RFQ__24-021_-_ePoll_Book_-_KNOWiNK_Poll_Pad_3_Version_3.9.pdf

Contract Services | Management Services Division | 1500 11th Street, Suite 460

Sacramento, CA 95814 | Tel 916.653.5974 | www.sos.ca.gov

Request for Quotation (RFQ)

For Information Technology Services

Electronic Poll Book - KNOWiNK Poll Pad 3 Version 3.9

QUOTE DUE DATE: 3/12/2025

Quotes must be delivered to Secretary of

State’s Office before 4:00 PM on the due date

Supplier name and address:

SOLICITATION NO. REV. # DATE

24-021 ______ 2/27/2025

REQUISITION OR CONTROL #

Contact:

Phone: Fax:

For further information contact:

Secretary of State Contract Services Unit contractservices@sos.ca.gov

Ship To: (see below or bid document)

ARE YOU CLAIMING PREFERENCE AS A SMALL

BUSINESS?

YES ________ NO ________

IF YES, MANUFACTURER?

ARE YOU A NON-SMALL BUSINESS CLAIMING AT

LEAST 25% SMALL BUSINESS SUBCONTRACTOR

PREFERENCE?

Name (Print):

Title:

Signature:

Date:___________

Federal Employer Identification Number:

Return bid to:

Attn: Contract Services Unit 1500 11th Street, Room 460 Sacramento, CA 95814

SECTION 14838 ET SEQ. OF THE CALIFORNIA

GOVERNMENT CODE REQUIRES THAT A 5%

PREFERENCE BE GIVEN TO BIDDERS WHO QUALIFY

AS A SMALL BUSINESS AS A NON-SMALL BUSINESS

CLAIMINIG AT LEAST 25% CALIFORNIA CERTIFIED

SMALL BUSINESS PARTICIPATION FOR

REQUIREMENTS SEE TITLE 2, CALIFORNIA CODE OF

REGULATIONS SECTION 1896 ET SEQ. THE

REQUIREMENTS FOR NONPROFIT VETERAN SERVICE

AGENCIES QUALIFYING AS A SMALL BUSINESS ARE

CONTAINED IN SECTION 999.50 ET SEQ. OF THE

MILITARY AND VETERANS CODE.

Bidder offers and agrees if this response is accepted within 45 calendar days following the date the response is due to furnish all the items upon which prices are quoted, at the prices set opposite each item, delivered at the designated point(s) by the method of delivery and within the times specified and subject to the attached General Provisions. DECLARATIONS UNDER PENALTY OF PERJURY; By signing above, with inclusion of the date of signature, the above signed bidder DECLARES UNDER PENALTY OF PERJURY under the laws of the State of California as follows: (1) (STATEMENT OF COMPLIANCE). The above signed as complied with the non-discrimination program requirements of Government Code 12990 and Title 2, California Administrative Code Section 8103, and such declaration is true and correct. (2) The National Labor Relations Board declaration set forth in Paragraph 48 of the General Provisions is true and correct. (3) If a claim is made for the Small Business or Disabled Veterans Business preference, the information set forth within is true and correct.

DESCRIPTION

The purpose of this contract is to provide the Secretary of State's Office of Voting Systems Technology Assessment with the necessary expertise and resources to allow the Secretary of State to make a determination on the accuracy, efficiency, and security of the KNOWiNK Poll Pad 3 Version 3.9, pursuant to the California Electronic Poll Book Regulations sections 20150 to 20165.

The following are incorporated as part of this Request for Quote for IT Services:

1. Requirements, including quote details and cost proposal and all attachments.

2. State’s Standard Agreement (STD 213); see Section I General Information, Sub-section 7.P of this RFQ.

3. Bidder Instructions DGS PD 451 Rev. 11/9/2011) can be located at: https://www.dgs.ca.gov/PD/Search-

Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets; the General Provisions - Information Technology (GSPD-ITGP(Non-Cloud) Rev. 2/20/25) can be located at:

https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Required-Language-for-Solicitations-and-Contracts?search=Bidders%20Instructions http://www.sos.ca.gov/ mailto:contractservices@sos.ca.gov https://www.dgs.ca.gov/PD/Search-Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets https://www.dgs.ca.gov/PD/Search-Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets https://www.dgs.ca.gov/PD/Search-Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Required-Language-for-Solicitations-and-Contracts?search=Bidders%20Instructions https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Required-Language-for-Solicitations-and-Contracts?search=Bidders%20Instructions

RFQ #24-021

Table of Contents

I. General Information

1. Purpose………………………………………………………………………………….……..3

2. Availability……………………………………………………………………………….…….3

3. Period of Performance……………………………………………………………….……..3

4. Key Action Dates……………………………………………………………………….……4

5. Written Questions……………………………………………………………………….……4

6. RFQ Response Guidelines…………………………………………………………….…….4

7. RFQ Response Content……………………………………………………………….…….6

II. Evaluation Information

1. Evaluation Criteria………………………………………………………………………

2. Award of Contract……………………………………………………………….………...12

3. Disposition of Bids………………………………………………………………………..….13

4. Protests…………………………………………………………………………………..……14

III. Exhibit A - Scope of Work

1. Purpose……………………………………………………………………………………

2. Contractor Tasks

3. Qualifications, Skills and Experience

4. Contractor’s Responsibilities………………………………………………………….…..30

5. State Responsibilities……………………………………………………………………….31

6. Contract Contact Information…………………………………………………………..32

7. Appendix A – System Description & Configuration

8. Appendix B – Vendor Non-Disclosure Agreement

IV. Attachments

1. Response Checklist

2. Cover Letter…………………………………………………………………………………41

3. Cost Worksheet

4. Customer Experience Reference Form………………………………………………...43

5. Payee Data Record (Std. 204)…………………………………………………………...44

6. Declaration Forms

1. Bidder Declaration Form

2. CA Disabled Veteran Business Enterprise (DVBE) Program Requirement…….45

7. California Civil Rights Laws Certification (DGS OLS 04 Rev. 01/17)……………

Electronic Poll Book - KNOWiNK Poll Pad 3 Version 3.9

Requirements

You are invited to review and respond to this Request for Quote (RFQ) for IT Services, entitled Secretary of State, RFQ #24-021 – Electronic Poll Book - KNOWiNK Poll Pad 3

Version 3.9. In submitting your quote, you must comply with the instructions found herein. The services required are described in the Scope of Work (SOW). Please read the enclosed document carefully. Quotes must be received no later than the date and time specified on the face of this RFQ and in Section I.4. Key Action Dates.

I. General Information

1. Purpose

The purpose of this contract is to provide Electronic Poll Book Test Support

Services to assist the Secretary of State with the evaluation of KNOWiNK Poll

Pad Version 3.9 as defined in Appendix A, for suitability and for use in California in accordance with the proposed California Code of Regulations sections

20150 to 20165. All Electronic Poll Book Systems submitted for certification will be tested for adherence to the proposed California Electronic Poll Book

Regulations.

Exhibit A – Scope of Work identifies the overall process, work and deliverables required for providing these services. Please carefully review this documentation for complete information and details.

2. Availability

The selected Contractor must be able to meet the requirements of this RFQ and be ready to begin work within ten (10) business days of the anticipated contract award date specified in Section I.4. Key Action Dates.

3. Period of Performance

The term of this Agreement shall begin on the date as indicated on the

Standard Agreement (STD 213) provided to the awarded Contractor, which is anticipated to be March 31, 2025 through June 30, 2026.

The contractor shall not be authorized to deliver or commence performance of services as described in this Scope of Work (SOW) until written approval has been obtained from all entities. No delivery or performance of service may commence prior to the execution of the Agreement.

4. Key Action Dates

Listed below are the key action dates and times by which the actions must be taken or completed. If the State finds it necessary to change any of these dates, it will be accomplished via an addendum to this RFQ.

Key Action Dates Date

1. Release of RFQ February 27, 2025

2. Submission of written questions March 5, 2025

3. Department’s response to written questions March 7, 2025

4. Submission of Quotes (by date and time) March 12, 2025, 4:00pm

5. Anticipated Notice of Intent to Award March 17, 2025

6. Anticipated Contract Award March 25, 2025

All dates after the Submission of Quotes (date and time) are approximate and may be changed if needed to allow the State additional time for evaluation and contract execution.

5. Written Questions

All questions regarding the content of this RFQ must be submitted in writing mail or sent electronically to ContractServices@sos.ca.gov and must be received by the Key Action Dates identified above. Questions not submitted in writing by the Key Action Date for submission of written questions shall be answered at the State’s option.

When the State has completed its review of the questions, all of the questions and answers will be posted on the California eProcurement Portal at:

https://caleprocure.ca.gov.

6. RFQ Response Guidelines

A. Response Submission

This RFQ shall be incorporated by reference and made part of the resulting

Agreement, as if attached. However, the Bidder’s quote in response to this

RFQ shall be made a part of the resulting Agreement. Responses to this RFQ must contain all data/information requested and must conform to the format described in this RFQ. It is the Bidder’s responsibility to provide all required data and any other information deemed necessary for the State’s mailto:ContractServices@sos.ca.gov https://caleprocure.ca.gov/ evaluation team to determine and verify the Bidder’s ability to perform the tasks and activities defined in the SOW.

In accordance with the Bidders Instructions, please submit quotes in writing via postal mail or hand-delivery to the SOS, at the address provided in the

RFQ front page (“Return bid to;” section on Front Page 1), by date and time shown above in Section I.D. Key Action Dates. Additionally, for the attachments required to be submitted with the Bidder’s response that require signature(s), the use of Electronic Signatures (eSignature) is also being permitted. eSignatures will be accepted and are legally binding and equivalent to handwritten signatures. The package or electronic submission containing the quote must be plainly marked with the RFQ number and title and show your firm name and address.

Facsimile machine responses will be considered only if they are sent to (916)

653-8324 for solicitations originating from the SOS, Contract Services Unit of the Business Operations Bureau. Responses sent to any other SOS fax number will not be considered. All pages of the faxed response that are received prior to the Submission of Quotes (by date and time) specified in

Section I.4. Key Action Dates will be considered “the complete response”.

Please be advised that there may be a heavy demand placed on the fax machine receiving responses and the State assumes no responsibility if a

Bidder cannot transmit their response via fax, and/or if the entire response is not received prior to the Submission of Quotes (by date and time).

If the Bidder chooses to transmit their response via E-mail, responses must be sent to contractservices@sos.ca.gov and it is suggested that all attachment(s) be submitted in .PDF format. In order to be considered as part of the response, all attachment(s) must be able to be opened, clearly viewed, and printed. Additionally, the State assumes no responsibility if the entire response is not received prior to the Submission of Quotes (by date and time) specified in Section I.4. Key Action Dates, and/or that may be blocked by the SOS secured E-mail filter. Please Note: The SOS will not confirm receipt of quotes submitted via E-mail and/or if any attachment(s) can be opened.

B. Qualifications to Do Business in California

All corporations, limited liability companies (LLC) and limited partnerships

(LP) are required to be registered with the California Secretary of State

(SOS) in order to do business* in the state of California. Before contract award can be made, the Contractor must be currently registered and in

“Active” status with the California SOS, as required by law, to do business in

California; this applies to domestic entities (organized or commercially mailto:contractservices@sos.ca.gov domiciled in the state of California) and foreign entities (organized or commercially domiciled outside of California).

During the response evaluation process, the State will verify if the Bidder is currently registered and in good standing (i.e., “Active” status) with the

California SOS, as applicable, in order to ensure that all obligations due to the State are fulfilled. Therefore, a certificate of status is not required to be submitted with the bidder’s response.

* “Doing business” is defined in the California Revenue and Taxation Code §

23101 as “actively engaging in any transaction for the purpose of financial or pecuniary gain or profit”. Although there are some statutory exceptions to taxation, rarely will a contractor performing within the state not be subject to the applicable franchise tax.

C. Loss Leader:

It is unlawful for any person engaged in business within this state to sell or use any article or product as a “loss leader” as defined in Section 17030 of the

Business and Professions Code. (PCC 12104.5(b).).

D. Federal Debarment, Suspension, Ineligibility and Voluntary Exclusion

Pursuant to federal law, by responding to a Secretary of State solicitation and/or signing an awarded agreement or execution of a purchase order which will be paid for using Federal Funds, the Contractor certifies under the penalty of perjury that the contracting entity is not excluded or ineligible from federal assistance programs and thereby is not on the federal government’s list of suspended or debarred entities.

Pursuant to federal law, as a component of the procurement process, when responding to an SOS solicitation, the Contractor must review the federal government’s list of debarred and suspended vendors and ensure no contract sub-award is provided to a vendor on this list. This list may be viewed at: www.sam.gov

7. RFQ Response Content

For further information and details, please refer to the Bidder Instructions (DGS

PD 451 Rev. 11/9/2011) at the following link:

https://www.dgs.ca.gov/PD/Search-

Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52 f5e77df36&activeFilters=division-or-office-facets;

The following documents, as identified, are required, and must be submitted in the RFQ response or your response may be deemed non-responsive:

http://www.sam.gov/ https://www.dgs.ca.gov/PD/Search-Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets https://www.dgs.ca.gov/PD/Search-Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets https://www.dgs.ca.gov/PD/Search-Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets

A. Cover Letter – Attachment 2 (completed)

The RFQ Cover Sheet (page 1) and the Cover Letter included in this RFQ as

Attachment 2 must be completed and submitted with the bidder’s response.

B. Cost Worksheet- Attachment 3 (completed)

Bidder must complete the cost sheet that identifies total cost as described in the SOW using the format in Attachment 3 – Cost Worksheet.

C. Customer Experience Reference Form - Attachment 4 (completed)

The bidder must submit with their response, three (3) client references for whom services have been performed, similar in scope and complexity to the services to be performed under this Agreement (as outlined in Exhibit A

– Scope of Work (SOW)). In accordance with this requirement, the bidder shall complete one (1) Customer Experience Reference Form, for each reference. Reference information shall include company/organization name, contact representative name and telephone number, project name/description and a description of the services performed. The description of services performed must be detailed and comprehensive enough to permit the State to assess the similarity of the referenced projects/experience to the services to be performed under the Agreement.

D. Payee Data Record (STD 204) – Attachment 5

The successful bidder will be required to submit a Payee Data Record form

(STD 204), listing their Taxpayer Identification Number, prior to contract awards.

E. Declaration Forms – Attachment 6

The bidder must complete the forms as identified in Attachment 6 and submit with the bidder’s response.

1. Bidder Declaration Form (DGS PD 05-105 (written))

2. CA Disabled Veteran Business Enterprise (DVBE) Program

Requirement (DGS PD 843 (Rev. 9/2019))

F. California Civil Rights Laws Certification (DGS OLS 04 Rev. 01/17) –

Attachment 7

The bidder must complete and sign/date a DGS OLS 04 form as identified in

Attachment 7 and submit the completed form along with their response to this RFQ. Failure to submit this completed form shall cause the response to this RFQ to be considered non-responsive. See Attachment 7 for complete information and details regarding this requirement.

G. DVBE Participation

The State has established goals for Disabled Veteran Business Enterprises

(DVBE) participating in State contracts. The minimum DVBE participation percentage (goal) is 3% for this solicitation. Please review the DVBE program requirements and information at:

https://caleprocure.ca.gov/pages/sbdvbe-index.aspx and forms at: https://www.dgs.ca.gov/PD/Forms

Bidders must complete and return all the appropriate pages in order for the quote to be considered responsive.

The Secretary of State’s Office has waived the application of the DVBE

Incentive for this solicitation. Therefore, no additional incentive points will be applied during the evaluation process of this RFQ; however, bidders must still meet the minimum DVBE participation percentage (goal) of 3% for this solicitation and are required to submit the following as part of their response to this RFQ: Std 843 (DVBE Declaration), and DGS PD-05-105 (Bidder

Declaration - Written) for the named DVBE(s) (See Attachment6 of this RFQ).

All Bidders must meet the 3% goal for this solicitation; failure to submit all required forms and fully document and meet the DVBE program requirement shall be considered non-responsive.

H. Small Business Regulations

The Small Business regulations are located in the California Code of

Regulations (Title 2, Division 2, Chapter 3, Subchapter 8, Section 1896 et.

seq.), concerning the application and calculation of the small business preference, small business certification, responsibilities of small business, department certification, and appeals. The regulations can be viewed at:

https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-

Division-Resources-List-Folder/Notice-of-Rulemaking-Regulations-for-SB-DVBE.

For those without Internet access, a copy of the regulations and/or further information can be obtained by calling the Office of Small Business and

DVBE Services at (916) 375-4940.

I. Non-Small Business Subcontractor Preference

A 5% bid preference is now available to a non-small business claiming 25%

California certified small business subcontractor participation. If applicable, claim the preference in the box on the right-hand side of the first page of this solicitation.

https://caleprocure.ca.gov/pages/sbdvbe-index.aspx https://www.dgs.ca.gov/PD/Forms https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Notice-of-Rulemaking-Regulations-for-SB-DVBE https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Notice-of-Rulemaking-Regulations-for-SB-DVBE

J. Small Business Nonprofit Veteran Service Agencies (SB/NVSA)

SB/NVSA prime bidders meeting requirements specified in the Military and

Veterans Code Section 999.50 et seq. and obtaining a California certification as a small business are eligible for the 5% small business preference. If applicable, claim the preference in the box on the right-hand side of the first page of this solicitation.

K. Attachment With Quote Required If Claiming the Small Business Preference

All bidders must complete and include the Bidder Declaration form DGS PD

05-105. If claiming the non-small business subcontractor preference, the form must list all of the California certified small businesses with which you commit to subcontract in an amount of at least twenty-five percent (25%) of the net bid price. All certified small businesses must perform a

“commercially useful function” in the performance of the contract as defined in Government Code Section 14837(d)(4).

Bidder Declaration form DGS PD 05-105 can be searched and located here:

https://www.dgs.ca.gov/PD/Forms

L. Small Business Certification

Bidders claiming the small business preference must be certified by

California as a small business or must commit to subcontract at least 25% of the net bid price with one or more California certified small businesses.

Completed certification applications and required support documents must be submitted to the Office of Small Business and DVBE Services (OSDS) no later than 5:00 p.m. on the bid due date, and the OSDS must be able to approve the application as submitted. Small business nonprofit veteran service agencies (SB/NVSA) claiming the small business preference must possess certification by California prior to the day and time bids are due.

Questions regarding certification should be directed to the OSDS at (916)

375-4940.

M. Declaration Forms - All bidders must complete the Bidder Declaration (DGS

PD 05-105) and include it with the bid response.

When completing the declaration, bidders must identify all subcontractors proposed for participation in the contract. Bidders awarded a contract are contractually obligated to use the subcontractors for the corresponding work identified unless the State agrees to a substitution, and it is incorporated by amendment to the contract. The Bidder Declaration form can be located at the link below:

Bidders who have been certified by California as a DVBE (or who are bidding rental equipment and have obtained the participation of subcontractors certified by California as a DVBE) must also submit a completed form(s) STD. 843 (Disabled Veteran Business Enterprise

Declaration). All disabled veteran owners and disabled veteran managers of the DVBE(s) must sign the form(s). Should the form not be included with the solicitation, contact the State contracting official or the form can be searched and located at the link below. The completed form must be included with the bid response:

N. Clarifying Information

At the State’s option prior to award, bidders may be required to submit additional written clarifying information. Failure to submit the required written information as specified may be grounds for bid rejection.

O. Contract Formation

The Agreement resulting from this procurement will be prepared using the

State’s Standard Agreement (STD 213) form, including all required exhibits;

Exhibits will include a copy of the awarded Contractor’s response to this

RFQ, other provisions as applicable and references to the General Provisions

- Information Technology (GSPD-ITGP(Non-Cloud) Rev. 2/20/25) and this RFQ document (as if attached).

The awarded Contractor will be provided the prepared contract document via DocuSign, as applicable upon award, and will be required to review and sign the contract for SOS execution. Once fully executed and approved accordingly, an executed copy of the contract will be provided to the Contractor. Please see the sample Standard Agreement (STD 213) form, IT General Provisions link, and mentioned exhibits below.

a. Standard Agreement (STD 213)

b. IT General Provisions - Information Technology (GSPD-ITGP(Non-

Cloud) Rev. 2/20/25) https://www.dgs.ca.gov/PD/Resources/Page-

Content/Procurement-Division-Resources-List-Folder/Required-

Language-for-Solicitations-and-

Contracts?search=standard%20contract%20language https://www.dgs.ca.gov/PD/Forms https://www.dgs.ca.gov/PD/Forms https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Required-Language-for-Solicitations-and-Contracts?search=standard%20contract%20language https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Required-Language-for-Solicitations-and-Contracts?search=standard%20contract%20language https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Required-Language-for-Solicitations-and-Contracts?search=standard%20contract%20language https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Required-Language-for-Solicitations-and-Contracts?search=standard%20contract%20language

II. Evaluation Criteria

Each RFQ response will be checked for the presence of requirement information in conformance with the submission requirements of this RFQ. The department will evaluate each RFQ response to determine its responsiveness to the requirements.

1. Evaluation Criteria

The overall responsiveness of each RFQ response is based on the complete response from the bidder to the RFQ requirements, including the scope of work for the project. The following three sub-sections and criteria will be reviewed by the State’s evaluation team.

A. Administrative Requirements Evaluation Criteria (Pass/Fail)

Example:

Requirement Pass Fail Comments

1. Completed RFQ Cover Sheet (page 1) and Cover Letter (Attachment 2)

2. Completed Cost Worksheet (Attachment

3)

3. Completed Customer Experience

References Forms (Attachment 4); for three (3) client references.

4. Payee Data Record (Std 204)

(Attachment 5)

5. Completed Bidder Declaration (DGS PD

05-105 Form); including list of

Subcontractors, as applicable

(Attachment 6).

6. Completed DVBE Declarations (STD. 843

Form) (Attachment 6)

7. Completed California Civil Rights Laws

Certification (DGS OLS 04) (Attachment

7)

8. Any other Administrative requirements, as applicable (I.e., Verification of entity status, SB, etc.)

B. Technical Requirements Evaluation Criteria (Pass/Fail)

Example:

Requirement Pass Fail Comments

a. At least 3 years of proven experience testing voting systems hardware, and/or software and/or firmware, including projects of equivalent size, scope and complexity.

b. At least 5 years of proven experience conducting source code review and analysis. The Contractor must provide with their proposal copies of deliverables it has prepared.

c. At least 3 years of proven experience with conduction hardware, software and firmware testing for a government entity.

d. Capability to perform benchmark and verification testing by utilizing hash values and imaging software.

e. Knowledge of PCI and PCI DSS

Requirements.

f. At least one (1) individual on the test team must have a valid Certified Information

Systems Security Professional (CISSP)

Certification.

C. Cost

This will be a low-cost award based upon responses that pass all requirements of the Administrative and Technical evaluation criteria.

2. Award of Contract

Award of contract, if made, will be in accordance with the RFQ information on evaluation to a responsible bidder whose bid complies with all the requirements of the RFQ documents and an addendum thereto, except for such immaterial defects as may be waived by the State. Award, if made, will be made within forty-five (45) days after the scheduled date for Contract

Award as specified in the RFQ; however, a bidder may extend the offer beyond 45 days in the event of a delay of contract award.

The State reserves the right to determine the successful bidder(s) either on the basis of individual items or on the basis of all items included in its RFQ, unless otherwise expressly provided in the State’s RFQ. Unless the bidder specifies otherwise in its bid, the State may accept any item or group of items of any bid. The State reserves the right to modify or cancel in whole or in part it’s RFQ.

Written notification of the State’s intent to award will be made to all bidders. If a bidder, having submitted a bid, can show that its bid, instead of the bid selected by the State, should be selected for contract award, the bidder will be allowed five (5) working days to submit a Notice of Intent to Protest, according to the instructions contained in the section titled “Protests” of this

RFQ.

3. Disposition of Bids

A. By submitting a bid, bidder agrees to the terms and conditions stated in this

RFQ, Exhibit A - SOW and the resulting Contract. Responses received after the Response Due Date may not be assessed. Quotes received in response to the SOW will be valid for one hundred eighty (180) days after the

Response Due Date.

B. Submitting responses that include assumptions, added conditional statements or statements regarding changes to the SOW in this RFQ may result in the offer being found as non-responsive.

C. Submitting documents marked as “Confidential”, “Proprietary” or otherwise appearing to contain sensitive information that the State considers an information security breach, constitutes grounds to reject the offer as non-responsive. Bids rejected for this reason will have all pages containing sensitive information purged from the offer prior to Award of the contract pursuant to this RFQ.

D. Upon review of the bids received and subsequent Contract Award, all documents submitted in response to this RFQ shall become the property of the State of California and shall be regarded as public records under the

California Public Records Act (Government Code Section 7920.000 et seq.), thereby subject to review by the public.

E. The State, at its discretion, reserves the right not to make an award or reject all offers, in the best interest of the State.

4. Protests

Any bidder’s issues regarding solicitation requirements must be resolved (or attempts to resolve them must have been made) before a protest may be submitted according to the procedure below. These issues will first be resolved by the contact for the solicitation or, if they result in a protest, the protest will be submitted to DGS, Office of Legal Services to hear and resolve issues and whose decision will be final.

If a bidder has submitted a bid which it believes to be responsive to the requirements of the RFQ and to be the bid that should have been selected according to the evaluation procedures in the solicitation and the bidder believes the State has incorrectly selected another bidder for award, the bidder may submit a protest of the selection as described below. Protests regarding selection of the “successful vendor” will be heard and resolved by the Victim Compensation and Government Claims Board whose decision will be final.

All protests of award must be made in writing, signed by an individual authorized to bind the bidder contractually and financially, and contain a statement of the reason(s) for protest; citing the law, rule, regulation, or procedure on which the protest is based. The protester must provide facts and evidence to support the claim. Protests must be submitted to both the following:

a. Department of General Services, Office of Legal Services

Attn: Bid Protest Coordinator

707 Third Street, 7th Floor, Suite 7-330

West Sacramento, CA 95605

Email: OLSProtests@dgs.ca.gov

b. Secretary of State

Attn: Contract Services

1500 11th Street, 4th Floor, Room 460

Email: contractservices@sos.ca.gov

All protests to the RFQ or protests concerning the evaluation, recommendation, or other aspects of the selection process must be received by the DGS

Procurement Division Deputy Director as promptly as possible, but not later than the date indicated in the Notification of Intent to Award. Certified or registered mail must be used unless delivered in person; in which case the protester should obtain a receipt of delivery.

mailto:OLSProtests@dgs.ca.gov

III. Exhibit A - Scope of Work

1. Purpose

The purpose of this contract is to provide Electronic Poll Book Test Support Services to assist the Secretary of State with the evaluation of KNOWiNK Poll Pad Version 3.9 as defined in Appendix A, for suitability and for use in California in accordance with the proposed California Code of Regulations sections 20150 to 20165. All

Electronic Poll Book Systems submitted for certification will be tested for adherence to the proposed California Electronic Poll Book Regulations.

This scope of work identifies the overall process, work and deliverables required for testing and evaluation of the Electronic Poll Book System described in Appendix A.

However, changes to the testing process, work and deliverables may occur and the Contractor shall assist the Secretary of State as needed.

The process for an Electronic Poll Book System to be tested and evaluated begins with the Electronic Poll Book Systems Vendor applying for Electronic Poll Book

Systems testing and approval through the Secretary of State. The Secretary of

State will then notify the Contractor to begin work on testing the Electronic Poll

Book System. The test and evaluation of Electronic Poll Book Systems consists of (a) functional testing, (b) software review, (c) security and telecommunications testing, (d) hardware testing and (e) usability, accessibility and privacy testing. The testing of electronic poll book systems is funded through the Electronic Poll Book

Systems vendor escrow account held by the Secretary of State.

The Contractor may subcontract for any portion of the work set forth in this scope of work. However, the percentage of subcontracting shall not exceed fifty percent (50 %).

2. Contractor Tasks

A. Functional Testing

The functional test evaluates the extent to which the system is accurate, efficient, reliable, accessible and secure, pursuant to the requirements of California state law. For the functional testing, the Contractor shall assist the Secretary of State as needed with the system set up, gathering of pertinent data, preparation of the written functional test plan, conducting functional tests, and preparing a written functional test report.

The Contractor shall assist with the installation of the system environment and the gathering of pertinent data during the installation as follows, when applicable:

• Format the equipment;

• Install the commercial off-the-shelf software;

• Establish any network connections and configurations necessary;

• Set up administrator and user accounts, apply security templates, system hardening or disabling of services;

• Install Electronic Poll Book Systems software and firmware on each device.

Contractor shall perform the following tasks:

• Prepare the functional test plan;

• Conduct the functional tests; and

• Prepare written functional test reports.

The Contractor shall conduct the examination in a manner that will provide the

California Secretary of State with a basis for evaluating the extent to which the

Electronic Poll Book Systems meets the California Electronic Poll Book Regulations, state law and federal law. The Contractor shall not render opinions on whether the Electronic Poll Book Systems complies or fails to comply with one or more referenced requirements, state law or federal law.

Acceptance Criteria:

The functional report must contain the following:

1) Summary of System Components

2) Scope of Work and Reporting

3) Description of System Submitted for Certification

4) Overview of System Operation

5) Approach to Testing

6) Scope Limitation

7) Detailed reporting on the Phases of Testing

8) Functional Findings

The functional test report must have proper grammar, spelling, and formatting.

The final report must be finalized in PDF format and on the contractor’s letterhead.

The report body must be in a 12 pt. Times New Roman Font.

The functional test report shall not make any recommendation as to whether the

Electronic Poll Book Systems should be approved. That determination shall be made solely by the Secretary of State.

B. Software Testing

• Prepare the software test plan;

• Conduct the software tests; and

• Prepare written software test reporst.

The Contractor shall conduct a Source Code review to evaluate the security and integrity of the system, and must identify any security vulnerabilities that could be exploited to:

• Alter voter information;

• Alter critical election data such as audit logs; or

• Conduct a “denial of service” attack on the Electronic Poll Book system.

The review is to provide a “Vulnerability Assessment,” based upon the model provided in ISO/IEC WD 18045:2008(E) Information Technology-Security

Techniques-Methodology for IT Security Evaluation, App B documenting and categorizing vulnerabilities, if any, to any tampering or errors that could cause manipulation, or fraudulent reporting of voter registration data information or that could alter critical voter registration data, including system audit data.

The Source Code review shall include, but not be limited to:

• Evaluation of potential vulnerabilities and related issues (code quality and standards compliance), considering that an exploitable issue in a component that is not in itself security relevant could be used to subvert more critical data. This is an issue whenever the architecture of the system does not provide strong separation of the components.

• Adherence to other applicable coding format conventions and standards including best practices for the coding language used, and any IEEE, NIST, ISO or NSA standards or guidelines which the contractor find reasonably applicable.

• Analysis of the program logic and branching structure.

• Search for exposures to commonly exploited vulnerabilities, such as buffer overflows, integer overflow, inappropriate casting or arithmetic.

• Evaluation of the use and correct implementation of cryptography and key management.

• Analysis of error and exception handling.

• Evaluation of the likelihood of security failures being detected.

o Are audit mechanisms reliable and tamper resistant?

o Is data that might be subject to tampering properly validated and authenticated?

• Evaluation of the risk that a user can escalate his or her capabilities beyond those authorized.

• Evaluation of whether the design and implementation follow sound, generally accepted engineering practices. Is code defensively written against:

o Bad data;

o Errors in other modules;

o Changes in environment;

o User errors; and o Other adverse conditions.

• Evaluation of whether the system is designed in a way that allows meaningful analysis, including:

o Is the architecture and code amenable to an external review (such as this one)?

o Could code analysis tools be usefully applied?

o Is the code complexity at a level that it obfuscates its logic?

• Search for embedded, exploitable code (such as “Easter eggs”) that can be triggered to affect the system.

• Search for dynamic memory access features which would permit the replacement of certificated executable code or control data or insertion of exploitable code or data.

• Search for use of runtime scripts, instructions, or other control data that can affect the operation of security relevant functions or the integrity of the data.

The Contractor shall conduct the examination in a manner that will provide the

California Secretary of State with a basis for evaluating the extent to which the source code meets applicable standards. The Contractor will not render opinions on whether the Electronic Poll Book Systems complies or fails to comply with one or more referenced standards, state law or federal law.

Reports shall not make any recommendation as to whether the Electronic Poll

Book Systems should be approved. That determination shall be made solely by the

California Secretary of State.

For vulnerabilities discovered, the Contractor will identify particular standards applicable to the vulnerability.

To the extent possible, vulnerabilities found should be reported with an indication of whether the exploitation of the vulnerability would require access by the:

• Voter/Poll Worker: Usually has low knowledge of the electronic poll book design and configuration. Some may have more advanced knowledge.

May carry out attacks designed by others.

• Elections official insider: Wide range of knowledge of the Electronic Poll

Book Systems design and configuration. May have unrestricted access to the Electronic Poll Book Systems for long periods of time. Their designated activities include:

o Set up and pre-election procedures;

o Election operation;

o Post-election processing of results; and o Archiving and storage operations.

• Vendor insider: With great knowledge of the Electronic Poll Book Systems design and configuration. They have unlimited access to the Electronic Poll

Book Systems before it is delivered to the purchaser and, thereafter, may have unrestricted access when performing warranty and maintenance service, and when providing election administration services.

It is not required to verify or demonstrate exploitability of the vulnerability, but the report of the vulnerability should identify factors noted which would be involved in the exploitation.

The vulnerability theories developed by the source code review team members shall, to the extent possible, be referred to the Secretary of State staff.

The Secretary of State shall provide documentation of the vulnerabilities found in an earlier version of the system, if any.

The Contractor shall make the best effort within the time allowed to find and report observations for the above categories. As such, it is understood that there may be undetected vulnerabilities in these categories.

The Contractor shall provide the Secretary of State with a list of tools and anticipated uses of such tools which they plan to use in its analysis.

The Contractor may communicate for this purpose directly, by telephone, by encrypted e-mail and/or courier delivery of encrypted files. Changes or significant findings that may suggest changes in any portion of the testing

(Functional, Software Review, or Security and Telecommunications Testing) shall be provided to the Secretary of State when they are identified or as part of a scheduled update.

Any elements of the report that cannot be publicly disclosed under Non-

Disclosure Agreements shall be reported in a confidential appendix to the report or presented as a second report, in a redacted format, so that the report can be made public.

Software Testing deliverables and Acceptance Criteria are:

1) Test plan for the system source code review, including tools to be used, staffing, subcontractors (if applicable) and timeline milestones.

2) Draft Final Report that includes description of findings and vulnerabilities, evaluation of the risk associated with each vulnerability described, any recommendations for mitigation of vulnerabilities and the conclusions of the reviewers. The draft report must be submitted in Microsoft Word format. Any reports with confidential information must be password protected or transmitted using secure file transfer methods, including but not limited to encryption.

3) Final Report, with appropriate revisions in response to reviews of the Draft

Final Report by the Secretary of State. The Contractor shall ensure that any elements of the report that cannot be publicly disclosed under Non-

Disclosure Agreements shall be reported in a confidential appendix to the report or presented as a second report, in a redacted format, so that the report can be made public.

The software test report must have proper grammar, spelling, and formatting. The final report must be finalized in PDF format and on the contractor’s letterhead. The report body must be in a 12 pt. Times New Roman Font.

The software test report shall not make any recommendation as to whether the electronic poll system should be approved. That determination shall be made solely by the Secretary of State.

C. Security and Telecommunications Testing

• Prepare the security and telecommunications test plan;

• Conduct security and telecommunications tests; and

• Prepare written security and telecommunications test reports.

The purpose of the Security and Telecommunications Testing is to identify and document vulnerabilities and potential vulnerabilities, if any, to any physical or logical tampering or errors that could alter critical voter registration data or system audit data. This testing must be conducted in a secured facility agreed upon between the contractor and the Secretary of State. Testing shall be conducted with a vendor specified hardened operating system in accordance with the

California Electronic Poll Book Regulations.

To the extent possible, vulnerabilities found shall be reported with an indication of whether the exploitation of the vulnerability would require access by the:

• Voter: Usually has low knowledge of the Electronic Poll Book Systems software and/or hardware design and configuration. Some may have more advanced knowledge. May carry out attacks designed by others.

• Poll worker: Usually has low knowledge of the Electronic Poll Book Systems software and/or hardware design and configuration. Some may have more advanced knowledge. May carry out attacks designed by others.

They have access to the software and/or hardware for up to one week, but all physical security has been put into place before the machines are received.

• Elections official insider: Wide range of knowledge of the Electronic Poll

Book Systems software and/or hardware design and configuration. May have unrestricted access for long periods of time. Their designated activities include:

o Set up and pre-election procedures;

o Election operation;

o Post-election processing of results; and o Archiving and storage operations.

• Vendor insider: With great knowledge of the Electronic Poll Book Systems software and/or hardware design and configuration. They have unlimited access to the Electronic Poll Book Systems software and/or hardware before it is delivered to the purchaser and, thereafter, may have unrestricted access when performing warranty and maintenance service, and when providing election administration services.

The Security and Telecommunications Testing may include but is not limited to:

• Examination of the top-level system design and architecture.

• Examination of the system documentation and procedures.

• Examination and open-ended testing of relevant software and operating system configuration.

• Examination and open-ended testing of hardware, including, when applicable examination of unused hardware ports and the security measures to lock/seal hardware ports used. Physical testing may not be destructive. If a risk is identified that requires destructive testing, the contractor will discuss this and receive written approval from the Secretary of State before proceeding with a destructive test.

• Examination and open-ended testing of system communications, including encryption of data, and protocols and procedures for access authorization.

The Security and Telecommunication testing shall, to the maximum extent possible, be conducted such that the testing will begin prior to having any knowledge of the source code to determine which vulnerabilities, if any, can be exploited without inside knowledge of the system.

Security and Telecommunications Testing deliverables and Acceptance Criteria are:

1) Test plan for the security and telecommunications testing, including tools to be used, staffing, subcontractors and timeline milestones.

2) Draft Final Report which includes description of findings and vulnerabilities, evaluation of risk associated with each vulnerability described, any recommendations for mitigation of vulnerabilities and the conclusions of the reviewers.

3) Final Report, with appropriate revisions in response to reviews of the Draft

Final Report by the Secretary of State. The Contractor shall ensure that any elements of the report which cannot be publicly disclosed under Non-

Disclosure Agreements shall be reported in a confidential appendix to the report or presented as a second report, in a redacted format, so that the report can be made public.

The security and telecommunications test report must have proper grammar, spelling, and formatting. The final report must be finalized in PDF format and on the contractor’s letterhead. The report body must be in a 12 pt. Times New Roman

Font.

The security and telecommunications test report shall not make any recommendation as to whether the electronic poll book system should be approved. That determination shall be made solely by the Secretary of State.

D. Usability, Accessibility, & Privacy Testing

Contractor shall perform one or more of the following tasks:

• Prepare the usability, accessibility, and privacy test plan;

• Conduct the usability, accessibility and privacy tests; and

• Prepare written usability, accessibility, and privacy test reports.

The testing will consist of a review of the manufacturer’s documentation of usability and accessibility testing performed during system development. Privacy will focus on visual, auditory warning, and no receipts indicating how the voter voted. The Contractor shall conduct the examination in a manner that will provide the California Secretary of State with a basis for evaluating the extent to which the

Electronic Poll Book Systems meets applicable standards. The Contractor shall not render opinions on whether the Electronic Poll Book Systems complies or fails to comply with one or more referenced standards, state law or federal law.

Usability, Accessibility, and Privacy Reports Acceptance Criteria:

The reports must contain the following:

2) Scope of Work and Reporting

3) Description of System Submitted for Certification

4) Approach to Testing

5) Detailed reporting on the Phases of Testing

6) Findings

The report(s) must have proper grammar, spelling, and formatting. The report must be finalized in Microsoft Word and/or PDF formats.

The report(s) shall not make any recommendation as to whether the Electronic

Poll Book Systems should be approved.