant to Sections 1 and 2 of the Commonwealth’s Terms and Conditions, any hardware, software, maintenance, or services delivered by Bidder under this RFQ will substantially conform to the applicable Specifications. As used in this RFQ, “Specifications” means (i) the requirements set forth in this RFQ, (ii) the functional, performance, and interoperability requirements set forth in any agreement entered hereunder; (iii) the functionality and description provided in Bidder’s response to this RFQ, and (iv) to the extent not inconsistent with the foregoing, the provider’s published specifications and documentation. If EOTSS discovers a non-conformity during the Warranty Period, then the Bidder’s entire liability and EOTSS’ exclusive remedy shall be as follows: Bidder shall use commercially reasonable efforts, at its option, to (1) correct the non-conformity, (2) provide a work around (a “Fix”), or (3) replace the hardware. If Bidder is unable to remedy a non-conformity within a reasonable period of time, then EOTSS may terminate any agreement effective immediately upon written notice to Bidder. In this event, Bidder shall promptly pay to EOTSS an amount equivalent to all amounts paid by EOTSS for (i) the hardware and (ii) maintenance and support services for the current year and (iii) all amounts already paid and not yet rendered or goods not yet delivered and accepted by EOTSS. Any replacement or error correction will not extend the original Warranty Period. During the Warranty Period, Bidder will not charge EOTSS for parts, labor or transportation.

5) Bidder warrants that the hardware, software, maintenance, and services provided do not infringe on any existing intellectual property rights of any third party and that the Bidder has obtained all rights, grants, assignments, conveyances, licenses, permissions and authorizations necessary or incidental to any materials owned by third parties supplied or specified by Bidder to the Agency.

V. References

☐ If marked, Bidder must describe three references to the Agency illustrating examples in which Bidder has provided similar hardware, software, maintenance, and services to organizations of comparable size to the Agency. Bidder must provide the name and contact information for an individual employed by the customer. Bidder agrees that the Agency or its agents may contact any individual(s) named as references hereunder. References must be submitted in the format specified on the OSD business reference form, which is available at https://www.mass.gov/files/documents/2016/08/wd/business-reference-form_0.doc?_ga=2.37941354.891907013.1563542725-372871650.1562964984.

VI. Order of Precedence

The agreement resulting from this RFQ shall consist of the following documents in the following order of precedence:

VII. Additional Requirements

A. Enterprise Information Security Standards and Policies

All goods and services provided to the Commonwealth must comply with the Enterprise Information Security Standards and Policies (https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards).

B. Accessibility for IT Solutions Contract Language

The Commonwealth is obligated to ensure non-discrimination and equal access to state services on the part of persons with a disability and reasonable accommodations to state employees with a disability. To effectively meet its responsibilities, the Commonwealth must achieve accessibility in the acquisition, deployment, and utilization of information technology. The Commonwealth defines accessibility to include compliance with its Enterprise Accessibility Standards and Web Accessibility Standards. These standards encompass the principles of Section 508 of the Federal Rehabilitation Act, the World Wide Web Consortium’s Web Content Authoring Guidelines, version 2, level AA (WCAG2 Standards), and the concept of usability for individuals with disabilities. Bidders must comply with the accessibility obligations detailed at https://www.mass.gov/service-details/accessibility-for-it-solutions-contract-language.

Bidders must include, at no additional cost and as part of their bid, licenses authorizing the Commonwealth personnel (including without limitation Agency personnel or its contractors) to test the software in accordance with the Enterprise Accessibility Standards, and for to test for interoperability with the specific AT and IT environments set forth in the AT/IT Environment List. The software must be available to the Commonwealth for evaluation prior to EOTSS purchasing the software and on an ongoing basis after the Agency has purchased the software.

C. Contract Negotiation and Amendments

The Agency may negotiate changes to the original performance measures, quantities, Term length, and requirements identified in this RFQ at any time, provided that such changes are consistent with the scope of this RFQ. The Agency may negotiate and execute contract amendments with the awarded Bidder(s) which the Agency reasonably determines are within the scope of this RFQ and necessary to result in best value to the Commonwealth.

D. Promotional Materials

Bidder must not reference the Agency or the Commonwealth in any promotional or marketing materials, including but not limited to use of the Agency’s or the Commonwealth’s name or logo, without first obtaining the Agency’s prior written approval for such use. Bidder must not use the Commonwealth’s seal in any promotional or marketing materials.

Bidders are discouraged from including extraneous promotional or marketing materials in their responses and excessive promotional or marketing materials may detract from the Bidders’ overall score.

E. Pending Litigation

Bidder must affirm that there is no pending litigation involving the Bidder, Provider, or the goods and services provided in the response, that may impair or interfere with the Agency’s right to use the goods or services. Bidder must warrant that there are no actual or threatened actions arising from, or alleged under, any intellectual property rights of any third party.

F. Oral Presentations and Demonstrations

In its discretion, the Agency may invite one or more Bidders whose responses have been judged competitive and responsive in the course of the evaluation to participate in a facilitated oral presentation, including a demonstration of the proposed goods or services. The Agency may use these demonstrations and oral presentations to clarify aspects of the Bidder’s response or to inquire as to the Bidder’s approach, recommendations, and experience. The Agency may adjust its scoring of a prospective Bidder based on the Bidder’s performance during production demonstration and/or oral presentation.

The Agency reserves the right to apply restrictions to the structure and content of Bidder’s product demonstrations and oral presentations. Demonstrations and oral presentations shall not be open to the public nor to any competitors. The schedule of the demonstrations and oral presentations will be arranged directly with the Bidders selected by the Agency. Failure of a Bidder to agree to a date and time may result in rejection of the Bidder’s response.

Bidders must use publicly released products and operating systems in their demonstration. No pre-production products (e.g., “beta”) should be demonstrated. All Bidder-owned products used in the course of the demonstration must be listed and priced in its response to this RFQ.

G. Review Rights

Responses to this RFQ may be reviewed and evaluated by any person(s) at the discretion of the Agency including non-allied and independent consultants retained by the Agency for the sole purpose of evaluating and analyzing responses.

H. Omitted

I. Omitted

VIII. Bidder Responses

The following must be provided in each Bidder’s response:

1. A cover letter including Bidder’s relevant contact information and a statement that Bidder agrees to the terms of this RFQ.

2. A response to each Section (I – VII) of the RFQ in which Bidder identifies the means by which it shall comply with the terms in each Section.

3. A Business and Technical Response consisting of:

a. A description of the specific products or services offered.

b. Any details about warranty, maintenance, and support applicable to the products and services in Table 1. Note that warranty, maintenance, and support must be consistent with requirements set forth in the applicable statewide contract.

c. An unlocked, editable copy of any relevant warranty, maintenance agreement, technical support description and any other forms or agreements, including licensing agreements, related to the procurement of the Bidder’s proposed solution, submitted in MS Word format.

d. Timeframe for delivery of goods and/or services once a Purchase Order is issued.

e. If Bidder is bidding services:

i. A list of assumptions on which it is basing its bid, if any; and

ii. If Bidder is offering professional services in its Response, a redline (track changes) version of the statement of work attached hereto as Attachment B. Note that most of the standard terms of the SOW are nonnegotiable, but Bidders should insert descriptions of tasks, deliverables, and milestone dates as applicable.

4. A Cost Response consisting of:

a. A completed Table 1 above including relevant pricing. For maintenance, Bidder must clearly indicate the level of maintenance offered and include costs for different maintenance options (e.g., silver, gold, platinum).

b. If Bidder is offering professional services, include fully completed Tables within the SOW. Bidder’s proposed professional services rates must include all costs and expenses, including without limitation delivery services, travel and all other costs and expenses. Bidder must provide either a total fixed price cost for all deliverables and tasks, or a total not-to-exceed cost for all time and materials services. The response must include an hourly rate for additional time and materials work.

c. A valid quote based on items 4(a) and 4(b) above that can be used to issue a purchase order. The quote must include address and contact information for the person to whom the quote can be sent. All quotes must be valid for a minimum of ninety (90) days after the date of submission.

d. Bidders should avoid including additional components in their responses which are not expressly requested in this RFQ. If multiple options are available and responsive to this RFQ, Bidders must clearly identify the differences in cost and functionality of each option.

IX. Evaluation Criteria

The responses to this RFQ will be evaluated based on the criteria listed below, in descending order of importance with the most important criteria listed first. The procurement management team may remove from further consideration non-responsive bids and bids that do not include all required items listed in Section VIII (Bidder Responses). Prior to such an exclusion, the Agency may request one or more clarification(s) from Bidder. A Bidder’s response may be excluded for failure to meet the Agency’s budgetary thresholds.

Any remaining responses will be evaluated based upon:

1. Total Price

2. Time for delivery

ATTACHMENT A – COMMBUYS Instructions Interested Bidders must submit their response using COMMBUYS.

Useful links:

1. Job aid on how to submit a quote: http://www.mass.gov/anf/docs/osd/commbuys/create-a-quote.pdf

1. Webcast: How to Locate and Respond to a Bid in CommBuys, which will familiarize bidders with CommBuys terminology, basic navigation, and provide guidance for locating bid opportunities in CommBuys and submitting an online quote.

1. Bidders MUST have their complete bid fully loaded and submitted prior to the time and date listed in the calendar. COMMBUYS will not allow for bids to be submitted after the posted time.

Bidder may contact the CommBuys Help Desk at CommBuys@state.ma.us or call during normal business hours (8AM – 5PM, Monday – Friday) at 1-888-627-8283 or 617-720-3197.

Written questions via the Bid Q&A on COMMBUYS The “Bid Q&A” provides the opportunity for Bidders to ask written questions and receive written answers from the Strategic Sourcing Team (SST) regarding this Bid. All Bidders’ questions must be submitted through the Bid Q&A found on COMMBUYS (see below for instructions). Questions may be asked only prior to the Deadline for Submission of Questions stated in the Procurement Calendar. The issuing department reserves the right not to respond to questions submitted after this date. It is the Bidder’s responsibility to verify receipt of questions.

Please note that any questions submitted to the SST using any other medium (including those that are sent by mail, fax, email or voicemail, etc.) will not be answered. To reduce the number of redundant or duplicate questions, Bidders are asked to review all questions previously submitted to determine whether the Bidder’s question has already been posted.

Bidders are responsible for entering content suitable for public viewing, since all of the questions are accessible to the public. Bidders must not include any information that could be considered personal, security sensitive, inflammatory, incorrect, collusory, or otherwise objectionable, including information about the Bidder’s company or other companies. The PMT reserves the right to edit or delete any submitted questions that raise any of these issues or that are not in the best interest of the Commonwealth or this Bid.

All answers are final when posted. Any subsequent revisions to previously provided answers will be dated.

It is the responsibility of the prospective Bidder and awarded Bidder to maintain an active registration in COMMBUYS and to keep current the email address of the Bidder’s contact person and prospective contract manager, if awarded a contract, and to monitor that email inbox for communications from the Purchasing Department, including requests for clarification. The Purchasing Department and the Commonwealth assume no responsibility if a prospective Bidder’s/awarded Bidder’s designated email address is not current, or if technical problems, including those with the prospective Bidder’s/awarded Bidder’s computer, network or internet service provider (ISP) cause email communications sent to/from the prospective Bidder/Awarded Bidder and the Purchasing Department to be lost or rejected by any means including email or spam filtering.

Locating Bid Q&A Log into COMMBUYS, locate the Bid, acknowledge receipt of the Bid, and scroll down to the bottom of the Bid Header page. The “Bid Q&A” button allows Bidders access to the Bid Q&A page.

ATTACHMENT B – TEMPLATE STATEMENT OF WORK

STATEMENT OF WORK

BETWEEN

THE EXECUTIVE OFFICE OF TECHNOLOGY SERVICES AND SECURITY

AND

[CONTRACTOR NAME]

FOR THE

[PROJECT NAME]

1 1. INTRODUCTION

The following document will serve as a Statement of Work (“SOW”) between the Executive Office of Technology Services and Security (“EOTSS”) and [Contractor Name] (“Contractor”) governing Contractor’s work on the [Project Name]. The entire agreement (the “Agreement”) between the parties consists of the following documents, in the following order of precedence. In the event of a conflict, the document of higher precedence shall govern.

(1) the Commonwealth Standard Terms and Conditions

(2) the Commonwealth’s Standard Form Contract

(3) Request for Response [RFR NAME] (“RFR”)

(4) Contractor’s response thereto

(5) the Request for Quotes [RFQ NAME, RFQ NUMBER AND DATE] (“RFQ”)

(6) this SOW, including Appendix A, and any Task Orders or other documents negotiated between the parties under the RFQ

(7) Contractor’s response to the RFQ

2 2. DEFINITIONS

The following terms shall have the following meanings. All other terms used in this SOW shall have the meaning ascribed to them in the other documents that constitute the Agreement.

“Deliverable” means any work product that Contractor delivers for the purposes of fulfilling its obligations to EOTSS.

“Task” means a material activity engaged in by Contractor for the purpose of fulfilling its obligations to EOTSS.

“Task Order” means an amendment to this SOW that specifies Tasks or Deliverables to be completed by Contractor within a specified time period.

3 3. EFFECTIVE DATE AND TERM

This SOW’s term (the “Term”) begins on the date on that it is executed by both parties (the “Effective Date”) and shall terminate on [INSERT END DATE] (“Termination Date”) unless extended or renewed via written amendment executed by the parties.

4. PROJECT BACKGROUND AND OVERVIEW

[Provide background and high-level overview of project.]

5. FIXED PRICE TASKS AND DELIVERABLES

This Section describes the Tasks to be completed by the Contractor, the Deliverables to be provided by the Contractor, and a timeline for delivery. A Task or Deliverable will be considered “complete” when all the acceptance criteria set forth in this SOW have been met. All written Deliverables shall be delivered in a format specified by EOTSS. All meetings shall be held on-premises at the address of EOTSS, unless agreed to otherwise by the Project Managers.

For the Fixed Price Tasks and Deliverables of this Agreement, Contractor shall perform Tasks and deliver Deliverables in conformance with the Description and Metrics of Acceptance on or before the Due Dates set forth in Table 1. Upon acceptance by EOTSS of the Deliverables or Tasks, the amounts specified in Table 1 associated with each Deliverable or Task shall be payable to Contractor.

TABLE 1: FIXED PRICE TASKS AND DELIVERABLES

TOTAL

6 KEY PERSONNEL

6.1 EOTSS Project Manager

[NAME] ([email address], [phone number]) will serve as the [Agency] Project Manager (“PM”) and will: (i) work closely with the Contractor PM to ensure successful completion of the project; (ii) consult with Contractor PM to develop the Project Management Plan; (iii) review weekly status reports and schedule weekly meetings with Contractor, as necessary; (iv) coordinate participation from other agencies and/or vendors as required during the engagement; (v) acquire [Agency Abbreviation] project team members as needed; and (vi) coordinate [Agency Abbreviation]’s review of the Deliverables and sign an acceptance form to signify acceptance for each accepted Deliverable.

[OPTIONAL: [NAME] ([email address], [phone number]) will serve as the EOTSS Technical Project Manager (“Technical PM”) and will: (i) work closely with the EOTSS PM and Contractor PM to ensure successful completion of the project; (ii) consult with the EOTSS PM and Contractor PM to develop the Project Management Plan; and (iii) serve as a technical resource for Contractor PM and Contractor personnel.]

6.2 Contractor Project Manager

[NAME] ([email address], [phone number]) will serve as the Contractor Project Manager (the “Contractor PM”) and will (i) be responsible for administering this SOW and the managing of the day-to-day operations under this SOW, (ii) serve as an interface between the EOTSS PM and all Contractor personnel participating in this engagement; (iii) develop and maintain the Project Management Plan in consultation with the EOTSS PM; (iv) facilitate regular communication with the EOTSS PM, including weekly status reports/updates, and review the project performance against the project plan and facilitate weekly project status meetings for the duration of the engagement; (v) update the Project Management Plan on a weekly basis and distribute it at weekly meetings for the duration of the engagement; (vi) sign acceptance forms to acknowledge receipt; and (vii) be responsible for the management and deployment of Contractor personnel.

The EOTSS PM and Contractor PM bear the primary responsibility for issue resolution. If an issue cannot be resolved by the PMs, the EOTSS PM shall escalate to [NAME] and the Contractor PM shall escalate to [NAME]. The PMs shall be responsible for coordinating a meeting with EOTSS and Contractor leadership to review and resolve any issues.

6.3 Contractor Personnel

Contractor will provide the following personnel for the following (estimated) time commitment.

TABLE 2: PERSONNEL

If a change to the assigned personnel is necessary, the Contractor PM will provide a written change request at least two weeks prior to the change to the EOTSS PM. The EOTSS PM may reject or accept such change. Contractor shall take full responsibility for project management. Contractor shall ensure any subcontractor(s) providing work under this SOW comply with all terms of the Agreement and Contractor shall be responsible for the performance of each such subcontractor.

7. ACCEPTANCE OR REJECTION PROCESS

The Contractor PM will submit each Deliverable to the EOTSS PM on or before the Due Date specified in Table 1. EOTSS will review each Deliverable and determine whether it has met in all material respects the criteria established in this Agreement.

Within ten (10) business days of receipt of each Deliverable, the EOTSS PM will notify the Contractor PM, in writing, of acceptance or rejection. A rejection will include a written description of the defects of the Deliverable. If the EOTSS PM does not respond with acceptance or rejection within ten (10) business days of receipt, the Contractor PM shall provide a reminder notice to the EOTSS PM. Upon receipt of rejection of a Deliverable, Contractor will act diligently to correct the specified defects and deliver an updated version of the Deliverable to the EOTSS PM. Acceptance or rejection of the updated version of the Deliverable will be subject to the process described in this paragraph.

Following any acceptance of a Deliverable which requires additional work to be entirely compliant with the pertinent specifications, and until the next delivery, Contractor will use reasonable efforts to provide a prompt correction or workaround.

8. PAYMENT TERMS

A Deliverable or Task will be considered “completed” when the EOTSS PM has accepted the Deliverable or Task in accordance with Section 7 of this SOW. Contractor shall issue invoices to EOTSS for the Deliverables or Tasks that are completed (each, a “Valid Invoice”). Valid invoices shall be payable by EOTSS in accordance with the Commonwealth’s bill-paying policies.

Unless otherwise agreed to by the parties in the form of an executed written amendment hereto, the total amount payable to Contractor by EOTSS shall be the firm fixed price total of [TOTAL].

9. AMENDMENTS TO THE SOW

The SOW may be amended prior to the end of the Term. The PM who would like to request a change will provide the suggested amendment in writing to the other party’s PM. The PMs will jointly determine whether the change impacts any terms contained within the Agreement. The parties may mutually agree to the change through a written signed amendment to the SOW.

10. ADDITIONAL CONTRACTOR REQUIREMENTS

[Include any additional privacy / security requirements based on data being accessed or used by Contractor. Include additional technical specifications, support terms, etc. Refer to attached documents if needed.]

11. AUTHORITY TO EXECUTE

The undersigned hereby represent that they are duly authorized to execute this Statement of Work on behalf of their respective organizations. The signer on behalf of Contractor further represents that he/she is listed as an Authorized Signatory under the applicable Statewide Contract or RFR. This Statement of Work may be signed in two or more counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument.

The Executive Office of Technology [Enter Contractor Name] Services and Security

Signature: ______________________________ Signature: ______________________________

Name: _________________________________ Name: ________________________________

Title: __________________________________ Title: __________________________________

Date: __________________________________ Date: __________________________________

APPENDIX A

The following terms are entered into by and between the Commonwealth entity and the Contractor signing the Statement of Work (“SOW”) attached hereto. The term “Agency” as used in this Appendix A shall refer to the Commonwealth entity signing the SOW. The following terms cannot be modified unless a written waiver is provided by the Agency General Counsel, or designee. The following Sections shall continue in effect beyond the Termination Date of the SOW: 2, 3, 6, 8, 9, 10, and any other Sections that would under the circumstances reasonably extend beyond the Termination Date of the SOW.

1. Equipment and Workplace

The Agency will provide standard workspace, office equipment, and network connectivity, as provided to state employees, and as required to enable Contractor personnel working on-site to provide the services contemplated under the SOW. Contractor will submit a list of personnel who will need access to the building and to state systems before execution of the SOW. Any Contractor personnel who have access to IT resources must comply with the Acceptable Use of Information Technology Policy (https://www.mass.gov/policy-advisory/acceptable-use-of-information-technology-policy) and any other workplace policies provided to Contractor by Agency.

2. System Security

Contractor shall comply with the Commonwealth’s Enterprise Information Security Policies and Standards (https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards).

Contractor will be required to use data provided by Agency (“Commonwealth Data”) and will implement commercially reasonable safeguards necessary to: (i) prevent unauthorized access to Commonwealth Data from any public or private network; (ii) prevent unauthorized physical access to any information technology resources involved in the SOW project; and (iii) prevent interception and manipulation of Commonwealth Data during transmission to and from any servers.

If Contractor uses, or receives access or potential access to, Commonwealth personal data under M.G.L. c. 66A or personal information under M.G.L. c. 93H (collectively, “Commonwealth Personal Data”). Contractor shall implement the maximum feasible safeguards reasonably needed to: (i) ensure the security, confidentiality and integrity of electronic personal data and personal information; (ii) prevent unauthorized access to electronic personal data or personal information or any other Commonwealth Personal Data from any public or private network; and (iii) notify the Agency immediately if any breach of such system or of the security, confidentiality, or integrity of electronic personal data or personal information occurs.

If the Deliverables include software or code that will be developed by Contractor and migrated into a production environment, Contractor shall implement the following controls for the purpose of maintaining software integrity and traceability throughout the software or code creation life cycle, including during development, testing, and production: (i) Contractor shall configure at least two software environments including a development/quality assurance (QA) environment and a production environment; (ii) Contractor shall implement a change management procedure to ensure that activities in the development/QA environment remain separate and distinct from the production environment; (iii) Contractor shall segregate duties between development and testing of software changes and migration of changes to the production environment; (iv) Contractor shall implement security controls to restrict individuals who have development or testing responsibilities from migrating changes to the production environment; (v) Contractor shall create a process to log and review all source control activities; (vi) Contractor shall implement a source control tool to ensure that all changes made to the production system are authorized, tested, and approved before migration to the production environment; (vii) Contractor shall not make any development or code changes in a production environment; and (viii) Contractor shall implement additional internal controls as specified in the Agreement.

3. Accessibility Contractor shall comply with the obligations and requirements set forth in the Accessibility for IT Solutions Contract Language (https://www.mass.gov/service-details/accessibility-for-it-solutions-contract-language).

4. MassGIS Web Mapping Services

MassGIS is the Commonwealth’s Office of Geographic and Environmental Information. Its legislative mandate includes coordinating GIS activities in the Commonwealth’s public agencies and distributing GIS data. MassGIS has also developed and is the host for the Commonwealth’s e-government geospatial web mapping initiative.

If the Deliverables include the capability for viewing maps and related information on an internet web site and if that web site will display map information available through MassGIS web mapping services (e.g., parcels, orthophotos, streets, wetlands), then Contractor shall use MassGIS geospatial web mapping services. MassGIS may grant a waiver of this requirement if Contractor demonstrates to MassGIS’ satisfaction that using the MassGIS web mapping services for the proposed application is not reasonably practical due to one or more of the following: (i) performance of the application would be degraded due to using the MassGIS services; (ii) the proposed application requires reliability that exceeds those that MassGIS can reasonably be expected to provide; (iii) the security requirements of the application preclude using the MassGIS services; and (iv) cost. Waivers are not valid under this Agreement unless they are provided in writing by the Director or Assistant Director of MassGIS.

5. Code Review

If the Deliverables include software code or applications developed by Contractor for the Agency, such code or applications shall follow current industry design and best practices, including, but not limited to those published by The National Institute of Standards & Technology (NIST), the SANS (SysAdmin, Audit, Network, Security (SANS) Institute), and other recognized bodies.

Contractor shall cooperate with the Agency’s code review of the relevant software or application Deliverables. Prior to implementation or acceptance of a Deliverable, Contractor shall subject such Deliverable, if it includes software code or script, to independent application review by Agency or its delegated reviewer to validate that all applicable enterprise IT standards and security policies have been met, as well as other specifications as identified in this Agreement. The review shall be performed by individuals other than Contractor’s or Agency’s personnel who developed the Deliverables. For purposes of this requirement, "independent" may include other staff of the Agency provided that no direct reporting relationships exist between the development and review organizations.

6. Intellectual Property Rights

If the Deliverables include new software or code developed or created by Contractor for the Agency, the following Section 6 shall apply.

The term Property includes the following: (1) confidential, proprietary, and trade secret information; (2) trademarks, trade names, discoveries, inventions processes, methods and improvements, whether or not patentable or subject to copyright protection and whether or not reduced to tangible form or reduced to practice; and (3) works of authorship which are used by Contractor to complete its work under the SOW (which may consist of computer programs (in object and source code form), scripts, data, documentation, the audio, visual and audiovisual content related to layout and graphic presentation, text, photographs, video, pictures, animation, sound recordings, training materials, images, techniques, methods, algorithms, program images, text visible on the Internet, HTML code and images, illustrations, graphics, pages, storyboards, writings, drawings, sketches, models, samples, data, other technical or business information, reports, and other works of authorship fixed in any tangible medium).

Contractor’s work under the SOW may involve: (1) a third party’s intellectual property; (2) Property created by Contractor for the open market (e.g. Contractor’s commercial off the shelf software); (3) Property developed by Contractor for other individual clients or for internal purposes prior to the Effective Date of the SOW and not delivered to any other client of Contractor; or (4) Property developed by Contractor specifically for the purposes of fulfilling its obligations to Agency under the terms of the Agreement. Ownership of the first and second categories of intellectual property is addressed in separate agreements. This Section 6 addresses exclusively ownership rights in the third and fourth categories of Property.

Contractor will retain all right, title and interest in and to all Property referenced in subsection (3) of the paragraph immediately preceding (hereinafter the "Contractor Property"). The Agency’s possession, installation or use of Contractor Property will not transfer to it any title to such property. The Agency acknowledges that Contractor Property may contain commercially valuable and proprietary trade secrets of Contractor, the development of which may involve the expenditure of substantial time and money and the use of skilled experts. The Agency will take no affirmative steps to disclose such information to third parties, provided that the Agency may do so if required under the Commonwealth’s Public Records Law, M.G.L. c. 66 § 10, or by legal process.

Except as expressly authorized herein, the Agency will not copy, modify, distribute or transfer by any means, display, sublicense, rent, reverse engineer, decompile or disassemble Contractor Property. Contractor grants to Agency a fully-paid, royalty-free, non-exclusive, non-transferable, worldwide, irrevocable, perpetual, assignable license to make, have made, use, reproduce, distribute, modify, publicly display, publicly perform, digitally perform, transmit, copy, sublicense to any Agency contractor for purposes of creating, implementing, maintaining or enhancing a Deliverable, and create derivative works based upon Contractor Property, in any media now known or hereafter known, to the extent the same are embodied in the Deliverables, or otherwise required to exploit the Deliverables. During the Term of this Agreement and immediately upon any expiration or termination thereof for any reason, Contractor will provide to Agency the most current copies of any Contractor Property to which Agency has rights pursuant to the foregoing, including any related documentation.

Notwithstanding anything contained herein to the contrary, and notwithstanding Agency’s use of Contractor Property under the license created herein, Contractor shall have all the rights and incidents of ownership with respect to Contractor Property, including the right to use such property for any purpose whatsoever and to grant licenses in the same to third parties. Contractor shall not encumber or otherwise transfer any rights that would preclude a free and clear license grant to the Commonwealth.

In conformance with the Commonwealth’s Standard Terms and Conditions, all Deliverables created under this Agreement whether made by Contractor, subcontractor, or both are the property of the Agency, except for the Contractor Property embodied in the Deliverable. Contractor irrevocably and unconditionally sells, transfers and assigns to the Agency or its designee(s), the entire right, title, and interest in and to all intellectual property rights that it may now or hereafter possess in said Deliverables, except for the Contractor Property embodied in the Deliverables, and all derivative works thereof. This sale, transfer and assignment shall be effective immediately upon creation of each Deliverable and shall include all copyright, patent, trade secret, trademark and other intellectual property rights created by Contractor or subcontractor in connection with such work (hereinafter the "Commonwealth Property").

All copyrightable material contained within a Deliverable and created under this Agreement are works made for hire. Contractor bears the burden to prove that a work within a Deliverable was not created under this Agreement. If work is determined to not be made for hire or that designation is not sufficient to secure rights, to the fullest extent allowable and for the full term of protection otherwise accorded to Contractor under such law, Contractor shall and hereby irrevocably does, assign and transfer to the Agency free from all liens and other encumbrances or restrictions, all right, title and interest that Contractor may have or come to have in and to such Deliverable. CONTRACTOR HEREBY WAIVES IN FAVOR OF THE AGENCY (AND SHALL CAUSE ITS PERSONNEL TO WAIVE IN FAVOR OF CLIENT IN WRITING SIGNED BY SUCH PERSONNEL) ANY AND ALL ARTIST’S OR MORAL RIGHTS (INCLUDING, WITHOUT LIMITATION, ALL RIGHTS OF INTEGRITY AND ATTRIBUTION) IT MAY HAVE PURSUANT TO ANY STATE OR FEDERAL LAWS OF THE UNITED STATES IN RESPECT TO ANY DELIVERABLE AND ALL SIMILAR RIGHTS UNDER THE LAWS OF ALL OTHER APPLICABLE JURISDICTIONS.

Contractor agrees to execute all documents and take all actions that may be reasonably requested by the Agency to evidence the transfer of ownership of or license to intellectual property rights described in this Section 6, including providing any code used exclusively to develop such Deliverables to the Agency and the documentation for such code. Contractor acknowledges that there are currently and that there may be future rights that the Commonwealth may otherwise become entitled to with respect to Commonwealth Property that does not yet exist, as well as new uses, media, means and forms of exploitation, current or future technology yet to be developed, and that Contractor specifically intends the foregoing ownership or rights by the Commonwealth to include all such now known or unknown uses, media and forms of exploitation.

The Commonwealth retains all right, title and interest in and to all derivative works of Commonwealth Property. The Agency hereby grants to Contractor a nonexclusive, revocable license to use, copy, modify and prepare derivative works of Commonwealth Property only during the Term and only for the purpose of performing services and developing Deliverables for the Agency under this Agreement.

If Contractor’s Tasks and Deliverables include development of a web site, the Agency will bear sole responsibility for registering the software or system domain name or URL, applying for any trademark registration relating to the software or system domain name or URL and applying for any copyright registration related to its copyright ownership with respect to any Commonwealth Property.

If the Deliverables contain or will contain any third-party intellectual property to which Contractor intends to provide a sublicense, Contractor must provide copies of all such sublicense agreements as early in the process as possible. The sublicense agreements must be included in Contractor’s initial quotation to the Agency, or, if the requirement to utilize sublicensed intellectual property is not known at the outset of the project, as soon as the requirement becomes known. Sublicenses to third-party intellectual property can ONLY be provided under RFR if they are provided at no charge to the Commonwealth.

7. Software Escrow If the Agency is purchasing a system based on code that will not be owned by the Commonwealth, upon the Agency’s request, Contractor shall deposit such code or components thereof in escrow, and Contractor and Agency shall enter into a separate agreement governing the terms of the escrow account (the “Escrow Agreement”) on or…