RFQ_26-0220687_Bugcrowd_SaaS_Rnwl.pdf

P.O. Box 1810 Rancho Cordova, CA 95741-1810

DATE: August 5, 2026

REQUEST FOR QUOTATION (RFQ) #26-0220687

Bugcrowd Software as a Service (SaaS) Renewal

The California Department of Technology (CDT) is inviting responses to this Request for Quotation (RFQ) entitled: Bugcrowd Software as a Service (SaaS) Renewal.

CDT considers this RFQ complete and without need of explanation. However, if you have questions or need any clarifying information, please contact the CDT Departmental Contact listed below via email and place your question(s) in writing. This RFQ will be awarded to the lowest responsive, responsible Bidder.

Quotes are due by 5:00 PM (PT) on August 19, 2026. Your RFQ response shall be emailed to the Department Contact named below. CDT will not accept late, faxed, nor physically mailed/delivered bids.

Bids must be emailed and received on, or before, the date and time specified herein. Please refer to Section I, RFQ RESPONSE REQUIREMENTS, for more information.

The Bid must be signed by an authorized representative that can bind the company contractually.

Vendor Name:

Product/Service Description:

Bugcrowd Software as a Service (SaaS) Renewal

Refer to Attachment 1- Cost Worksheet for itemized cost

Term: Upon Approval – June 13, 2027

Price Quotation: $

Applicable Sales Tax: $0.00 (electronic delivery)

Total: $

REQUIRED DOCUMENTATION: Please complete, print and email the document(s) or information below.

Please complete the information above, and sign and date Page 3 of this RFQ.

Please complete, sign and date Attachment 1, Cost Worksheet, within this RFQ.

Please indicate if you are claiming the Small Business (SB) preference. (Refer to Section IV for more information.)

Claiming the SB preference? Yes No

If “Yes,” are you a CA certified SB? Yes No Enter the CA Certified SB Number:

OR

Are you a non-SB claiming the preference by subcontracting at least 25% to CA certified SB?

Yes No

Enter the subcontracted CA Certified SB’s Name:

Enter the subcontracted CA Certified SB’s Number:

Note: Completion of the Bidder Declaration, is also required.

State of California RFQ #26-0220687 California Department of Technology

Please indicate if you are claiming the Disabled Veterans Business Enterprise (DVBE) incentive.

(Refer to Section IV or more information.)

Claiming the DVBE incentive? Yes No

If “Yes:”

Are you a CA certified DVBE? Yes No Enter the CA Certified DVBE Number:

OR

Are you a non-DVBE claiming the incentive by subcontracting at least 5% to CA certified DVBE?

Yes No Enter the subcontracted CA Certified DVBE’s Name:

Enter the subcontracted CA Certified DVBE’s Number:

Enter the percentage being subcontracted to the CA Certified DVBE: % Note: Completion of the Bidder Declaration, is also required.

Please complete the DVBE affiliation (DGS PD 843), if applicable. See hyperlink below for form https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/pd_843.pdf

Please indicate if you are claiming the Target Area Contract Preference Act (TACPA) preference.

(Refer to Section IV for more information.)

Claiming the TACPA preference? Yes No

If “Yes,” please ensure to follow the requirements described in Section IV, and submit the completed TACPA Preference Request Form (STD 830) and the Bidder’s Summary of Contract Activities and Labor Hours (DGS/PD 526) located here:

http://tacpa.dgs.ca.gov/

Please complete, sign and email the Std 204, Payee Data Record Form. See hyperlink below for form: STD 204 Payee Data Record

Please complete, sign and email the Std 205, Payee Data Record Supplement Form, if applicable. See hyperlink below for form: STD 205 Payee Data Record Supplement

Please sign and e-mail back the Bidder Declaration Form. Click the hyperlink below for form:

Bidder Declaration GSPD-05-105

Please complete and sign the Civil Rights Laws Attachment form:

https://www.documents.dgs.ca.gov/dgs/fmc/dgs/ols004.pdf

Please complete, sign and return the Federal Debarment Certification Form.

https://www.documents.dgs.ca.gov/dgs/FMC/GS/PD/PD_2.pdf

Please complete, sign and return Attachment 2 Byrd Anti-Lobbying Amendment Form.

https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/pd_843.pdf http://tacpa.dgs.ca.gov/ https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.documents.dgs.ca.gov%2Fdgs%2Ffmc%2Fpdf%2Fstd204.pdf&data=04%7C01%7Ckristine.vankeuren%40STATE.CA.GOV%7Ce30a331f9dd1456a14c108d8f9f3376e%7C52b26be47f5d4e1cbaed8cf75b7570d5%7C0%7C0%7C637534170461433575%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=X04VlEJkbwYcRPYArJ0KMYAikGvpvykcbdt4nS4M5iE%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.documents.dgs.ca.gov%2Fdgs%2Ffmc%2Fpdf%2Fstd205.pdf&data=04%7C01%7Ckristine.vankeuren%40STATE.CA.GOV%7Ce30a331f9dd1456a14c108d8f9f3376e%7C52b26be47f5d4e1cbaed8cf75b7570d5%7C0%7C0%7C637534170461433575%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=AvffAGpU14ub1p8KTkMqXPWxSM6j0VzjwKzXomkTOD0%3D&reserved=0 https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/gspd05-105.pdf https://www.documents.dgs.ca.gov/dgs/FMC/GS/PD/PD_2.pdf

State of California RFQ #26-0220687

CDT will process the resulting Agreement using its IT Delegated Purchasing Authority. The State reserves the right to amend the resulting Agreement for changes (e.g. quantity or time) consistent with the terms of the Agreement. Please note, no verbal information shall be binding to the State.

The State terms and conditions applicable to this order are listed on the DGS web sites below:

• Bidders Instructions (GSPD-451), Effective 11/09/11 https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/GSPD/Bidders-Instructions.ashx

• Cloud Computing Services - General Provisions - Information Technology (IT), Effective 2/20/2025

(DGS PD 402-ITGP):

https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT- General-Provisions-Cloud-DGS-PD-402ITGP-Revised-02202025.pdf

AUTHORIZED SIGNATURE: ______________________________________ DATE _____________

PRINTED NAME AND TITLE OF PERSON SIGNING:

Bidder offers and agrees if this response is accepted within 45 calendar days following the date the response is due to furnish all the items upon which prices are quoted, at the prices set opposite each item, delivered at the designated point(s) by the method of delivery and within the times specified and subject to the attached General Provisions. DECLARATIONS UNDER PENALTY OF PERJURY; By signing above, with inclusion of the date of signature, the above signed bidder DECLARES UNDER PENALTY OF PERJURY under the laws of the State of California as follows: (1) (STATEMENT OF COMPLIANCE). The above signed as complied with the non-discrimination program requirements of Government Code 12990 and Title 2, California Administrative Code Section 8103, and such declaration is true and correct. (2) The National Labor Relations Board declaration set forth in Paragraph 48 of the General Provisions is true and correct. (3) If a claim is made for the Small Business or Disabled Veterans Business preference, the information set forth within is true and correct

For further information regarding this RFQ or its contents, please contact the CDT Departmental Contact listed below:

Jet Zapanta California Department of Technology Acquisitions & IT Program Management Branch P.O. Box 1810 Rancho Cordova, CA 95741 Jet.Zapanta@state.ca.gov https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/GSPD/Bidders-Instructions.ashx https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-Cloud-DGS-PD-402ITGP-Revised-02202025.pdf https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-Cloud-DGS-PD-402ITGP-Revised-02202025.pdf mailto:Jet.Zapanta@state.ca.gov

State of California RFQ #26-0220687

I. RFQ RESPONSE REQUIREMENTS

1. The Bidder must provide completed documents for all items listed in “Required Documentation” as provide on pages 1 through 3. Where forms are not applicable, a response to the checklist is required.

2. KEY ACTION DATES:

It is recognized that time is of the essence. All bidders submitting quotes are hereby advised of the following schedule and will be expected to adhere to the required dates and times. CDT assumes no responsibility for quotes not received by the quote due date at the specified location.

EVENT DATE

Release of RFQ August 5, 2026 Last Date/Time to Submit Questions (Via Email)

August 12, 2026 at 11:00 AM PT

Release of Questions and Answers, Addendum 1, if needed

August 14, 2026

Quotes Due Date and Time (Must Be Received By)

August 19, 2026 at 5:00 PM PT

Review of Quotation Submissions Begins* August 20, 2026 Anticipated Intent to Award Date* (Agreement Award)

August 21, 2026

Estimated Agreement Term (Initial Engagement of Services/ Base Term)

Upon Approval – June 13, 2027

3. WRITTEN QUESTIONS:

All questions regarding the content of this RFQ must be submitted in writing by email to the Department Contact named on the cover page and must be received by the Key Action Date identified above. Questions not submitted in writing by the Key Action Date for written questions shall only be answered at the State’s option.

When the State has completed its review of the questions received timely, the questions and answers will be answered in the form of an addendum and posted online at https://caleprocure.ca.gov.

Note: Do not submit questions via Cal e-Procure. Questions will only be accepted via email to the Department Contact as indicated.

4. SUBMISSION OF BID:

All bids received must be submitted via two (2) emails and sent to CDT as indicated herein. Each emailed package must be plainly marked “BID” or “COST BID” with the RFQ number and Bidder’s name in the subject line. Examples for the two (2) email submissions are provided below:

SUBJECT LINE (for Bid Response):

RFQ # 26-0220687 – BIDDER’S NAME – BID – JZ

SUBJECT LINE (for Cost Response):

RFQ # 26-0220687 – BIDDER’S NAME – COST BID – JZ

https://caleprocure.ca.gov/

State of California RFQ #26-0220687

Bids submitted or delivered via any other method will not be accepted. The Bidder is solely responsible for ensuring that the full bid is received by the State in accordance with the solicitation requirements, at the specified location, and prior to the Quotes Due Date and Time. The State shall not be responsible for any delays in delivery, including but not limited to, transmission errors, or any other delays or mis-delivery.

WHEN SUBMITTING YOUR RESPONSE TO THIS RFQ, BIDDER MUST SUBMIT:

a. Two (2) emails as described below:

1) One (1) email containing the electronic copy of the entire RFQ response packet (excluding cost) and marked as “MASTER,” to be submitted via the email address on the cover page of this RFQ and following the naming convention for the Subject Line as described herein; and

2) One (1) email containing the electronic copy of the Cost Worksheet submitted via the email address on the cover page of this RFQ and following the naming convention for the Subject Line as described herein.

II. RFQ GENERAL INFORMATION

1. Issuance of this RFQ in no way constitutes a commitment by the State to award an

Agreement. The State reserves the right to reject Bids received and cancel this RFQ if the State determines that it is in the State’s best interest to do so. RFQ responses that reference a Bidder’s own terms and conditions, provisions, assumptions, and/or conditional language will be considered non-responsive and be rejected. Any response that is conditional or incomplete may also be considered to be non-responsive.

Assumptions made by the Bidder in responding to this RFQ do not obligate the State.

Additionally, assumptions may make the Bid conditional and cause the Bid to be rejected.

2. If a Bidder discovers any ambiguity, conflict, discrepancy, omission or any other errors in this RFQ, the Bidder should immediately provide written notice to the State of such error and request clarification or modification of the affected document. Bidders requiring clarification of the intent and content of this RFQ may request clarification by submitting questions via email to the Department Contact listed on the cover page of this RFQ.

3. The State may modify any part of the RFQ, by issuance of one (1) or more addenda.

Addenda will be numbered consecutively and posted online at caleprocure.ca.gov.

4. The State may request clarifications from Bidders at any phase of the assessment and selection process for the purpose of clarifying ambiguities in the information presented in the Response. The State is under no obligation to request clarification if information in the Bid is unclear.

5. All costs for developing Responses are entirely the responsibility of the Bidder and shall not be chargeable to the State.

6. Both the RFQ 26-0220687 and the attached Agreement in its entirety (Exhibits A-D) will be a part of the final purchase order when executed.

https://caleprocure.ca.gov/

State of California RFQ #26-0220687

III. RESPONSIBLE BIDDER

This RFQ will be awarded to the lowest, responsive, responsible Bidder. CDT may require Bidder(s) to submit evidence of their qualifications at such times and under conditions, as it may deem necessary. If a Bidder has been determined to be non-responsible, the RFQ response shall be rejected.

The Bid may be rejected if it is conditional or incomplete, or if it contains any alterations of form or other irregularities of any kind. CDT may reject any or all Bids and may waive any immaterial deviation in the Bid. CDT’s waiver of an immaterial defect shall in no way modify the Bid document or excuse the Bidder from full compliance with all the requirements if awarded the Agreement.

1. AWARD OF CONTRACT:

Award of contract, if made, will be in accordance with the RFQ information on evaluation to a responsible bidder whose bid complies with all the requirements of the RFQ documents and an addenda thereto, except for such immaterial defects as may be waived by the State. Award, if made, will be made within forty-five (45) days after the scheduled date for Contract Award as specified in the RFQ; however, a bidder may extend the offer beyond 45 days in the event of a delay of contract award. The State reserves the right to determine the successful bidder(s) either on the basis of individual items or on the basis of all items included in its RFQ, unless otherwise expressly provided in the State’s RFQ. Unless the bidder specifies otherwise in its bid, the State may accept any item or group of items of any bid. The State reserves the right to modify or cancel in whole or in part its RFQ. Written notification of the State’s intent to award will be made to all bidders. If a bidder, having submitted a bid, can show that its bid, instead of the bid selected by the State, should be selected for contract award, the bidder will be allowed five (5) working days to submit a Notice of Intent to Protest, according to the instructions contained in the paragraph titled “Protests” of this RFQ

2. PROTESTS:

Any bidder’s issues regarding solicitation requirements must be resolved (or attempts to resolve them must have been made) before a protest may be submitted according to the procedure below. These issues will first be resolved by the Department Contact for the solicitation or if they result in a protest, the protest will be submitted to DGS Procurement Division Deputy Director to hear and resolve issues and whose decision will be final. If a bidder has submitted a bid which it believes to be responsive to the requirements of the RFQ and to be the bid that should have been selected according to the evaluation procedures in the solicitation and the bidder believes the State has incorrectly selected another bidder for award, the bidder may submit a protest of the selection as described below.

Protests regarding selection of the “successful bidder” will be heard and resolved by the Victim Compensation and Government Claims Board whose decision will be final. All protests of award must be made in writing, signed by an individual authorized to bind the bidder contractually and financially, and contain a statement of the reason(s) for protest;

citing the law, rule, regulation or procedure on which the protest is based. The protester must provide facts and evidence to support the claim. Protests must be mailed or delivered to:

State of California RFQ #26-0220687

Street and Mailing Address:

Deputy Director Procurement Division 707 Third Street, Second Floor South West Sacramento, CA 95605 Facsimile No.: (916) 375-4611

All protests to the RFQ or protests concerning the evaluation, recommendation, or other aspects of the selection process must be received by DGS Procurement Division Deputy Director as promptly as possible, but not later than the date indicated in the Notification of Intent to Award. Certified or registered mail must be used unless delivered in person, in which case the protester should obtain a receipt of delivery.

IV. EVALUATION

1. EVALUATION PROCESS:

a. At the time of bid review, each will be checked for the presence or absence of required information in conformance with the submission requirements of this RFQ.

b. The State will evaluate each quote to determine its responsiveness to the published requirements.

c. Award, if made, will be to the responsive and responsible bidder with the lowest total cost, after application of any applicable incentives and preferences.

2. INCENTIVES AND PREFERENCES:

a. CALIFORNIA CERTIFIED SMALL BUSINESS (SB) AND PREFERENCE(S)

INFORMATION:

1) Small Business Preferences and Certification: Bidders claiming the SB preference must be certified by California as a small business or must commit to subcontracting at least twenty-five percent (25%) of the net bid price with one or more California certified small businesses. Small Business Nonprofit Veteran Services Agencies (SB/NVSA) prime bidders meeting requirements specified in the Military and Veterans Code Section 999.50 et seq. and obtaining a California certification as an SB are eligible for the five percent (5%) small business preference. If applicable, claim the preference by checking the appropriate box in the checklist and provide the required information.

2) SB Participation Reporting Requirements: Per Government Code 14841, if a contract/purchase order is awarded from this solicitation with a commitment from the prime bidder to achieve small business participation, the contractor must within sixty (60) days of receiving final payment under this agreement (or within such other time period as may be specified elsewhere in this agreement) report to the awarding department the actual percentage of small business participation achieved.

3) Non-Small Business Subcontractor Preference: A five percent (5%) bid preference is available to a non-small business claiming twenty-five percent (25%) California Certified small business subcontractor participation. If applicable, claim the preference by checking the appropriate box in the checklist and provide the required information. If claiming the non-small business subcontractor preference, the bid response must include a list of the small business(es) with which you commit to subcontract in an amount of at least twenty-five percent (25%) of the net bid price with one of more California certified

State of California RFQ #26-0220687 small businesses. Each listed certified small business must perform a “commercially useful function” in the performance of the contract as defined in Government Code Section 14837(d)(4). The required list of California certified small business subcontracts must be attached to the bid response and must include the following: 1) subcontractor name, 2) address, 3) phone number, 4) a description of the work to be performed and/or products supplied, 5) and the dollar amount or percentage of the net bid price (as specified in the solicitation) per subcontractor.

b. CALIFORNIA CERTIFIED DISABLED VETERAN BUSINESS ENTERPRISE (DVBE)

PARTICIPATION AND INCENTIVE INFORMATION:

1) DVBE Participation Requirements:

CDT is requiring DVBE Participation. Aligned with legislative changes of AB 230 (Brough, Chapter 676, Statutes of 2019) amending Section 999.5 of the Military and Veterans Codes (MVC) and Sections 14839 and 14841 of the Government Code (GC) and the added Section 10230 to the Public Contract Code (PCC); AB 1365 (Veterans Affairs Committee, Chapter 689, Statutes of 2019) added Section

999.55 to the MVC; and SB 588 (Archuleta, Chapter 80, Statutes of 2020) added Section 999.7 to the MVC, it is the awarded Contractor’s responsibility to understand and comply with these requirements.

• The awarded Contractor is required to submit a complete and accurate Prime

Contractor’s Certification – DVBE Subcontracting Report (STD 817) upon contract completion.

(Link to STD 817: https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std817.pdf)

• CDT will withhold $10,000, or full payment if less than $10,000, from a prime Contractor’s final payment pending the receipt of a complete and accurate

STD 817.

• CDT will review the STD 817 and determine if it is complete and accurate.

The withhold will only be released once the review and determination has been completed by CDT.

• If the STD 817 is late or incomplete, CDT will send the prime Contractor a cure notice allowing a minimum of 15 days, but no more than 30 days, to meet the certification requirements.

• If the prime Contractor does not comply by the identified deadline, the withhold is permanently deducted.

• All records shall be retained for a minimum of six (6) years.

2) DVBE Incentive: Bidders claiming the DVBE incentive must be certified by California as a DVBE and must commit at least 1% of the net bid price to one or more California certified DVBEs.

Bidders claiming the incentive must state this intention in their Bid Response and submit the required forms as applicable. The DVBE incentive will be applied after the application of the SB preference.

For the DVBE incentive to be applied, the Bidder must be compliant with the DVBE program requirements and responsive to all other requirements, including https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std817.pdf

State of California RFQ #26-0220687 a CUF performed by the DVBE(s). The scale below depicts the DVBE incentive available:

Confirmed DVBE Participation of: DVBE Incentive:

5% or More 5%

4% - 4.99% inclusive 4% 3% - 3.99% inclusive 3% 2% - 2.99% inclusive 2% 1% - 1.99% inclusive 1%

3) DVBE Subcontractor Substitution: The Contractor/Bidder understands and agrees that should award of this contract be based in part on their commitment to use the DVBE subcontractor(s) identified in their bid, per Military and Veterans Code section 999.5 (e), a DVBE subcontractor may only be replaced by another DVBE subcontractor and must be approved by the Department of General Services (DGS). Changes to the scope of work that impact the DVBE subcontractor(s) identified in the bid and approved DVBE substitutions will be documented by contract amendment. Failure of Contractor to seek substitution and adhere to the DVBE participation level identified in the bid or offer may be cause for contract termination, recovery of damages under rights and remedies due to the State, and penalties as outlined in M&VC Section 999.9; Public Contract Code (PCC) section 10115.10.

4) DVBE Participation Reporting Requirements: If a contract/purchase order is awarded from this solicitation with a commitment from the prime bidder to achieve DVBE participation, pursuant to M&VC Section 999.5, the prime contractor must within sixty (60) days of receiving final payment under this agreement (or within such other time period as may be specified elsewhere in this agreement) certify the information contained in the “Prime Contractor’s DVBE Subcontracting Report (Rev. April 2014)” The state reserves the right to verify all of the above information. Any person or entity that knowingly provides false information shall be subject to a civil penalty for each violation as stated in M&VC Section 999.5(d). The form should be provided by and returned to the ordering agency by the prime contractor. It is the prime contractor’s responsibility to ensure the form is received, completed and returned within the stated time frame.

c. TARGET AREA CONTRACT PREFERENCE ACT (TACPA) PREFERENCE: The

TACPA preference will be granted for this procurement. Bidders wishing to take advantage of this preference will need to review the following website and submit the appropriate response with the bid: http://tacpa.dgs.ca.gov/

Bidders wishing to take advantage of these preferences are required to submit the following applications/forms:

• TACPA (Std. 830)

• Bidder’s Summary of Contract Activities and Labor Hours (DGS/PD 525)

• Manufacturer Summary of Contract Activities and Labor Hours (DGS/PD 526).

Bidders who are not requesting the TACPA preference need not return these documents with the bid response.

http://tacpa.dgs.ca.gov/

State of California RFQ #26-0220687

3. COMMERICALLY USEFUL FUNCTION:

CDT will uniformly apply Commercially Useful Function (CUF) Best Practices standards in collective consideration of CUF standards set forth by 49 CFR Part 26.55 (c)-(d), Government Code section 14837, California Code of Regulations section 1896.4(h), and Military and Veteran Code section 999(b) (5). An SB, DVBE, and MB is deemed to perform a CUF if the business meets the following CUF standards:

a. Performs a CUF when a SB/MB/DVBE is responsible for the execution of a distinct element of work of the Agreement and is carrying out its responsibilities by performing, managing, and supervising the work involved.

b. Performs work that is normal for its business services and functions.

c. Be responsible, with respect, to materials and supplies used on the Agreement, for negotiating price, determining quality and quantity, ordering the material, and installing and paying for the material itself.

d. An SB/MB/DVBE does not perform a CUF if its role is limited to that of an extra participant in a transaction, contract, or project through which funds are passed in order to obtain the appearance of SB/MB/DVBE participation.

e. An SB/MB/DVBE does not perform a CUF if it subcontracts a greater portion of the work than would be expected by normal industry practices.

V. DELIVERY

For the purpose of this solicitation, only Bid responses quoting F.O.B. Destination will be accepted.

VI. PAYEE DATA RECORD (STD. 204) and PAYEE DATA RECORD SUPPLEMENT (STD.

205)

The Bidder is required to submit a completed Payee Data Record (Standard Form 204) in response to the RFO. Refer to the following website link for more details: STD 204

To facilitate the collection of remittance address(es) and contact information in addition to that provided on the STD 204, the State Controller’s Office (SCO) Vendor Management Group (VMG) has developed and published the Payee Data Record Supplement form (STD 205 New 03/2021). The STD 205 must be used to provide the supplier’s remittance address information if different than the mailing address on the STD 204. This newly published form allows suppliers to provide up to five (5) additional remittance addresses and identify up to three (3) additional authorized representatives for the payee. Refer to the following website link for more details: STD 205

VII. BIDDER DECLARATION FORM

When completing the declaration, Bidders must identify all subcontractors proposed for participation in the contract. Bidders awarded a contract are contractually obligated to use the subcontractors for the corresponding work identified unless the State agrees to a substitution and it is incorporated by amendment to the contract.

At the State’s option prior to award, Bidders may be required to submit additional written clarifying information. Failure to submit the required written information as specified may be grounds for quote rejection.

https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.documents.dgs.ca.gov%2Fdgs%2Ffmc%2Fpdf%2Fstd204.pdf&data=04%7C01%7Ckristine.vankeuren%40STATE.CA.GOV%7Ce30a331f9dd1456a14c108d8f9f3376e%7C52b26be47f5d4e1cbaed8cf75b7570d5%7C0%7C0%7C637534170461433575%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=X04VlEJkbwYcRPYArJ0KMYAikGvpvykcbdt4nS4M5iE%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.documents.dgs.ca.gov%2Fdgs%2Ffmc%2Fpdf%2Fstd205.pdf&data=04%7C01%7Ckristine.vankeuren%40STATE.CA.GOV%7Ce30a331f9dd1456a14c108d8f9f3376e%7C52b26be47f5d4e1cbaed8cf75b7570d5%7C0%7C0%7C637534170461433575%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=AvffAGpU14ub1p8KTkMqXPWxSM6j0VzjwKzXomkTOD0%3D&reserved=0

State of California RFQ #26-0220687 https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/gspd05-105.pdf

VIII. CALIFORNIA CIVIL RIGHTS LAW CERTIFICATION

Effective January 1, 2017, the Unruh Civil Rights Act and the Fair Employment and Housing Act (also referred to as the Acts; see Public Contract Code section 2010) establishes restrictions against contracting with vendors that have policies or practices that violate the Acts.

Pursuant to Public Contract Code (PCC) 2010, a person that submits a bid or proposal or proposes to renew a contract with, a state agency in the amount of $100,000 or more shall certify, under penalty of perjury, at the time the bid or proposal is submitted or the contract is renewed, all of the following:

1. That they are in compliance with the Unruh Civil Rights Act (Section 51 of the Civil

Code).

2. That they are in compliance with the California Fair Employment and Housing Act (Chapter 7 (commencing with Section 12960) of Part 2.8 of Division 3 of Title 2 of the Government Code).

3. Supplier discrimination policies:

a. That any policy that they have against any sovereign nation or peoples recognized by the government of the United States, including, but not limited to, the nation and people of Israel, is not used to discriminate in violation of the Unruh Civil Rights Act (Section 51 of the Civil Code) or the California Fair Employment and Housing Act (Chapter 7 (commencing with Section 12960) of Part 2.8 of Division 3 of Title 2 of the Government Code).

b. Any policy adopted by a person or actions taken thereunder that are reasonably necessary to comply with federal or state sanctions or laws affecting sovereign nations or their nationals shall not be construed as unlawful discrimination in violation of the Unruh Civil Rights Act (Section 51 of the Civil Code) or the California Fair Employment and Housing Act (Chapter 7 (commencing with Section 12960) of Part 2.8 of Division 3 of Title 2 of the Government Code.

Bidders must complete and sign the California Civil Rights Laws Certification and submit with their bid response. Bidders must also agree to re-certify if the option to extend or an amendment to add time or funding to the contract is utilized.

IX. PLASTIC TRASH BAG CERTIFICATION VIOLATIONS

Public Resources Code §42290 et seq. prohibits the State from contracting with any supplier, manufacturer, or wholesaler, and any of its divisions, subsidiaries, or successors that have been determined to be noncompliant to the recycled content plastic trash bag certification requirements. This includes award of a State contract or subcontract or renewal, extension, or modification of an existing contract or subcontract. Prior to award https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/gspd05-105.pdf

State of California RFQ #26-0220687 the State shall ascertain if the intended awardee or proposed subcontractor is a business identified on the current CalRecycle noncompliant list(s). In the event of any doubt of the status or identity of the business in violation, the State will notify the Board of the proposed award and afford the Board the opportunity to advise the State. No award will be made when either the Bidder or a subcontractor has been identified either by published list or by advice from the Board, to be in violation of certification requirements.

X. TIEBREAKER

In the event of a tie, contract award will be made as a result of a coin toss. Tied Bidders will be invited to attend the coin toss and State witnesses will also be present.

Note: In the event of a precise tie between suppliers claiming the incentive, the Bid of an SB and the Bid of a DVBE that is also a SB, the award shall go to the DVBE that is also an SB. (Reference Chapter 3 and GC section 14838 (f) and 2 CCR section 1896.8(f)).

XI. GC 12990 AND NON-DISCRIMINATION (IT AND NON-IT GOODS ONLY)

Any employer who wishes to contract with the State for goods is subject to the provisions of GC 12990 relating to discrimination in employment. Contractors that do not meet the provisions of GC 12990 are not eligible to contract with the State for IT goods. Ineligible contractors are found in the California Regulatory Notice Register. To access the California Regulatory Notice Register: https://oal.ca.gov/publications/notice_register/

XII. FEDERAL TAX ADMINISTRATION REQUIREMENTS

CDT must notify the United States Internal Revenue Service (IRS) prior to executing, or amending, any agreement to disclose, or provide access to, federal tax information (FTI) to a Contractor or Sub-Contractor, at least 45 calendar days prior to the disclosure of FTI, to ensure appropriate contractual language is included and that Contractors are held to safeguarding requirements. This procedure conforms to IRS Publication 1075. Subject to the IRS, FTI requirements, if an unfavorable response is received by the IRS, this contract will be terminated immediately, per the Cloud Computing Services - General Provisions – Information Technology (402-ITGP), clause 16.3, Termination for Default. In conformation with IRS Publication 1075.

XIII. SECURITY AND DATA PROTECTION REQUIREMENTS

CDT must ensure agreements with state and non-state entities include provisions which protect and minimize risk to the state when engaging in the development, use, or maintenance of information systems, products, solutions, or services. Bidders must comply with the State Administrative Manual (SAM) Section 5305.8.

XIV. GENERATIVE ARTIFICIAL INTELLIGENCE (GenAI) REQUIREMENTS

The State of California seeks to realize the potential benefits of GenAI, through the development and deployment of GenAI, while balancing the risks of these technologies.

Bidder/Offeror must notify the State in writing if it: (1) intends to provide GenAI as a deliverable to the State; or (2), intends to utilize GenAI, including GenAI from third parties, to complete all or a portion of any deliverable that materially impacts: (i) functionality of a State system, (ii) risk to the State, or (iii) Contract performance. For avoidance of doubt, https://oal.ca.gov/publications/notice_register/

State of California RFQ #26-0220687 the term "materially impacts" shall have the meaning set forth in State Administrative Manual (SAM) 4986.2.

Failure to report GenAI to the State may result in disqualification. The State reserves its right to seek any and all relief it may be entitled to as a result of such non-disclosure.

Upon notification by a Bidder/Offeror of GenAI as required, the state reserves the right to incorporate GenAI Special Provisions into the final contract or reject bids/offers that present an unacceptable level of risk to the state.

Government Code 11549.64 defines “Generative Artificial Intelligence (GenAI)” as an artificial intelligence system that can generate derived synthetic content, including text, images, video, and audio that emulates the structure and characteristics of the system’s training data.

https://www.dgs.ca.gov/Resources/SAM/TOC/4900/4986-2 https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=GOV&sectionNum=11549.64.&highlight=true&keyword=Generative%20Artificial%20Intelligence

State of California RFQ #26-0220687

ATTACHMENT 1 - COST WORKSHEET

Bugcrowd Software as a Service (SaaS) Renewal

Upon Approval through June 13, 2027

California Department of Technology Requested Quote:

Bidders must submit a cost quote for each item(s) in the following list and clearly state unit price and extended (cost) price.

ITEM QTY DESCRIPTION UNIT

PRICE

EXTEND

ED

PRICE

1 1

Bugcrowd: Includes: Crowdcontrol Platform Triage Engine - A proprietary algorithm which automatically filters out-of-scope and duplicate submissions. Crowd Engine - Researchers are matched to your targets based on skills and expertise. Crowd is auto-rotated to keep activity up.

Validation Services - Bugcrowd's review team will handle the initial validation of issues and provide recommendations of technical impact of the vulnerability further enabling your organization to focus on key business issues

2 1

BugCrowd: A Vulnerability Disclosure Program is the first step for organizations hoping to improve collaboration with the Security Researcher Community. Bugcrowd's proprietary platform, Crowdcontrol, makes this a safe and easy process for any organization to launch. VDP Professional by Bugcrowd includes access to: - Public or Private Program on Bugcrowd.com/programs attracting the highest volume of Researchers - Embedded Submission Form - Email Intake System - Unlimited Triage and Validation by Bugcrowd's Industry Leading Security Operations Team - Program Set up - SDLC Integration - Advanced Program Reporting - Ongoing Program Health - Ongoing Support & Account Management

3 1

Bugcrowd: This is a reward pool payment into a program and will be topped up over time as needed. Bugcrowd will work with Customer to determine industry-standard rewards at the time of distribution. Payout ranges and pool amounts are suggested by Bugcrowd.

4 1

Platform Fee 1-99 Days. Access during the term of this Order (up to12 months) to Bugcrowd PTaaS portal with realtime submissions dashboard, platform reporting and SDLC Integrations, in-platform retesting of tested assets and access to dedicated Program manager. Off-platform reporting, re-testing and project management supported by drawing down on available Draw Down days purchased separately.

State of California RFQ #26-0220687

Subtotal (lines 1-4):

Tax (if applicable):

N/A- Electronic Download

Grand Total:

SB/DVBE Certification

Number:

FEIN Number:

Signature and Date:

Printed Name and Title:

Company Name:

Company Address:

Contact Phone Number:

State of California RFQ #26-0220687

ATTACHMENT 2 – BYRD ANTI-LOBBYING AMENDMENT FORM

31 C.F.R. Part 21 – New Restrictions on Lobbying – CERTIFICATION REGARDING LOBBYING

The undersigned certifies, to the best of their knowledge and belief, that:

1. No Federal appropriated funds have been paid or will be paid, by or on behalf of the undersigned, to any person for influencing or attempting to influence an officer or employee of an agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of any Federal contract, the making of any Federal grant, the making of any Federal loan, the entering into of any cooperative agreement, and the extension, continuation, renewal, amendment, or modification of any Federal contract, grant, loan, or cooperative agreement.

2. If any funds other than Federal appropriated funds have been paid or will be paid to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with this Federal contract, grant, loan, or cooperative agreement, the undersigned shall complete and submit Standard Form-LLL, “Disclosure Form to Report Lobbying,” in accordance with its instructions.

3. The undersigned shall require that the language of this certification be included in the award documents for all sub awards at all tiers (including subcontracts, sub grants, and contracts under grants, loans, and cooperative agreements) and that all contractors shall certify and disclose accordingly.

4. This certification is a material representation of fact upon which reliance was placed when this transaction was made or entered into. Submission of this certification is a prerequisite for making or entering into this transaction imposed by Section 1352, Title 31, U.S. Code. Any person who fails to file the required certification shall be subject to a civil penalty of not less than $10,000 and not more than $100,000 for each such failure.

The Contractor certifies or affirms the truthfulness and accuracy of each statement of its certification and disclosure, if any. In addition, the contractor understands and agrees that the provisions of 31 U.S.C. Ch. 38, Administrative Remedies for False Claims and Statements, apply to this certification and disclosure, if any.

Signature of Contractor’s authorized official

Date:

(Print name and title of person signing above)

STATE OF CALIFORNIA CONTRACTOR TBD

DEPARTMENT OF TECHNOLOGY PO 26-TBD / RFQ No. 26-0220687

EXHIBIT A

STATEMENT OF WORK

1. Contract Description:

CONTRACTOR TBD (hereinafter referred to as “the Contractor”) agrees to provide the California Department of Technology (hereinafter referred to as the “State,” “CDT,” and/or the “Licensee”) with Bugcrowd Software as a Service (SaaS) Renewal, as listed on Page 1 of RFQ No. 26-0220687 and on Exhibit C – Cost Worksheet of this Agreement.

2. Licensee Site/Location:

The “Licensee Site” shall mean CDT, as identified in this Agreement, which Licensee represents, is operated or controlled by the Licensee. The Licensee may change the Licensee Site to another location located within the United States without incurring additional charges.

CDT, Office of Technology Services Gold Camp Campus Vacaville Campus

3101 Gold Camp Drive 1020 Vaquero Circle Rancho Cordova, CA 95670 Vacaville, CA 95688

3. License Type: Software as a Service (SaaS) Subscription per designated user, per year.

4. Term: Upon approval through June 13, 2027

5. Installed on: All the software associated with this SaaS is installed at the manufacturer’s or

Contractor’s site.

6. Notices:

All notices required by or relating to this Agreement shall be in writing and shall be sent to the parties of this Agreement at their address as set below unless changed from time to time, in which event each party shall notify the other in writing, and all such notices shall be deemed duly given if deposited, postage prepaid, in the United States mail and directed to the following addresses:

The technical representative during the term of this Agreement will be:

State Agency Manufacturer CDT, Office of Information Security Bugcrowd

Attn: Matthew Forsberg Attn: Support Phone: (916) 898-0413 Phone: (888) 361-9734 E-mail: Matthew Forsberg@state.ca.gov E-mail: support@bugcrowd.com mailto:Matthew%20Forsberg@state.ca.gov mailto:support@bugcrowd.com

Contract inquiries should be addressed to:

State Agency Contractor

CDT, Acquisitions & IT Program Management Branch

TBD

Attn: Jet Zapanta Attn: TBD

Address: PO Box 1810

Address: TBD

Phone: (916) 245-1817 Phone: TBD E-mail: Jet.Zapanta@state.ca.gov E-mail: TBD

7. Contractor Responsibilities:

a. Contractor shall allow and coordinate testing with CDT staff annually for performance, functionality, and availability testing of the secondary backup site. Contractor must provide validation of the role between primary and secondary sites.

b. Contractor shall have a secondary site that is at least 250 miles away from the primary production site to act as a backup, failover, and redundancy site.

8. Support:

The Contractor shall ensure that Support is provided by the manufacturer, Bugcrowd, through the term of the Agreement.

a. Phone Support: (888) 361-9734

b. Website: https://docs.bugcrowd.com/researchers/onboarding/support/

c. E-mail: support@bugcrowd.com

9. Amendments:

Consistent with the terms and conditions of the original solicitation, and upon mutual consent, the CDT and the Contractor may execute amendments to this Agreement for quantity, money and/or time. No additional products or services can be added to this Agreement. No amendment or variation of the terms of this Agreement shall be valid unless made in writing, and agreed upon by both parties and approved, as required. No verbal understanding or agreement not incorporated into the Agreement is binding on any of the parties.

10. Cancellation Provisions:

CDT may exercise its option to terminate the resulting Agreement at any time with thirty (30) calendar days’ prior written notice.

11. Federal Tax Administration Requirements

CDT must notify the United States Internal Revenue Service (IRS) prior to executing, or amending, any agreement to disclose, or provide access to, federal tax information (FTI) to a Contractor or Sub-Contractor, at least forty-five (45) calendar days prior to the disclosure of FTI, to ensure appropriate contractual language is included and that Contractors are held to safeguarding requirements. This procedure conforms to IRS Publication 1075.

Subject to the IRS, FTI requirements, if an unfavorable response is received by the IRS, this contract will be terminated immediately, per the Cloud Computing Services - General Provisions – Information Technology (402-ITGP), clause 16.3, Termination for Default mailto:allan@hftechservices.com mailto:Jet.Zapanta@state.ca.gov https://docs.bugcrowd.com/researchers/onboarding/support/ mailto:support@bugcrowd.com

(Exhibit D). In conformation with IRS Publication 1075, Contractor must comply with these terms.

12. Security and Data Protection Requirements:

CDT must ensure agreements with state and non-state entities include provisions which protect and minimize risk to the state when engaging in the development, use, or maintenance of information systems, products, solutions, or services. The Contractor must comply with the State Administrative Manual (SAM) Section 5305.8.

13. Clean Air Act (42 U.S.C. 7401-7671q) and the Federal Water Pollution Control Act (33

U.S.C. 1251-1388).

The Contractor agrees to comply with all applicable standards, orders or regulations issued pursuant to the Clean Air Act (42 U.S.C. 7401-7671q) and the Federal Water Pollution Control Act as amended (33 U.S.C. 1251-1387). Violations must be reported to the Federal awarding agency and the Regional Office of the Environmental Protection Agency (EPA).

EXHIBIT B

BUDGET DETAIL AND PAYMENT PROVISIONS

1. Payment and Invoicing:

a. Payment will be made annually in advance upon receipt of a correct invoice. The invoice shall include booking confirmation of the CDT Purchase Order;

including but not limited to, the product name, code (if applicable), and term date; and shall reference the Agency Order Number.

b. Aligned with legislative changes of AB 230 (Brough, Chapter 676, Statutes of 2019) amending Section 999.5 of the Military and Veterans Codes (MVC) and Sections 14839 and 14841 of the Government Code (GC) and the added Section 10230 to the Public Contract Code (PCC); AB 1365 (Veterans Affairs Committee, Chapter 689, Statutes of 2019) added Section 999.55 to the MVC; and SB 588 (Archuleta, Chapter 80, Statutes of 2020) added Section 999.7 to the MVC, it is the awarded Contractor’s responsibility to understand and comply with these requirements.

1) The awarded Contractor is required to submit a complete and accurate Prime

Contractor’s Certification – DVBE Subcontracting Report (STD 817) upon contract completion.

2) (Link to STD 817: https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std817.pdf)

3) CDT will withhold $10,000, or full payment if less than $10,000, from a prime

Contractor’s final payment pending the receipt of a complete and accurate STD 817.

4) CDT will review the STD 817 and determine if it is complete and accurate. The withhold will only be released once the review and determination has been completed by CDT.

5) If the STD 817 is late or incomplete, CDT will send the prime Contractor a cure notice allowing a minimum of 15 days, but no more than 30 days, to meet the certification requirements.

6) If the prime Contractor does not comply by the identified deadline, the withhold is permanently deducted.

7) All records shall be retained for a minimum of six (6) years.

c. Submit your invoice using only one of the following options:

1) Send via U.S. mail in TRIPLICATE to:

Administration Division – Accounting Office P. O. Box 1810

OR

2) Submit electronically at: APInvoices@state.ca.gov

d. Payment will be made in accordance with, and within the time specified in, Government Code Chapter 4.5, commencing with Section 927. Payment to https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std817.pdf mailto:APInvoices@state.ca.gov small/micro businesses shall be made in accordance with and within the time specified in Chapter 4.5, Government Code 927 et seq.

2. Budget Contingency Clause:

a. It is mutually agreed that if the Budget Act of the current year and/or any subsequent years covered under this Contract does not appropriate sufficient funds for the program, this Contract shall be of no further force and effect. In this event, the State shall have no liability to pay any funds whatsoever to the Contractor or to furnish any other considerations under this contract and Contractor shall not be obligated to perform any provisions of this contract.

b. If funding for any fiscal year is reduced or deleted by the Budget Act for purposes of this program, the State shall have the option to either cancel this Contract with no liability occurring to the State, or offer a contract amendment to the Contractor to reflect the reduced amount.

EXHIBIT C

COST WORKSHEET

Bugcrowd Software as a Service (SaaS) Renewal

Term: Upon Approval through June 13, 2027

(Placeholder for Vendor’s Quote)

EXHIBIT D

CLOUD COMPUTING SERVICES - GENERAL PROVISIONS

These provisions are hereby incorporated by reference. The provisions are revised and effective 2/20/2025.

https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document- Attachments/IT-General-Provisions-Cloud-DGS-PD-402ITGP-Revised-02202025.pdf https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/IT-General-Provisions-Cloud-DGS-PD-402ITGP-Revised-02202025.pdf…