RFQ 27-05307 for Project Health Assessments PM and Consulting and App Dev Services Final 06.15.26.docx

Commonwealth of Massachusetts The Executive Office of Technology Services and Security

Commonwealth of Massachusetts Executive Office of Technology Services and Security

Request for Quotation EOTSS RFQ 27-05307 for Project Health Assessments, Project Management and Strategic Consulting Services, and Application Development Services

COMMBUYS Bid Number (ITS81): BD-26-1060-ITD00-ITD00-130602

June 15, 2026

IN ACCORDANCE WITH M.G.L. C. 66 AND M.G.L. C. 4, § 7 (26), THIS RFQ AND ALL RESPONSES HERETO INCLUDING THE WINNING BID SHALL BECOME PUBLIC RECORD, AND CAN BE OBTAINED FROM THE EXECUTIVE OFFICE OF TECHNOLOGY SERVICES AND SECURITY BY SUBMITTING A REQUEST AT https://www.mass.gov/executive-office-of-technology-services-and-security-prr. ANY PORTIONS OF A RESPONSE THAT ARE LABELED AS CONFIDENTIAL WILL STILL BE CONSIDERED PUBLIC RECORD.

General Procurement Information

General Information

Purchasing Entity: Executive Office of Technology Services and Security (“EOTSS”) or (“Agency”)

Address: One Ashburton Place, Eighth Floor, Boston, MA 02108

Procurement Contact: Shawn Johnson

Telephone: 617-406-8329

E-Mail Address: shawn.johnson@mass.gov

RFQ File Number and Title: EOTSS RFQ 27-05307 for Project Health Assessments, Project Management and Strategic Consulting Services, and Application Development Services

Attachments: Attachment A – COMMBUYS Instructions

This Request for Quotes (“RFQ”) does not commit the Commonwealth of Massachusetts (“Commonwealth”) or Agency to approve a Statement of Work, pay any costs incurred in the preparation of a Bidder’s response to this RFQ or to procure or contract for products or services. The Agency may: (i) accept or reject any and all bids received as a result of this RFQ; (ii) contract for some, all, or none of the products and services offered by Bidders in response to this RFQ; (iii) negotiate with one or more qualified Bidders; or (iv) cancel, in part or in its entirety, this RFQ if it is in the best interest of the Commonwealth to do so.

The Agency may amend this RFQ at any time prior to the date the responses are due. Any such amendment will be posted to the Commonwealth’s procurement website, COMMBUYS (www.commbuys.com).

Bidders must submit their bids through the Commonwealth’s online procurement system, COMMBUYS, as detailed in Attachment A. Bidders are advised to check this site regularly, as this will be the sole method used for notification of changes.

Eligible Bidders

This RFQ is restricted to Bidders on the following Statewide Contracts:

· ITS81 - Project Services and GIS

Event Calendar

All times in this RFQ are in prevailing Eastern Time. Responses must be received no later than the response due date and time indicated below or they will not be evaluated. Bidders must have their responses fully loaded and accepted in COMMBUYS prior to the RFQ Response Due date and time listed below. Bidders are urged to allow sufficient time to upload their entire response.

Purchasing Agency

The Executive Office of Technology Services and Security is responsible for the development of IT policy and implementation and oversight of all information technology investments for the Commonwealth and its respective agencies. EOTSS has broad statutory authority to effectuate the goals prompting IT consolidation in Chapter 64 of the Acts of 2017, as memorialized and articulated in M.G.L. c. 6A, s. 7A and M.G.L. c. 7D. As the lead enterprise IT and cybersecurity organization for the Executive Branch, EOTSS provides responsive digital and security services, and oversees and manages the enterprise technology and digital infrastructure and services for over 125 state agencies and over 43,000 state employees. EOTSS provides Enterprise Cybersecurity and Risk Management services, Infrastructure and Network services, End-User Support and IT services, Digital and Data services, Strategy Management and Consulting services, and additional IT-focused services to the Executive Branch and other Commonwealth users.

R If checked, the contract resulting from this RFQ will be made available to other Executive Department entities for the purchase of products or services. EOTSS may, in its option, require its prior approval for such entities to purchase products or services.

Description and Purpose of Procurement

Background

EOTSS is seeking Responses from qualified ITS81 IT Project Services and GIS vendors to conduct Information Technology Project Health Assessments (“Project Health Assessment”), Information Technology Project Management and Consulting Services (“PM and Consulting Services”) and additional development work (as needed), for a variety of Information Technology projects for EOTSS and other agencies and secretariats in the Executive branch (“Eligible Entity or Eligible Entities”).

Any Vendor who enters into a contract under this RFQ shall not be precluded from bidding on, and being awarded, current or future contracts with any Commonwealth agencies that may receive services under this RFQ, except for contracts related to projects for which they are providing Project Health Assessment services at the time that the bidding on a contract commences. In addition, such Vendor will not be allowed to perform Project Health Assessments or PM and Consulting Services for any projects where they have entered into contracts or Statements of Work under a solicitation other than this RFQ for the provision of services of any kind.

EOTSS is seeking to enter into contract(s) with approximately up to five (5) qualified Bidders. Eligible Entities shall have the ability to enter into Statements of Work directly under the resulting Master Services Agreement(s) between EOTSS and the Successful Bidder(s) and shall be able to receive direct invoices for services performed by the Successful Bidder(s). The Successful Bidder(s) may be required to manage more than one Statement of Work at any given time. The Successful Bidder(s) must receive EOTSS’ prior written approval before entering into a Statement of Work with an Eligible Entity. Statements of Work cannot change any of the terms and conditions of the Master Services Agreement pursuant to which they are issued. Prior to entering into a Statement of Work, an Eligible Entity may request a project proposal from the Successful Bidder(s) detailing the proposed services and resources for review by the Eligible Entity. The Successful Bidders shall not charge the Commonwealth for any work performed in the information gathering or preparation of project proposals or Statements of Work. A submitted project proposal does not commit EOTSS or an Eligible Entity to enter into a Statement of Work.

Although EOTSS expects to enter into contract with five (5) qualified Bidders, this RFQ does not restrict EOTSS from entering into contracts with a different number of qualified Bidders, commit EOTSS to enter into a contract with any qualified Bidder, to pay any costs incurred in the preparation of any Bidder’s Response or to procure or contract for any commodities or services.

EOTSS does not commit to awarding the same number of assignments or the same dollar value of assignments to every Vendor. If in EOTSS’ judgment, a Vendor’s performance on an assignment is not satisfactory, EOTSS may choose not to assign additional assignments to the Vendor and may terminate the contract with that Vendor.

Description of Services

EOTSS is seeking Vendors who can perform the following services:

Project Health Assessment Services EOTSS believes there are fundamental items in an assessment of the health of a project, irrespective of size or complexity. EOTSS would seek to balance the complexity and size of projects in the variety of projects assigned to a Vendor to ensure maximum benefit of the assessment and the Commonwealth’s needs. It is EOTSS’ expectation that if awarded a contract, Vendors will respond within one week of Eligible Entities request for services.

The ultimate goal of the Project Health Assessment is to provide EOTSS and Eligible Entities with the necessary information and analysis (the “Necessary Information”) to assess whether the Projects assigned to the Vendor:

1. are on-track and successfully progressing towards achieving their business and technical objectives;

1. have the appropriate project management and control processes and systems in place and are actively utilizing them;

1. whether a survey report that uses select metrics to measure and assess the risk profile of a project (“the Likelihood of Success”) is in line with EOTSS’ or Eligible Entity’s Project expectations;

1. are achieving or can achieve their stated goals and benefits; and

1. are still important and needed by the Commonwealth agency and/or the Commonwealth overall.

In performing Project Health Assessments, the Vendor will analyze and assess (the “Information Analyzed”) the following, without limitation:

1. whether there are clearly articulated business and technical cases that are aligned with the Eligible Agency’s business and technology strategies, and whether those cases remain valid (i.e., the Project is still needed);

1. the defined Project governance and organization structure and processes including active executive sponsorship and commitment and stakeholder engagement;

1. whether established and appropriately scaled and effective project management processes, including methodology, defined scope, project plan, work breakdown structures, scheduling, costing/budgeting, resource planning, risk management, success criteria, are still the most appropriate methodology for the project;

1. the Project’s actual progress against projected project schedule, budget and quality requirements including clearly identified milestones and deliverables;

1. whether the Project is satisfying key business and/or technical objectives;

1. whether the Project’s Likelihood of Success is being met; and

1. whether the Project’s processes and systems to perform the following are in place and adequate:

6. issue and risk identification, tracking and management;

6. scope/change control; and

6. communications, including status and progress reporting to all participants in the project.

EOTSS expects that each Vendor will obtain and document its assessment of the information specified above through examination of Project artifacts and deliverables and interviews with relevant project management and team members as well as key Eligible Entity personnel.

When the Vendor has completed its analysis and review of the projects assigned to it, it must then compile its findings and recommendations into a written report to be delivered by the Vendor to EOTSS or the Eligible Entity at the completion of a Project Health Assessment assignment (“Final Report”) to be submitted to EOTSS or the Eligible Entity (and to others as directed by EOTSS or the Eligible Entity). The findings and recommendations the Vendor provides in its Final Report will form the basis for EOTSS and the Eligible Entities to determine what actions, if any, must be taken to resolve identified gaps and problems.

Each Final Report shall include at least the following information, where appropriate and relevant:

1. the name of the Vendor’s team members and its Project Manager for each assignment;

1. a table of contents;

1. the start and end dates of each project within the assignment;

1. names of the individuals at EOTSS or Eligible Entity who were in charge of each project within the assignment, specifying those with whom the Vendor interacted during each project within the assignment;

1. the specific services (e.g., documents, artifacts or deliverables analyzed, interviews conducted, meetings held) performed by the Vendor on each project within the assignment, indicating the date on which the services were performed, where relevant;

1. the Necessary Information (defined and listed above);

1. the Information Analyzed (defined and listed above);

1. any gaps, weaknesses or deficiencies identified for any project within the assignment

1. any critical issues identified for any project within the assignment that require prompt remedial action by the Eligible Entity or EOTSS;

1. any recommendations for project improvements;

1. any strong points, particular strengths, or accomplishments of the Eligible Entity;

1. any suggestions for the Eligible Entity’s future course or “next steps”;

1. a suggestion for a time frame for the Project’s next assessment (if any is needed) and

1. an overall rating of the Project Health on a scale of one to five with one indicating “poor” and five indicating “excellent.”

Project Health Rating. Contractor shall provide an overall Project Health rating as part of each status report using a five-point scale, where:

5 – Excellent: Project is on schedule, within budget, and no material risks or issues exist.

4 – Good: Minor risks or issues exist, but no material impact to schedule, budget, scope, or quality is anticipated.

3 – Fair: One or more risks or issues require management attention and may impact schedule, budget, scope, or quality if not timely addressed.

2 – Poor: Significant risks or issues are impacting project performance and corrective action is required to achieve project objectives.

1 – Critical: Project objectives are at substantial risk and immediate executive intervention is required.

The Vendor shall provide a written explanation supporting the assigned rating, including key accomplishments, open risks, open issues, mitigation activities, and any anticipated impacts to project schedule, scope, budget, or deliverables. The format and content of the Project Health assessment shall be consistent across all reporting periods and conform to any reporting template provided by the Commonwealth

The Final Report must include details on every project within the overall assignment. EOTSS is seeking a programmatic and portfolio management view by a Vendor for the projects assigned to said Vendor.

Project Management and Strategic Consulting Services In addition, the Successful Bidder may be required to provide project management, product management, and strategic consulting, including, but not limited to the following:

· Project management services (i.e., project and implementation oversight, support deliverables drafting and milestone reviews, status tracking and reporting);

· Provide qualified professionals who are experienced in full project life cycle management, with excellent skills and the ability to organize, plan, manage and execute large, complex projects and lead cross-functional, multi-agency project teams;

· Lead projects to develop and implement Information Technology strategies and standards

· Assessments of and recommendations for enterprise solutions for project tracking and portfolio management;

· Function as lead project manager in certain cases where there are no Commonwealth resources available to staff a project;

· Function as a lead delivery manager or chief product officer in certain cases where there are no Commonwealth resources available to staff a project

· Assist in the evaluation of project management and software development lifecycle methodologies and related tools and procure proprietary and/or off-the-shelf software if requested;

· Procurement support (i.e. drafting RFP, demo management, vendor selection and negotiation support);

· Subject matter expertise for people, process and technology needs;

· Benefits realization support (i.e. support policy implementation, change management and communication planning); and

· Project plans, schedules, budgets and risk assessments on all assigned projects.

Application development services In addition, the Vendor may be requested to provide application development services including, but not limited to the following:

· Providing expertise in developing secure, scalable, and maintainable applications using industry-standard technologies and the ability to comply with Commonwealth and agency-specific security, privacy, accessibility, and data protection policies.

· Advising on best practices that support the full Software Development Life Cycle (SDLC), including requirements gathering, design, development, testing, deployment (e.g., release planning and management), and maintenance. Expertise in Agile, Scrum, or hybrid project delivery methodologies as well as product management best practices.

· Providing expertise integrating applications with enterprise systems, APIs, identity management solutions, and third-party platforms.

· Assisting with design and development of cloud-based, on-premises, or hybrid solutions, including, experience with infrastructure, data migration, system modernization, and legacy application replacement initiatives.

· Expertise with evaluating GenAI features and functonality in application development practices throughout the SDLC (e.g., incorporating AI into design, coding, prototyping, process automation, testing, etc.)

· EOTSS reserves the right to request additional information, documentation, or demonstrations as necessary to evaluate and verify that the Vendor possesses the specific qualifications, expertise, and technical capabilities required to successfully perform any application development services contemplated under this engagement.

Independent Verification and Validation (IV&V) Services In addition, Vendor may be requested to provide independent IV&V services to deliver objective assessments of project health, performance, risks, controls, governance, deliverables, and overall readiness to achieve project objectives during an active project. These services may include:

· Evaluation of a vendor’s project management, scope, schedule, budget, resources, requirements, testing, processes and procedures, cybersecurity, compliance, and performance, for example by direct participation in ongoing meetings.

· Identification and assessment of risks, issues, gaps, and emerging concerns to provide actionable mitigation recommendations for corrective action

· Providing an overall independent assessment of project outcomes and communicate findings to leadership, including prompt escalation of any critical risks or material concerns as needed (e.g., impacting project scope, schedule, budget, quality, security, compliance, or operational readiness).

· Providing advisory and consulting services to support an agency in negotiating a vendor’s upcoming work and deliverables based on performance evaluation Providing other similar real-time advisory and consulting services as the above, in mutual agreement with an agency, to ensure an agency’s vendor partner(s) are delivering value in accordance with their contractual obligations 1.

Estimated Term

The estimated term of any contract entered into under this RFQ shall consist of an initial 36-month term and may be renewed or extended upon written agreement by the awarded Bidder and the Agency. The initial term and all renewals or extensions shall be referred to collectively as the “Term.” The maximum Term length will be governed by the applicable Statewide Contract.

Order of Precedence

The agreement resulting from this RFQ shall consist of the following documents in the following order of precedence:

Data Classification and the Use of Generative Artificial Intelligence (GenAI)

Data Classification

The Commonwealth of Massachusetts collects, manages, and stores information to support its business operations. The Commonwealth is committed to preserving the confidentiality, integrity, and availability of its information assets. Such information assets may include, without limitation, personal information, confidential information, and information protected under applicable law. Bidder agrees and acknowledges that its access, or potential access, to certain information assets may require certifications, background checks, or other additional requirements. Agency anticipates that the awarded Bidder will have access, or potential access, to the following data types as a result of providing services/products to Agency under this RFQ.

M. G. L. c. 66A

-Commonwealth of Massachusetts Dept. of Revenue background check

NCIC 2000 Operating Manual CJIS Security Policy Title 28, CFR Part 20 -Dept. of Criminal Justice Information certification -background check

NCIC 2000 Operating Manual CJIS Security Policy Title 28, CFR Part 20 -Dept. of Criminal Justice Information certification -background check

5 U.S.C. 552a s. 1106 -background check

Bidder certifies that its products or services, as offered in its RFQ response, meet all applicable legal and regulatory requirements pertaining to the identified data types indicated above. Bidder also agrees to enter into additional agreement(s), as reasonably requested by the Commonwealth prior to gaining access, or potential access, to Commonwealth information assets. Bidder acknowledges that the list above is not exhaustive, and Agency may designate additional data types, applicable laws and regulations, and additional required documentation in the contract resulting from this RFQ or any amendment thereto.

Use of Generative AI

The following provisions apply both to Generative AI (“GenAI”) that the Contractor proposes to use or will use to fulfill its obligations under a contract, and to GenAI tools that Contractor will provide directly to the Agency for its own use.

Use of GenAI Conditioned on Compliance with these Terms

Contractor shall not use GenAI to fulfill any obligations under the contract with the Agency or provide any GenAI tools to the Agency unless the contract includes terms consistent with this section, “Use of Generative AI”.

Use and Deletion of Agency Data

Contractor shall not use Agency Data (defined as data provided by Agency and any data derived therefrom, including metadata (collectively, the “Agency Data”) for training, tuning, or testing the GenAI model unless required for the performance of Services and where the Agency has provided written consent for both the use of the GenAI tool and the Agency Data. Any permitted Agency Data inputs will be strictly limited to the data and inputs provided under this Agreement and will not extend to other Agency intellectual property. If the GenAI system/solution or Contractor’s provision of other services under the Contract require the use of Agency Data as GenAI training data, Contractor shall only use Agency Data as strictly necessary to provide the Services. Both the Contractor and Agency shall retain control over their data and have the ability to delete their data. Contractor shall delete all Agency Data within 30 days of receiving written notification from the Agency and shall confirm in writing that all Agency Data has been deleted.

Intellectual Property, Accuracy, Bias, Discrimination, Mitigation and Quality Control of GenAI

Contractor’s use of GenAI will be specifically limited to the automated creation of the material expressly defined in this Agreement’s scope. All GenAI usage will be configured to strictly align with the Agency’s brand guidelines. Contractor will implement robust quality control measures to review and approve, through non-automated means, all content generated by the GenAI tool before it is published, distributed or used in any business context. The review process must occur prior to any content being deployed or utilized in business operations, and every month thereafter, and must ensure that the content aligns with all the relevant policies, regulations and quality expectations. Additionally, the Contractor must identify, document and mitigate any biases, discrimination or otherwise unlawful outcomes based on race, color, religion, sex, national origin, disability, age, genetic information, or any other protected characteristic under applicable law in the AI solution or services.

Breach and Termination

Notwithstanding any other terms to the contrary in the Solicitation, or any contract entered by Contractor, Contractor’s failure to meet any of the obligations set forth in this provision “Use of Generative AI” will constitute a breach of the contract entitling the Commonwealth to terminate the contract for cause and without penalty and to pursue damages and any other legal or equitable remedies to which it may be entitled.

Amendments to GenAI Terms

The Commonwealth reserves the right to negotiate an amendment incorporating additional GenAI contract provisions into the contract or terminate in whole or in part any contract that, in the sole determination of the Commonwealth, presents an unacceptable level of risk to the Commonwealth with respect to GenAI.

Provision of Evaluative Information

Contractor shall regularly monitor the performance of the GenAI system to detect and rectify system behavior that violates any of these provisions. Contractor shall promptly communicate the discovery of system behavior that violates any of the requirements in this ‘Use of Generative AI’ section to the Commonwealth, including the potential impact to the services.

Order of Precedence

This section “Use of Generative AI” will take precedence over any conflicting GenAI contract terms provided by the Contractor to the Agency.

Updates to the Model/Platform

Contractor shall provide reasonable notice to the Agency of any updates to the GenAI model/platform that substantially impact the services prior to the updates taking place.

Audit

Contractor certifies that on an annual basis, or upon request of the Agency, its GenAI systems, models, or platforms, and related processes, training materials, training data sets, and its use and management of synthetic data, comply with the requirements of the Agreement. Contractor further certifies that it retains GenAI audit logs consistent with the terms of Schedule F of the Commonwealth’s Records in Common Schedule. Such certification shall be made in writing by an authorized officer of the Contractor and shall be subject to the same confidentiality protections as set forth in the Agreement, except as disclosure is required by law.

Control

For GenAI solutions/systems/models developed for the Agency, Contractor shall provide mechanisms through which the Agency can oversee the development and testing of the GenAI and where necessary override its functionality through human intervention.

Disentanglement

As of the termination date of the contract, or other date agreed upon by the Parties or determined by the Commonwealth, the Contractor shall cease the use of Generative AI in service delivery to the Agency; disengage Generative AI components; and comply with the transition/termination assistance obligations set forth in the contract.

Right to Use

During the term of the contract, Contractor shall ensure that the Agency has access to the full functionality offered by the GenAI systems/solutions used in the scope of services, including without limitation the ability to use the system, develop and test solutions, and make copies (with appropriate commercial mechanisms) without any limitations or restrictions. This clause shall survive the term of the contract if, in the contract, the Agency identifies the use of the Generative AI system as of strategic importance.

Localization

GenAI systems/solutions and data shall be hosted and stored in a cloud location controlled or approved by the Agency.

Representations

Each representation and warranty set forth in the contract applicable to information technology shall apply with equal force to GenAI solutions/systems. In addition, Contractor warrants that the GenAI that is part of the system/solution shall be accurate and generate unbiased results and, should Contractor fail to deliver on this warranty, it shall remedy, at no cost to the Agency, any such defects in the GenAI system/solution.

Additional Requirements

Enterprise Information Security Standards and Policies

All products and services provided to the Commonwealth must comply with all applicable policies adopted by the Agency, which shall be made available to Bidder prior to contract execution. At a minimum, all goods and services provided to the Commonwealth must comply with the Enterprise Information Security Standards and Policies (https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards). Bidders shall provide information that demonstrates that their security practices meet the requirements detailed in these policies.

Accessibility for IT Solutions Contract Language

The Commonwealth of Massachusetts’ Enterprise Digital Accessibility Policy drives ongoing efforts to make Massachusetts’ Digital Assets, including those delivered by a third-party, accessible and usable by all persons as required by state and federal laws. Where a Deliverable includes a Digital Asset, such Deliverable must meet the Commonwealth’s Digital Accessibility Standards.

The Commonwealth’s Digital Accessibility Standards include the Web Content Accessibility Guidelines (WCAG) version 2.1 level A and AA developed by the World Wide Web Consortium (W3C). Bidder must comply with the digital accessibility obligations set forth in the Vendor Digital Accessibility Contract Language and Vendor Digital Accessibility Testing Obligations and any subsequent versions or amendments.

During the bidding process and upon request, Bidder shall cooperate and provide the Commonwealth, or any third-party digital accessibility service provider procured by the Commonwealth, access to test its digital products for accessibility at no additional cost to the Commonwealth. The digital products must be available to the Commonwealth for evaluation prior to purchase and on an ongoing basis.

Contract Negotiation and Amendments

The Agency may negotiate changes to the original performance measures, quantities, Term length, and requirements identified in this RFQ at any time, provided that such changes are consistent with the scope of this RFQ. The Agency may negotiate and execute contract amendments with the awarded Bidder(s) which the Agency reasonably determines are within the scope of this RFQ and necessary to result in best value to the Commonwealth.

Promotional Materials

Bidder must not reference the Agency or the Commonwealth in any promotional or marketing materials, including but not limited to use of the Agency’s or the Commonwealth’s name or logo, without first obtaining the Agency’s prior written approval for such use. Bidder must not use the Commonwealth’s seal in any promotional or marketing materials.

Bidders are discouraged from including extraneous promotional or marketing materials in their responses to this RFQ and excessive promotional or marketing materials may detract from the Bidders’ overall score.

Pending Litigation

Bidder must affirm that there is no pending litigation involving the Bidder, Provider, or the services provided in the response, that may impair or interfere with the Agency’s right to use the services. Bidder must warrant that there are no actual or threatened actions arising from, or alleged under, any intellectual property rights of any third party.

Oral Presentations and Demonstrations

In its discretion, the Agency may invite one or more Bidders whose responses have been judged competitive and responsive in the course of the evaluation to participate in a facilitated oral presentation, including a demonstration of the proposed services. The Agency may use these demonstrations and oral presentations to clarify aspects of the Bidder’s response or to inquire as to the Bidder’s approach, recommendations, and experience. The Agency may adjust its scoring of a prospective Bidder based on the Bidder’s performance during production demonstration and/or oral presentation.

The Agency reserves the right to apply restrictions to the structure and content of Bidder’s product demonstrations and oral presentations. Demonstrations and oral presentations shall not be open to the public nor to any competitors. The schedule of the demonstrations and oral presentations will be arranged directly with the Bidders selected by the Agency. Failure of a Bidder to agree to a date and time may result in rejection of the Bidder’s response.

Review Rights

Responses to this RFQ may be reviewed and evaluated by any person(s) at the discretion of the Agency including non-allied and independent consultants retained by the Agency for the sole purpose of evaluating and analyzing responses.

Permitted Copies

If applicable, Bidders must authorize the Agency to make, keep and retain a reasonable number of machine-readable copies of all licensed, core software components included in the deliverables for testing, backup or archival purposes (the “Permitted Copies”). Such authorization shall be provided to the Agency at no additional cost.

Risk Management

Bidder must indicate the types of system audits or assessments (e.g. SOC 2) it conducts or engages third parties to conduct on its behalf, pertaining to the quoted products or services, and the frequency of such audits or assessments. Any time after submitting its Bid, upon Agency's request, Bidder shall provide audit or assessment reports to the Agency.

Warranties

Bidder shall provide all warranties listed below. Additional warranties may be agreed to in the contract resulting from this RFQ.

Bidder must provide all warranties required by the applicable Statewide Contract.

Bidder and its subcontractors will be sufficiently staffed and equipped to fulfill Bidder’s obligations under any SOW or engagement resulting from this RFQ. Bidder warrants that it shall be responsible for the actions and omissions of all subcontractors and shall ensure all subcontractors’ compliance with the terms of an agreement resulting from this RFQ.

Bidder’s services will be performed: (a) by appropriately qualified and trained personnel; (b) with due care and diligence and to a high standard of quality as is customary in the industry; (c) in compliance with the Milestone Schedule and the terms and conditions of this RFQ and any contract hereunder; and (d) in accordance with all applicable professional standards for the field of expertise.

The Deliverables will substantially conform with the Deliverable descriptions set forth in any SOW or engagement resulting from this RFQ.

All media on which the Bidder provides any software shall be free from defects.

All software delivered by the Bidder under the applicable Statewide Contract or this RFQ shall be free of Trojan horses, back doors, and other malicious code.

Bidder will obtain all rights, grants, assignments, conveyances, licenses, permissions and authorizations necessary or incidental to any materials owned by third parties, including data to train Generative AI models, supplied or specified by the Bidder for incorporation in the Deliverables to be developed under the applicable Statewide Contract.

Documentation to be provided by the Bidder shall be in sufficient detail so as to allow suitably skilled, trained, and educated Agency personnel to understand the operation of the Deliverables. Bidder agrees to promptly, at no additional cost to the Agency, make corrections to any documentation that does not conform to this warranty.

Bidder warrants that any systems that Bidder creates or modifies will operate in conformance with the Specifications for the system or modifications for six (6) months after acceptance (“Warranty Period”). As used in this RFQ, “Specifications” means (i) the requirements set forth in this RFQ, (ii) the functional, performance, and interoperability requirements set forth in any agreement entered hereunder; and (iii) the functionality and description provided in Bidder’s response to this RFQ. If EOTSS discovers a non-conformity during the Warranty Period, then the Bidder shall use commercially reasonable efforts to correct the non-conformity or provide a work around that is acceptable to the Agency (a “Fix”). If Bidder is unable to remedy a non-conformity or to provide a Fix that is acceptable to the Agency within a reasonable period of time, then the Agency may terminate any agreement effective immediately upon written notice to Bidder. Any replacement or error correction will not extend the original Warranty Period. During the Warranty Period, Bidder will not charge the Agency for services, parts, labor, or transportation

All content that may be created by GenAI is a work made for hire under U.S. Copyright law. To the extent any GenAI content may not be considered a work made for hire under applicable law, as part of the Contract, Contractor assigns to Agency, in perpetuity, all right and interest to such GenAI content without the need for further consideration. In addition, content created from the Commonwealth provided prompt is not a derivative work of the GenAI training data. Notwithstanding the preceding sentence, in the event a court of competent jurisdiction determines that content created from a Commonwealth-provided prompt constitutes a derivative work of the GenAI training data, Contractor agrees to grant the Commonwealth unlimited, irrevocable, worldwide, perpetual, royalty-free, non-exclusive right, and license to use, modify, reproduce, perform, release, display, create derivative works from, and disclose the content for any Commonwealth business.

EOTSS GenAI Policy

The Commonwealth consistently seeks to realize the benefits of new technology, in particular generative artificial intelligence (AI). Contractor must comply with the Enterprise Use and Development of Generative Artificial Intelligence Policy issued by EOTSS on January 31, 2025, as it may be amended from time to time. Please follow this link to the policy: www.mass.gov/doc/enterprise-use-and-development-of-generative-artificial-intelligence-policy/download.

Post-Quantum Cryptography (PQC)

Contractor solutions should support migration to post-quantum cryptographic standards approved or recommended by NIST or other recognized industry, governmental, or international standards bodies, and maintain cryptographic agility without requiring complete system replacement. If complete system replacement is necessary to support such migration, the transition shall be performed at no additional cost to the Commonwealth.

Bidder Responses

Bidders must complete the attached RFQ Response Form (Form 1) and a Template Master Services Agreement (Form 2).

The responses to this RFQ will be evaluated based on the criteria listed below, in descending order of importance with the most important criteria listed first. The procurement management team may remove from further consideration non-responsive bids and bids that do not include all required items listed in Section VII (Bidder Responses). Prior to such an exclusion, the Agency may request one or more clarification(s) from Bidder. A Bidder’s response may be excluded for failure to meet the Agency’s budgetary thresholds. Should this RFQ result in a contract with an annual spend amount of less than $250,000, bids from certified small businesses are highly desired, in accordance with ReOrg Plan S.2937 “An Act to Elevate the Supplier Diversity Office to Ensure Equal Opportunity in State Contracting,” and Agency will follow guidance provided by the Supplier Diversity Office in evaluating Bidder responses.

Any remaining responses will be evaluated based upon:

1. Fit to Requirements of the RFQ

2. Quality of product functionality

3. Time for delivery

4. Price as provided in the Cost Table

ATTACHMENT A – COMMBUYS Instructions

Interested Bidders must submit their response using COMMBUYS.

Useful links:

1. Job aid on how to submit a quote: https://www.mass.gov/doc/how-to-create-a-quote-in-commbuys/download

1. Webcast: How to Locate and Respond to a Bid in CommBuys, which will familiarize bidders with CommBuys terminology, basic navigation, and provide guidance for locating bid opportunities in CommBuys and submitting an online quote.

1. Bidders MUST have their complete bid fully loaded and submitted prior to the time and date listed in the calendar. COMMBUYS will not allow for bids to be submitted after the posted time.

Bidder may contact the CommBuys Help Desk at CommBuys@state.ma.us or call during normal business hours (8AM – 5PM, Monday – Friday) at 1-888-627-8283 or 617-720-3197.

Written questions via the Bid Q&A on COMMBUYS

The “Bid Q&A” provides the opportunity for Bidders to ask written questions and receive written answers from the Strategic Sourcing Team (SST) regarding this Bid. All Bidders’ questions must be submitted through the Bid Q&A found on COMMBUYS (see below for instructions). Questions may be asked only prior to the Deadline for Submission of Questions stated in the Procurement Calendar. The issuing department reserves the right not to respond to questions submitted after this date. It is the Bidder’s responsibility to verify receipt of questions.

Please note that any questions submitted to the SST using any other medium (including those that are sent by mail, fax, email or voicemail, etc.) will not be answered. To reduce the number of redundant or duplicate questions, Bidders are asked to review all questions previously submitted to determine whether the Bidder’s question has already been posted.

Bidders are responsible for entering content suitable for public viewing, since all of the questions are accessible to the public. Bidders must not include any information that could be considered personal, security sensitive, inflammatory, incorrect, collusory, or otherwise objectionable, including information about the Bidder’s company or other companies. The PMT reserves the right to edit or delete any submitted questions that raise any of these issues or that are not in the best interest of the Commonwealth or this Bid.

All answers are final when posted. Any subsequent revisions to previously provided answers will be dated.

It is the responsibility of the prospective Bidder and awarded Bidder to maintain an active registration in COMMBUYS and to keep current the email address of the Bidder’s contact person and prospective contract manager, if awarded a contract, and to monitor that email inbox for communications from the Purchasing Department, including requests for clarification. The Purchasing Department and the Commonwealth assume no responsibility if a prospective Bidder’s/awarded Bidder’s designated email address is not current, or if technical problems, including those with the prospective Bidder’s/awarded Bidder’s computer, network or internet service provider (ISP) cause email communications sent to/from the prospective Bidder/Awarded Bidder and the Purchasing Department to be lost or rejected by any means including email or spam filtering.

Locating Bid Q&A

Log into COMMBUYS, locate the Bid, acknowledge receipt of the Bid, and scroll down to the bottom of the Bid Header page. The “Bid Q&A” button allows Bidders access to the Bid Q&A page.

FORM 1 – RFQ RESPONSE FORM

Bidders should avoid including additional components in their responses which are not expressly requested in the RFQ. If multiple options are available and responsive to the RFQ, Bidders must clearly identify the differences in cost and functionality of each option.

1. Statement of Interest and Contact Information

Company or Organization Name:

_______________________________________________ (“Bidder”)

Bidder Address:

Bidder Contact(s):

References

X If marked, Bidder must describe three references to the Agency illustrating examples in which Bidder has provided similar hardware, software, maintenance, and services to organizations of comparable size to the Agency within the last five to ten years, if applicable. Bidder must provide the name and contact information for an individual employed by the customer. Bidders are encouraged to provide references of government organizations within the Commonwealth. Bidder agrees that the Agency or its agents may contact any individual(s) named as references hereunder. References must be submitted in the format specified on the OSD business reference form, which is available at https://www.mass.gov/files/documents/2016/08/wd/business-reference-form_0.doc?_ga=2.37941354.891907013.1563542725-372871650.1562964984.

Data Classification

Bidder must describe its information security practices and policies with respect to the Data Types identified in Section V (Data Classification) of the RFQ. Additional documentation may be attached to this Response form.

Business and Technical Response

Bidders’ response should include, at a minimum, the following:

A response to each Section (I – VIII) of the RFQ in which Bidder identifies the means by which it shall comply with the terms in each Section. For section II, please provide evidence of bidder qualifications and previous experience with:

1. Health assessments:

· Statement on experience conducting Project Health Assessments, or similar assessments of IT projects within the past five (5) to seven (7) years; cross-industry knowledge or experience as well as Commonwealth-specific knowledge or experience;

· documented project staff capabilities, certifications, and related experience, based on information provided as part of the RFQ, including resumes of all key personnel

· Describe in detail its methodology and approach that it will utilize when providing the services described in this RFQ. This should set forth the process and tasks by which the Bidder has delivered services substantially similar to those described in this RFQ to other clients.

· The Bidder must provide sample Project Health Assessment reports from similar projects completed by the Bidder that demonstrate its Methodology and Approach to conducting project health assessments. The sample reports should include at least one each of the following. Please provide:

a. a sample Project Plan from another engagement;

b. a sample risk analysis report; and

c. a ranked order listing of perceived concerns.

2. Project Management, Consulting Services

· Statement on experience providing project management and/or consulting services on IT projects within the past five (5) to seven (7) years; cross-industry knowledge or experience as well as Commonwealth-specific knowledge or experience;

· documented project staff capabilities, certifications, and related experience, based on information provided as part of the RFQ, including resumes of all key personnel

· Describe in detail its methodology and approach that it will utilize when providing the services described in this RFQ. This should set forth the process and tasks by which the Bidder has delivered services substantially similar to those described in this RFQ to other clients.

· The Bidder must provide sample Project Management and Consulting Services reports from similar projects completed by the Bidder.

3. Application Development services

· Statement on experience conducting Application Development or similar services for IT projects within the past five (5) to seven (7) years; cross-industry knowledge or experience as well as Commonwealth-specific knowledge or experience;

· documented project staff capabilities, certifications, and related experience, based on information provided as part of the RFQ, including resumes of all key personnel

· Describe in detail its areas of expertise (e.g., common enterprise platforms, products, applications, infrastructure) including specific certifications (e.g., vendor partnership levels) as well as methodology and approach that it will utilize when providing the services described in this RFQ. This should set forth the process and tasks by which the Bidder has delivered services substantially similar to those described in this RFQ to other clients.

· The Bidder must provide evidence of application development experience, including but not limited to:

a. case studies, references, architecture diagrams, technical design documents, UI/UX samples, and examples of successfully delivered government or enterprise applications.

b. Demonstrate development maturity and operational capabilities, including Agile delivery practices, secure coding standards, testing and QA artifacts, DevSecOps/CI/CD processes, accessibility compliance, security documentation, and support/maintenance procedures.

4. IV&V Services

· Statement on experience providing IV&V services within the past five (5) to seven (7) years; cross-industry knowledge or experience as well as Commonwealth-specific knowledge or experience;

· Describe in detail its methodology…