RFQ__25-016_-_Voting_System_-_ES_S_EVS_6.5.2.0.pdf

Contract Services | Management Services Division | 1500 11th Street, Suite 460

Sacramento, CA 95814 | Tel 916.653.5974 | www.sos.ca.gov

Request for Quotation (RFQ)

For Information Technology Services

Voting System - ES&S EVS 6.5.2.0 Test Support Services

QUOTE DUE DATE: 10/21/2025

Quotes must be delivered to Secretary of State’s Office before 4:00 PM on the due date

Supplier name and address:

SOLICITATION NO. REV. # DATE

25-016 ______ 10/07/2025

REQUISITION OR CONTROL #

Contact:

Phone: Fax:

For further information contact:

Secretary of State Contract Services Unit contractservices@sos.ca.gov

Ship To: (see below or bid document)

ARE YOU CLAIMING PREFERENCE AS A SMALL

BUSINESS?

YES ________ NO ________

IF YES, MANUFACTURER?

ARE YOU A NON-SMALL BUSINESS CLAIMING AT

LEAST 25% SMALL BUSINESS SUBCONTRACTOR

PREFERENCE?

Name (Print):

Title:

Signature:

Date:___________

Federal Employer Identification Number:

Return bid to:

Attn: Contract Services Unit 1500 11th Street, Room 460 Sacramento, CA 95814

SECTION 14838 ET SEQ. OF THE CALIFORNIA

GOVERNMENT CODE REQUIRES THAT A 5%

PREFERENCE BE GIVEN TO BIDDERS WHO QUALIFY

AS A SMALL BUSINESS AS A NON-SMALL BUSINESS

CLAIMINIG AT LEAST 25% CALIFORNIA CERTIFIED

SMALL BUSINESS PARTICIPATION FOR

REQUIREMENTS SEE TITLE 2, CALIFORNIA CODE OF

REGULATIONS SECTION 1896 ET SEQ. THE

REQUIREMENTS FOR NONPROFIT VETERAN SERVICE

AGENCIES QUALIFYING AS A SMALL BUSINESS ARE

CONTAINED IN SECTION 999.50 ET SEQ. OF THE

MILITARY AND VETERANS CODE.

Bidder offers and agrees if this response is accepted within 45 calendar days following the date the response is due to furnish all the items upon which prices are quoted, at the prices set opposite each item, delivered at the designated point(s) by the method of delivery and within the times specified and subject to the attached General Provisions. DECLARATIONS UNDER PENALTY OF PERJURY; By signing above, with inclusion of the date of signature, the above signed bidder DECLARES UNDER PENALTY OF PERJURY under the laws of the State of California as follows: (1) (STATEMENT OF COMPLIANCE). The above signed as complied with the non-discrimination program requirements of Government Code 12990 and Title 2, California Administrative Code Section 8103, and such declaration is true and correct. (2) The National Labor Relations Board declaration set forth in Paragraph 48 of the General Provisions is true and correct. (3) If a claim is made for the Small Business or Disabled Veterans Business preference, the information set forth within is true and correct.

DESCRIPTION

The purpose of this contract is to provide Voting System Test Support Services to assist the Secretary of State with the evaluation of the Election Systems & Software (ES&S) EVS 6.5.2.0 Voting System, as defined in Appendix A, for its suitability for use in California in accordance with Elections Code sections 19001 et seq. The Election Systems & Software (ES&S) EVS 6.5.2.0 Voting System will be tested using the California Voting Systems Standards (CVSS).

The following are incorporated as part of this Request for Quote for IT Services:

1. Requirements, including quote details and cost proposal and all attachments.

2. State’s Standard Agreement (STD 213); see Section I General Information, Sub-section 7.R of this RFQ.

3. Bidder Instructions DGS PD 451 Rev. 11/9/2011) can be located at: https://www.dgs.ca.gov/PD/Search

Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets; Department of General Services Procurement Division, Information Technology – General Provision Non- Cloud Goods & Services. DGS PD 403-IT (Non-Cloud) can be located at:

https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Required-Language-for-Solicitations-and-Contracts?search=Bidders%20Instructions http://www.sos.ca.gov/ mailto:contractservices@sos.ca.gov https://www.dgs.ca.gov/PD/Search%20Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets https://www.dgs.ca.gov/PD/Search%20Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets https://www.dgs.ca.gov/PD/Search%20Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Required-Language-for-Solicitations-and-Contracts?search=Bidders%20Instructions https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Required-Language-for-Solicitations-and-Contracts?search=Bidders%20Instructions

RFQ #25-016

Table of Contents

I. General Information

1. Purpose……………………………………………………………………………………..……..4

2. Availability……………………………………………………………………………….……….4

3. Period of Performance………………………………………………………………….……..4

4. Key Action Dates……………………………………………………………………….……….5

5. Written Questions…………………………………………………………………………..……5

6. RFQ Response Guidelines…………………………………………………………….…….….5

7. RFQ Response Content……………………………………………………………….…….….7

II. Evaluation Information

1. Evaluation Criteria…………………………………………………………………………

2. Award of Contract……………………………………………………………….…………...15

3. Disposition of Bids…………………………………………………………………………..….16

4. Protests…………………………………………………………………………………………...16

III. Exhibit A - Scope of Work

A. Purpose and Background……………………………………………………………………18

B. Contractor Tasks and Responsibilities…………………………………………….………..18

C. Deliverables……………………………………………………………………………………..29

D. Qualifications, Skills and Experience……………………………………………………….33

E. SOS Responsibilities…………………………………………………………………………….34

F. Contractor’s Responsibilities…………………………………………………………………34

G. Contract Contact Information………………………………………………………………35

H. Appendix A – System Description & Configuration……………………………………..36

I. Appendix B – Vendor Non-Disclosure Agreement………………………………………39

IV. Exhibit B - Budgets Details and Payment Provisions

1. Invoicing and Payment………………………………………………………………………44

2. Budget Contingency Clause………………………………………………………………..44

3. Escrow Funds……………………………………………………………………………………45

4. Prompt Payment Clause…………………………………………………………………..…45

5. Cost Detail………………………………………………………………………………………45

V. Exhibit C - Department of General Services Procurement Division, Information

Technology – General Provisions – Non-Cloud Goods & Services. DGS PD 403-IT (Non-

Cloud)……………………………………………………………………………………………..…46

VI. Exhibit D - Additional Provisions

1. Solicitation and Contractor’s Response…………………………………………………..47

2. Amendments…………………………………………………………………………………...47

3. Termination……………………………………………………………………………………...47

4. Commission, Percentage, Brokerage, or Contingent Fees……………………………47

5. Subcontractors…………………………………………………………………………………47

6. Incompatible Activities……………………………………………………………………….47

VII. Attachments

1. Response Checklist…………………………………………………………………………

2. Cover Letter…………………………………………………………………………………

3. Cost Worksheet………………………………………………………………………………...52

4. Customer Experience Reference Form……………………………………………………54

5. Payee Data Record (Std. 204)………………………………………………………………56

6. Declaration Forms

1. Bidder Declaration Form……………………………………………………………..……57

2. CA Disabled Veteran Business Enterprise (DVBE) Program Requirement………..57

7. California Civil Rights Laws Certification (DGS OLS 04 Rev. 01/17)………………..…58

8. Staff Experience Worksheet………………………………………………………………….59

Voting System - ES&S EVS 6.5.2.0 Test Support Services

Requirements

You are invited to review and respond to this Request for Quote (RFQ) for IT Services, entitled Secretary of State, RFQ #25-016 – Voting System - ES&S EVS 6.5.2.0. In submitting your quote, you must comply with the instructions found herein. The services required are described in the Scope of Work (SOW). Please read the enclosed document carefully. Quotes must be received no later than the date and time specified on the face of this RFQ and in Section I.4. Key Action Dates.

I. General Information

1. Purpose

The purpose of this contract is to provide Voting System Test Support Services to assist the Secretary of State with the evaluation of the Election Systems & Software

(ES&S) EVS 6.5.2.0 Voting System, as defined in Appendix A, for its suitability for use in California in accordance with Elections Code sections 19001 et seq. The

Election Systems & Software (ES&S) EVS 6.5.2.0 Voting System will be tested using the California Voting Systems Standards (CVSS).

Exhibit A – Scope of Work identifies the overall process, work and deliverables required for providing these services. Please carefully review this documentation for complete information and details.

2. Availability

The selected Contractor must be able to meet the requirements of this RFQ and be ready to begin work within ten (10) business days of the anticipated contract award date specified in Section I.4. Key Action Dates.

3. Period of Performance

The term of this Agreement shall begin on the date as indicated on the Standard

Agreement (STD 213) provided to the awarded Contractor, which is anticipated to be November, 2025 through November, 2027.

The contractor shall not be authorized to deliver or commence performance of services as described in this Scope of Work (SOW) until written approval has been obtained from all entities. No delivery or performance of service may commence prior to the execution of the Agreement.

4. Key Action Dates

Listed below are the key action dates and times by which the actions must be taken or completed. If the State finds it necessary to change any of these dates, it will be accomplished via an addendum to this RFQ.

Key Action Dates Date

1. Release of RFQ October 7, 2025

2. Submission of written questions October 10, 2025

3. Department’s response to written questions October 14, 2025

4. Submission of Quotes (by date and time) October 21, 2025, 4:00pm

5. Anticipated Notice of Intent to Award October 28, 2025

6. Anticipated Contract Award November 4, 2025

All dates after the Submission of Quotes (date and time) are approximate and may be changed if needed to allow the State additional time for evaluation and contract execution.

5. Written Questions

All questions regarding the content of this RFQ must be submitted in writing by mail or sent electronically to ContractServices@sos.ca.gov and must be received by the Key Action Dates identified above. Questions not submitted in writing by the Key Action Date for submission of written questions shall be answered at the

State’s option.

When the State has completed its review of the questions, all of the questions and answers will be posted on the California eProcurement Portal at:

https://caleprocure.ca.gov.

6. RFQ Response Guidelines

A. Response Submission

This RFQ shall be incorporated by reference and made part of the resulting

Agreement, as if attached. However, the Bidder’s quote in response to this

RFQ shall be made a part of the resulting Agreement. Responses to this RFQ must contain all data/information requested and must conform to the format described in this RFQ. It is the bidder’s responsibility to provide all required data and any other information deemed necessary for the State’s evaluation team to determine and verify the Bidder’s ability to perform the tasks and activities defined in the SOW.

mailto:ContractServices@sos.ca.gov https://caleprocure.ca.gov/

In accordance with the Bidders Instructions, please submit quotes in writing via postal mail or hand-delivery to the SOS, at the address provided in the RFQ front page (“Return bid to;” section on Front Page 1), by date and time shown above in Section I.4. Key Action Dates. Additionally, for the attachments required to be submitted with the Bidder’s response that require signature(s), the use of Electronic Signatures (eSignature) is also being permitted.

eSignatures will be accepted and are legally binding and equivalent to handwritten signatures. The package or electronic submission containing the quote must be plainly marked with the RFQ number and title and show your firm name and address.

Facsimile machine responses will be considered only if they are sent to (916)

653-8324 for solicitations originating from the SOS, Contract Services Unit of the

Business Operations Bureau. Responses sent to any other SOS fax number will not be considered. All pages of the faxed response that are received prior to the Submission of Quotes (by date and time) specified in Section I.4. Key

Action Dates will be considered “the complete response”. Please be advised that there may be a heavy demand placed on the fax machine receiving responses and the State assumes no responsibility if a Bidder cannot transmit their response via fax, and/or if the entire response is not received prior to the

Submission of Quotes (by date and time).

If the Bidder chooses to transmit their response via E-mail, responses must be sent to contractservices@sos.ca.gov and it is suggested that all attachment(s) be submitted in .PDF format. In order to be considered as part of the response, all attachment(s) must be able to be opened, clearly viewed, and printed.

Additionally, the State assumes no responsibility if the entire response is not received prior to the Submission of Quotes (by date and time) specified in

Section I.4. Key Action Dates, and/or that may be blocked by the SOS secured

E-mail filter. Please Note: The SOS will not confirm receipt of quotes submitted via E-mail and/or if any attachment(s) can be opened.

B. Qualifications to Do Business in California

All corporations, limited liability companies (LLC) and limited partnerships

(LP) are required to be registered with the California Secretary of State (SOS) in order to do business* in the state of California. Before contract award can be made, the Contractor must be currently registered and in “Active” status with the California SOS, as required by law, to do business in California; this applies to domestic entities (organized or commercially domiciled in the state of California) and foreign entities (organized or commercially domiciled outside of California).

mailto:contractservices@sos.ca.gov

During the response evaluation process, the State will verify if the Bidder is currently registered and in good standing (i.e., “Active” status) with the

California SOS, as applicable, in order to ensure that all obligations due to the

State are fulfilled. Therefore, a certificate of status is not required to be submitted with the bidder’s response.

* “Doing business” is defined in the California Revenue and Taxation Code §

23101 as “actively engaging in any transaction for the purpose of financial or pecuniary gain or profit”. Although there are some statutory exceptions to taxation, rarely will a contractor performing within the state not be subject to the applicable franchise tax.

C. Loss Leader:

It is unlawful for any person engaged in business within this state to sell or use any article or product as a “loss leader” as defined in Section 17030 of the

Business and Professions Code. (PCC 12104.5(b).).

7. RFQ Response Content

For further information and details, please refer to the Bidder Instructions (DGS PD

451 Rev. 11/9/2011) at the following link:

https://www.dgs.ca.gov/PD/Search-

Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5 e77df36&activeFilters=division-or-office-facets;

The following documents, as identified, are required, and must be submitted in the RFQ response or your response may be deemed non-responsive:

A. Cover Letter – Attachment 2 (completed)

The RFQ Cover Sheet (page 1) and the Cover Letter included in this RFQ as

Attachment 2 must be completed and submitted with the bidder’s response.

B. Cost Worksheet- Attachment 3 (completed)

Bidder must complete the cost sheet that identifies total cost as described in the SOW using the format in Attachment 3 – Cost Worksheet.

C. Customer Experience Reference Form - Attachment 4 (completed)

The bidder must submit with their response, two (2) client references for whom services have been performed, similar in scope and complexity to the services to be performed under this agreement (as outlined in Exhibit A – Scope of

Work (SOW)). In accordance with this requirement, the bidder shall complete one (1) Customer Experience Reference Form, for each reference.

https://www.dgs.ca.gov/PD/Search-Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets https://www.dgs.ca.gov/PD/Search-Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets https://www.dgs.ca.gov/PD/Search-Results?search=Bidders%20Instructions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets

The SOS will contact references prior to contract award. Therefore, SOS strongly recommends bidder to contact each reference prior to submitting the bid in order to confirm availability of the contact person listed. Receipt of negative responses may cause the response to be deemed non-responsive.

NOTE: If the Bidder has performed these services for the SOS within the last five

(5) years, the SOS must be listed as one (1) of the references provided in

Attachment 4.

D. Payee Data Record (STD 204) – Attachment 5

The successful bidder will be required to submit a Payee Data Record form

(STD 204), listing their Taxpayer Identification Number, prior to contract awards.

E. Declaration Forms – Attachment 6

The bidder must complete the forms as identified in Attachment 6 and submit with the bidder’s response.

1. Bidder Declaration Form (DGS PD 05-105 (written))

2. CA Disabled Veteran Business Enterprise (DVBE) Program Requirement

(DGS PD 843 (Rev. 9/2019))

F. California Civil Rights Laws Certification (DGS OLS 04 Rev. 01/17) - Attachment

The bidder must complete and sign/date a DGS OLS 04 form as identified in

Attachment 7 and submit the completed form along with their response to this

RFQ. Failure to submit this completed form shall cause the response to this RFQ to be considered non-responsive. See Attachment 7 for complete information and details regarding this requirement.

G. Staff Experience Worksheet – Attachment 8 - The following information must be submitted with the bidder’s response.

1. Staff Experience Worksheet – A completed Staff Experience Worksheet, prepared in accordance with the sample provided titled Attachment 8

– Staff Experience Worksheet. The worksheet must clearly validate and support the proposed staff qualifications, as described in the resume(s), to each of the mandatory qualifications referenced in Section D. –

Qualifications, Skills and Experience of the SOW.

2. Staff Name(s) and Resume(s) - The name(s), assigned role(s)/task(s), and resume(s) of ALL individuals proposed to be used in this engagement, including a detailed description of experience that demonstrates how the proposed staff meets the mandatory qualifications referenced in

Section D. – Qualifications, Skills and Experience of the SOW.

H. DVBE Participation

The State has established goals for Disabled Veteran Business Enterprises

(DVBE) participating in State contracts. The minimum DVBE participation percentage (goal) is 3% for this solicitation. Please review the DVBE program requirements and information at:

https://www.dgs.ca.gov/SearchResult?search=DVBEProgramRequirements&to picCategoryFilters=&divisionid=&audienceCategoryFilters=&contenttype=PDF

&sort=relevance&eventCategoryFilters=&resourceCategoryFilters=&serviceCa tegoryFilters=&activeFilters=Types%7C&page=1 and forms at: https://www.dgs.ca.gov/PD/Forms

Bidders must complete and return all the appropriate pages in order for the quote to be considered responsive.

The Secretary of State’s Office has waived the application of the DVBE

Incentive for this solicitation. Therefore, no additional incentive points will be applied during the evaluation process of this RFQ; however, bidders must still meet the minimum DVBE participation percentage (goal) of 3% for this solicitation and are required to submit the following as part of their response to this RFQ: Std 843 (DVBE Declaration), and DGS PD-05-105 (Bidder Declaration -

Written) for the named DVBE(s) (See Attachment6 of this RFQ).

All Bidders must meet the 3% goal for this solicitation; failure to submit all required forms and fully document and meet the DVBE program requirement shall be considered non-responsive.

I. TACPA (if applicable) – (Required for contracts that will exceed $100,000.)

If the bidder qualifies for more than one bidding preference (TACPA, Small

Business), the maximum preference allowed by law is 15% or $100,000. If the following act applies, complete the appropriate form, and submit with the bidder’s response.

Target Area Contract Preferences Act (TACPA)

(STD. 830 for Services)

Preference will be granted to California-based Contractors in accordance with Government Code Section 4530-4535.3 whenever contract for goods and services are in excess of $100,000 and the Contractor meets certain requirements as defined in the California Code (Title 2, Section 1896.30) regarding labor needed to produce the goods or provide the services being procured. Bidders desiring to claim Target Area Contract Preferences Act shall https://www.dgs.ca.gov/SearchResult?search=DVBEProgramRequirements&topicCategoryFilters=&divisionid=&audienceCategoryFilters=&contenttype=PDF&sort=relevance&eventCategoryFilters=&resourceCategoryFilters=&serviceCategoryFilters=&activeFilters=Types%7C&page=1 https://www.dgs.ca.gov/SearchResult?search=DVBEProgramRequirements&topicCategoryFilters=&divisionid=&audienceCategoryFilters=&contenttype=PDF&sort=relevance&eventCategoryFilters=&resourceCategoryFilters=&serviceCategoryFilters=&activeFilters=Types%7C&page=1 https://www.dgs.ca.gov/SearchResult?search=DVBEProgramRequirements&topicCategoryFilters=&divisionid=&audienceCategoryFilters=&contenttype=PDF&sort=relevance&eventCategoryFilters=&resourceCategoryFilters=&serviceCategoryFilters=&activeFilters=Types%7C&page=1 https://www.dgs.ca.gov/SearchResult?search=DVBEProgramRequirements&topicCategoryFilters=&divisionid=&audienceCategoryFilters=&contenttype=PDF&sort=relevance&eventCategoryFilters=&resourceCategoryFilters=&serviceCategoryFilters=&activeFilters=Types%7C&page=1 https://www.dgs.ca.gov/PD/Forms complete (Std. Form 830 (Rev. 5/2022)) and submit it with the Final Proposal.

Refer to the following website link to obtain the appropriate form and information:

https://www.dgs.ca.gov/PD/Resources/SCM/SearchResult?search=TACPA

J. Small Business Regulations

The Small Business regulations are located in the California Code of

Regulations (Title 2, Division 2, Chapter 3, Subchapter 8, Section 1896 et. seq.), concerning the application and calculation of the small business preference, small business certification, responsibilities of small business, department certification, and appeals. The regulations can be viewed at:

https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-

Resources-List-Folder/Notice-of-Rulemaking-Regulations-for-SB-DVBE.

For those without Internet access, a copy of the regulations and/or further information can be obtained by calling the Office of Small Business and DVBE

Services at (916) 375-4940.

K. Non-Small Business Subcontractor Preference

A 5% bid preference is now available to a non-small business claiming 25%

California certified small business subcontractor participation. If applicable, claim the preference in the box on the right-hand side of the first page of this solicitation.

L. Small Business Nonprofit Veteran Service Agencies (SB/NVSA)

SB/NVSA prime bidders meeting requirements specified in the Military and

Veterans Code Section 999.50 et seq. and obtaining a California certification as a small business are eligible for the 5% small business preference. If applicable, claim the preference in the box on the right-hand side of the first page of this solicitation.

M. Attachment With Quote Required If Claiming the Small Business Preference

All bidders must complete and include the Bidder Declaration form DGS PD

05-105. If claiming the non-small business subcontractor preference, the form must list all of the California certified small businesses with which you commit to subcontract in an amount of at least twenty-five percent (25%) of the net bid price. All certified small businesses must perform a “commercially useful function” in the performance of the contract as defined in Government Code

Section 14837(d)(4).

Bidder Declaration form DGS PD 05-105 can be searched and located here:

N. Small Business Certification https://www.dgs.ca.gov/PD/Resources/SCM/SearchResult?search=TACPA https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Notice-of-Rulemaking-Regulations-for-SB-DVBE https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Notice-of-Rulemaking-Regulations-for-SB-DVBE

Bidders claiming the small business preference must be certified by California as a small business or must commit to subcontract at least 25% of the net bid price with one or more California certified small businesses. Completed certification applications and required support documents must be submitted to the Office of Small Business and DVBE Services (OSDS) no later than 5:00 p.m. on the bid due date, and the OSDS must be able to approve the application as submitted. Small business nonprofit veteran service agencies

(SB/NVSA) claiming the small business preference must possess certification by

California prior to the day and time bids are due. Questions regarding certification should be directed to the OSDS at (916) 375-4940.

O. Generative Artificial Intelligence (GenAI)

The State of California seeks to realize the potential benefits of GenAI, through the development and deployment of GenAI tools, while balancing the risks of these new technologies.

Offeror must notify the State in writing if it: (1) intends to provide GenAI as a deliverable to the State; or (2), intends to utilize GenAI, including GenAI from third parties, to complete all or a portion of any deliverable that materially impacts: (i) functionality of a State system, (ii) risk to the State, or (iii) Contract performance. For avoidance of doubt, the term “materially impacts” shall have the meaning set forth in State Administrative Manual (SAM) § 4986.2.

Failure to report GenAI to the State may result in disqualification. The State reserves the right to seek any and all relief to which it may be entitled to as a result of such non-disclosure.

Upon notification by an Offeror of GenAI as required, the State reserves the right to incorporate GenAI Special Provisions into the final contract or reject bids/offers that present an unacceptable level of risk to the State.

Government Code 11549.64 defines “Generative Artificial Intelligence

(GenAI)” as an artificial intelligence system that can generate derived synthetic content, including text, images, video, and audio that emulates the structure and characteristics of the system’s training data.

P. Declaration Forms - All bidders must complete the Bidder Declaration (DGS PD

05-105) and include it with the bid response.

When completing the declaration, bidders must identify all subcontractors proposed for participation in the contract. Bidders awarded a contract are contractually obligated to use the subcontractors for the corresponding work identified unless the State agrees to a substitution, and it is incorporated by amendment to the contract. The Bidder Declaration form can be located at the link below:

Bidders who have been certified by California as a DVBE (or who are bidding rental equipment and have obtained the participation of subcontractors certified by California as a DVBE) must also submit a completed form(s) STD.

843 (Disabled Veteran Business Enterprise Declaration). All disabled veteran owners and disabled veteran managers of the DVBE(s) must sign the form(s).

Should the form not be included with the solicitation, contact the State contracting official or the form can be searched and located at the link below. The completed form must be included with the bid response:

Q. Clarifying Information

At the State’s option prior to award, bidders may be required to submit additional written clarifying information. Failure to submit the required written information as specified may be grounds for bid rejection.

R. Contract Formation

The Agreement resulting from this procurement will be prepared using the

State’s Standard Agreement (STD 213) form, including all required exhibits;

Exhibits will include a copy of the awarded Contractor’s response to this RFQ, other provisions as applicable and references to the General Provisions -

Information Technology (GSPD-ITGP(Non-Cloud) Rev. 2/20/25) and this RFQ document (as if attached).

The awarded Contractor will be provided the prepared contract document via DocuSign, as applicable upon award, and will be required to review and sign the contract for SOS execution. Once fully executed and approved accordingly, an executed copy of the contract will be provided to the

Contractor. Please see the sample Standard Agreement (STD 213) form, IT

General Provisions link, and mentioned exhibits below.

a. Standard Agreement (STD 213)

b. IT General Provisions - Information Technology (GSPD-ITGP(Non-Cloud)

Rev. 2/20/25) https://www.dgs.ca.gov/PD/Resources/Page-

Content/Procurement-Division-Resources-List-Folder/Required-

Language-for-Solicitations-and-

Contracts?search=standard%20contract%20language https://www.dgs.ca.gov/PD/Forms https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Required-Language-for-Solicitations-and-Contracts?search=standard%20contract%20language https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Required-Language-for-Solicitations-and-Contracts?search=standard%20contract%20language https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Required-Language-for-Solicitations-and-Contracts?search=standard%20contract%20language https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Required-Language-for-Solicitations-and-Contracts?search=standard%20contract%20language

II. Evaluation Information

Each RFQ response will be checked for the presence of requirement information in conformance with the submission requirements of this RFQ. The department will evaluate each RFQ response to determine its responsiveness to the requirements.

1. Evaluation Criteria

The overall responsiveness of each RFQ response is based on the complete response from the bidder to the RFQ requirements, including the scope of work for the project. The following three sub-sections and criteria will be reviewed by the State’s evaluation team.

A. Administrative Requirements Evaluation Criteria (Pass/Fail)

Example:

Requirement Pass Fail Comments

1. Completed RFQ Cover Sheet (page 1) and

Cover Letter (Attachment 2)

2. Completed Cost Worksheet (Attachment 3)

3. Completed Customer Experience

References Forms (Attachment 4); for two (2) client references.

4. Payee Data Record (Std 204) (Attachment 5)

5. Completed Bidder Declaration (DGS PD 05-

105 Form); including list of Subcontractors, as applicable (Attachment 6).

6. Completed DVBE Declarations (STD. 843

Form) (Attachment 6)

7. Completed California Civil Rights Laws

Certification (DGS OLS 04) (Attachment 7)

8. Completed Staff Experience Worksheet

(Attachment 8).

9. Staff Name(s) and Resume(s) - The name(s), assigned role(s)/task(s), and resume(s) of ALL individuals proposed to be used in this engagement, including a detailed description of experience that demonstrates how the proposed staff meets the mandatory qualifications.

Any other Administrative requirements, as applicable (I.e., Verification of entity status, SB, etc.)

B. Technical Requirements Evaluation Criteria (Pass/Fail)

Example:

Requirement Pass Fail Comments

a) At least five (5) years of knowledge and experience in voting technology system design, research and analysis conducted on voting technology system security and known and suspected flaws in voting technology systems.

b) At least three (3) years of knowledge and experience of threats to voting technology systems.

c) At least five (5) years of knowledge and experience with Microsoft server and workstation operating systems including, but not limited to, logging, audit logging, and security.

d) At least three (3) years of knowledge and experience with Microsoft SQL server.

e) At least three (3) years of proven experience testing voting technology systems hardware, software and firmware, including projects of equivalent size, scope and complexity to the services to be provided under this agreement.

f) At least six (6) years of proven experience conducting source code review and analysis.

g) At least three (3) years of proven experience with conduction hardware, software and firmware testing, specific to voting technology system testing for a government entity at the state or federal level.

h) Capability to perform benchmark and verification testing by utilizing hash values and imaging.

Security and Telecommunications Specific Qualifications

(The staff proposed to perform the security and telecommunications testing services)

a) Six (6) or more years of experience in software engineering.

b) Six (6) or more years of experience in information security.

c) Six (6) or more years of experience in penetration testing.

d) Six (6) or more years of experience in voting technology system security.

C. Cost

This will be a low-cost award based upon responses that pass all requirements of the Administrative and Technical evaluation criteria.

2. Award of Contract

Award of contract, if made, will be in accordance with the RFQ information on evaluation to a responsible bidder whose bid complies with all the requirements of the RFQ documents and an addendum thereto, except for such immaterial defects as may be waived by the State. Award, if made, will be made within forty-five (45) days after the scheduled date for Contract Award as specified in the RFQ; however, a bidder may extend the offer beyond 45 days in the event of a delay of contract award.

The State reserves the right to determine the successful bidder(s) either on the basis of individual items or on the basis of all items included in its RFQ, unless otherwise expressly provided in the State’s RFQ. Unless the bidder specifies otherwise in its bid, the State may accept any item or group of items of any bid.

The State reserves the right to modify or cancel in whole or in part it’s RFQ.

Written notification of the State’s intent to award will be made to all bidders. If a bidder, having submitted a bid, can show that its bid, instead of the bid selected by the State, should be selected for contract award, the bidder will be allowed five (5) working days to submit a Notice of Intent to Protest, according to the instructions contained in the section titled “Protests” of this RFQ.

3. Disposition of Bids

A. By submitting a bid, bidder agrees to the terms and conditions stated in this

RFQ, Exhibit A - SOW and the resulting Contract. Responses received after the

Response Due Date may not be assessed. Quotes received in response to the

SOW will be valid for one hundred eighty (180) days after the Response Due

Date.

B. Submitting responses that include assumptions, added conditional statements or statements regarding changes to the SOW in this RFQ may result in the offer being found as non-responsive.

C. Submitting documents marked as “Confidential”, “Proprietary” or otherwise appearing to contain sensitive information that the State considers an information security breach, constitutes grounds to reject the offer as non-responsive. Bids rejected for this reason will have all pages containing sensitive information purged from the offer prior to Award of the contract pursuant to this RFQ.

D. Upon review of the bids received and subsequent Contract Award, all documents submitted in response to this RFQ shall become the property of the

State of California and shall be regarded as public records under the

California Public Records Act (Government Code Section 7920.000 et seq.), thereby subject to review by the public.

E. The State, at its discretion, reserves the right not to make an award or reject all offers, in the best interest of the State.

4. Protests

Any bidder’s issues regarding solicitation requirements must be resolved (or attempts to resolve them must have been made) before a protest may be submitted according to the procedure below. These issues will first be resolved by the contact for the solicitation or, if they result in a protest, the protest will be submitted to DGS, Office of Legal Services to hear and resolve issues and whose decision will be final.

If a bidder has submitted a bid which it believes to be responsive to the requirements of the RFQ and to be the bid that should have been selected according to the evaluation procedures in the solicitation and the bidder believes the State has incorrectly selected another bidder for award, the bidder may submit a protest of the selection as described below. Protests regarding selection of the “successful vendor” will be heard and resolved by the Victim

Compensation and Government Claims Board whose decision will be final.

All protests of award must be made in writing, signed by an individual authorized to bind the bidder contractually and financially, and contain a statement of the reason(s) for protest; citing the law, rule, regulation, or procedure on which the protest is based. The protester must provide facts and evidence to support the claim. Protests must be submitted to both the following:

a. Department of General Services, Office of Legal Services

Attn: Bid Protest Coordinator

707 Third Street, 7th Floor, Suite 7-330

West Sacramento, CA 95605

Email: OLSProtests@dgs.ca.gov

b. Secretary of State

Attn: Contract Services

1500 11th Street, 4th Floor, Room 460

Email: contractservices@sos.ca.gov

All protests to the RFQ or protests concerning the evaluation, recommendation, or other aspects of the selection process must be received by the DGS

Procurement Division Deputy Director as promptly as possible, but not later than the date indicated in the Notification of Intent to Award. Certified or registered mail must be used unless delivered in person; in which case the protester should obtain a receipt of delivery.

mailto:OLSProtests@dgs.ca.gov

III. Exhibit A - Scope of Work

The Contractor agrees to perform as a state approved testing agency (SATA) as provided in Elections Code section 19220 et seq to provide the California Secretary of State (SOS) with voting system test support services as detailed in this scope of work for the Election Systems & Software (ES&S) EVS 6.5.2.0 Voting System.

A. Purpose and Background

The purpose of this contract is to provide Voting System Test Support Services to assist the Secretary of State with the evaluation of the Election Systems & Software (ES&S) EVS

6.5.2.0 Voting System, as defined in Appendix A, for its suitability for use in California in accordance with Elections Code sections 19001 et seq. The Election Systems & Software

(ES&S) EVS 6.5.2.0 Voting System will be tested using the California Voting Systems

Standards (CVSS).

This scope of work identifies the overall process, work and deliverables required for testing and evaluation of the voting system described in Appendix A. However, changes to the testing process, work and deliverables may occur and the Contractor shall assist the Secretary of State as needed.

The Contractor may subcontract for any portion of the work set forth in this scope of work. However, the percentage of subcontracting shall not exceed fifty percent (50%).

The Contractor shall provide a safe, secure mechanism to share encrypted files, encrypted source code, and other communications such as encrypted reports.

B. Contractor Task and Responsibilities

1.0 Functional Testing

The functional test evaluates the extent to which the system is accurate, efficient, reliable, accessible and secure, pursuant to the requirements of California state law, and California Voting System Standards (CVSS). For the functional testing, the

Contractor shall assist the Secretary of State as needed with all pre-voting, voting, and post voting requirements of CVSS Section 2, gathering of pertinent data, preparation of the written functional test plan, conducting functional tests, and preparing a written functional test report.

The Contractor shall assist with the installation of the system environment and the gathering of pertinent data during the installation as follows:

• Configure a Trusted Build or “witnessed compile in an audited compilation environment”

• Contractor will assist with the installation:

o Format the hard disks on the server(s) and workstation(s);

o Install the operating system;

o Benchmark the system, through hash values and images, in various stages throughout the process;

o Install the commercial off-the-shelf software;

o Establish any network connections and configurations necessary;

o Set up administrator and user accounts, apply security templates, system hardening or disabling of services;

o Install voting system software and firmware on each voting device.

• Configure at least seven test election definitions, one for each of the following types of election:

o California Top-Two Primary Election;

o California Gubernatorial General Election;

o California Recall Election;

o California Presidential Primary;

o California Presidential General Election;

o Vote Center Election; and o Ranked Choice Voting (If the system supports it) o Miscellaneous Election to cover any further requirements of CVSS section 2.

• Test the import of election results with Election Night Reporting templates as provided by the Secretary of State. Including the Statement of Vote (SOV) and the Supplemental Statement of Vote (SSOV) files.

• Provide access to MD5 Message-Digest Algorithm software to produce a hash value, whenever requested by the Secretary of State, to be used to check data integrity of the system that is being tested.

• Provide software to image the system at various stages of building the system, whenever requested by the Secretary of State. Such images will be maintained and used by the Secretary of State in compliance with the Non-Disclosure

Agreement (NDA).

Contractor will perform the following tasks:

• Assist with or perform the Physical Configuration Audit (CVSS 2.6.7.3).

• Assist with or perform the Functional Configuration Audit (CVSS 2.6.7.4).

• Prepare the functional test plan;

• Conduct the functional tests; and

• Prepare written functional test reports.

The Contractor shall conduct the examination in a manner that will provide the

California Secretary of State with a basis for evaluating the extent to which the voting system meets applicable standards. The Contractor shall not render opinions on whether the voting system complies or fails to comply with one or more referenced standards.

a. Acceptance Criteria:

The functional report must contain the following:

1) Summary of System Components

2) Scope of Work and Reporting

3) Description of System Submitted for Certification

4) Overview of System Operation

5) Federal Certification (If Applicable)

6) Approach to Testing

7) Scope Limitation

8) Detailed reporting on the Phases of Testing

9) Functional Findings

The functional test report must have proper grammar, spelling, and formatting. All drafts must be submitted in Microsoft Word format. The final report must be finalized in PDF format and on the contractor’s letterhead. The report body must be in a 12-point Times

New Roman Font.

The functional test report shall not make any recommendation as to whether the voting system should be approved. That determination shall be made solely by the Secretary of State.

2.0 Software Testing

The Contractor shall conduct software testing to the requirements of CVSS sections 5 and 7, and a source code review to evaluate the security and integrity of the system, and must identify any security vulnerabilities that could be exploited to:

• alter the election results;

• alter vote recording;

• alter vote results;

• alter critical election data such as audit logs; or

• conduct a “denial of service” attack on the voting system.

The review is to provide a “Vulnerability Assessment,” based upon the model provided in ISO/IEC 18045:2022 Information Technology-Security Techniques-Methodology for IT

Security Evaluation, App B documenting and categorizing vulnerabilities, if any, to any tampering or errors that could cause incorrect recording, tabulation, tallying or reporting of votes or that could alter critical election data such as election definition or system audit data.

The Software Testing shall include, but not be limited to:

• Evaluation of potential vulnerabilities and related issues (code quality and standards compliance), considering that an exploitable issue in a component that is not in itself security relevant could be used to subvert more critical data.

This is an issue whenever the architecture of the system does not provide strong separation of the components.

• Adherence to the applicable standards in sections: 5 and 7 California Voting

System Standards.

• Adherence to other applicable coding format conventions and standards including best practices for the coding language used, and any IEEE, NIST, ISO or

NSA standards or guidelines which the contractor find reasonably applicable.

• Analysis of the program logic and branching structure.

• Search for exposures to commonly exploited vulnerabilities, such as buffer overflows, integer overflow, inappropriate casting or arithmetic.

• Evaluation of the use and correct implementation of cryptography and key management.

• Analysis of error and exception handling.

• Evaluation of the likelihood of security failures being detected.

o Are audit mechanisms reliable and tamper resistant?

o Is data that might be subject to tampering properly validated and authenticated?

• Evaluation of the risk that a user can escalate his or her capabilities beyond those authorized.

• Evaluation of whether the design and implementation follow sound, generally accepted engineering practices. Is code defensively written against:

o Bad data;

o Errors in other modules;

o Changes in environment;

o User errors; and o Other adverse conditions.

• Evaluation of whether the system is designed in a way that allows meaningful analysis, including:

o Is the architecture and code amenable to an external review (such as this one)?

o Could code analysis tools be usefully applied?

o Is the code complexity at a level that it obfuscates its logic?

• Search for embedded, exploitable code (such as “Easter eggs”) that can be triggered to affect the system.

• Search for dynamic memory access features which would permit the replacement of certificated executable code or control data or insertion of exploitable code or data.

• Search for use of runtime scripts, instructions, or other control data that can affect the operation of security relevant functions or the integrity of the data.

California Secretary of State with a basis for evaluating the extent to which the source code meets applicable California Voting System Standards.

Reports shall not make any recommendation as to whether the voting system should be approved. That determination shall be made solely by the California Secretary of State.

For vulnerabilities discovered, the Contractor will identify particular standards applicable to the vulnerability.

To the extent possible, vulnerabilities found should be reported with an indication of whether the exploitation of the vulnerability would require access by the:

• Voter: Usually has low knowledge of the voting machine design and configuration. Some may have more advanced knowledge. May carry out attacks designed by others. They have access to the machine(s) for less than an hour.

• Poll worker: Usually has low knowledge of the voting machine design and configuration. Some may have more advanced knowledge. May carry out attacks designed by others. They have access to the machine(s) for up to one week, but all physical security has been put into place before the machines are received.

• Elections official insider: Wide range of knowledge of the voting machine design and configuration. May have unrestricted access to the machine for long periods of time. Their designated activities include:

o Set up and pre-election procedures;

o Election operation;

o Post-election processing of results; and o Archiving and storage operations.

• Vendor insider: With great knowledge of the voting machine design and configuration. They have unlimited access to the machine before it is delivered to the purchaser and, thereafter, may have unrestricted access when performing warranty and maintenance service, and when providing election administration services.

It is not required to verify or demonstrate exploitability of the vulnerability but the report of the vulnerability should identify factors noted which would be involved in the exploitation.

The vulnerability theories developed by the software testing team members shall, to the extent possible, be referred to the Secretary of State staff.

The source code reviewed shall be that provided by the Secretary of State and shall be the code used for the Witnessed Build of the system.

The Secretary of State shall provide documentation of the vulnerabilities found in an earlier version of the system, if any.

The Contractor shall make the best effort within the time allowed to find and report observations for the above categories. As such, it is understood that there may be undetected vulnerabilities in these categories.

The Contractor shall provide the Secretary of State with a list of tools and anticipated uses of such tools which they plan to use in its analysis.

The Contractor may communicate for this purpose directly, by telephone, by encrypted e-mail and/or courier delivery of encrypted files. Changes or significant findings that may suggest changes in any portion of the testing (Functional, Source

Code Review, or Red Team Penetration Testing) shall be provided to the Secretary of

State when…