RFQ_for_RHP_Subject_Matter_Expert_final.pdf

STATE OF MARYLAND

DEPARTMENT OF THE ENVIRONMENT (MDE)

AIR AND RADIATION ADMINISTRATION

REQUEST FOR QUOTE

RADIOACTIVE MATERIAL LICENSING SUBJECT MATTER

EXPERT

U00R5600190 eMMA# BPM050628

ISSUE DATE: APRIL 21, 2025

NOTICE

A Prospective Bidder that has received this document from a source other than eMarylandMarketplace

(eMMA) https://procurement.maryland.gov should register on eMMA. See Section 4.2.

MINORITY BUSINESS ENTERPRISES ARE ENCOURAGED TO RESPOND

TO THIS SOLICITATION.

Solicitation#: U00P5600190 Request for Quote

Department of the Environment Page ii of 33

NO BID NOTICE/VENDOR FEEDBACK FORM

To help us improve the quality of State solicitations, and to make our procurement process more responsive and business friendly, please provide comments and suggestions regarding this solicitation.

Please return your comments with your response. If you have chosen not to respond to this solicitation, please email or fax this completed form to the attention of the Procurement Officer (see Key Information Summary Sheet below for contact information).

Title: Radioactive Materials Licensing Subject Matter Expert Solicitation Number eMMA Number BPM050628

1. If you have chosen not to respond to this solicitation, please indicate the reason(s) below:

� Other commitments preclude our participation at this time

� The subject of the solicitation is not something we ordinarily provide

� We are inexperienced in the work/commodities required

� Specifications are unclear, too restrictive, etc. (Explain in REMARKS section)

� The scope of work is beyond our present capacity

� Doing business with the State is simply too complicated. (Explain in REMARKS section)

� We cannot be competitive. (Explain in REMARKS section)

� Time allotted for completion of the Bid is insufficient

� Start-up time is insufficient

� Bonding/Insurance requirements are restrictive (Explain in REMARKS section)

� Bid requirements (other than specifications) are unreasonable or too risky (Explain in REMARKS section)

� MBE or VSBE requirements (Explain in REMARKS section)

� Prior State of Maryland contract experience was unprofitable or otherwise unsatisfactory.

(Explain in REMARKS section)

� Payment schedule too slow

� Other: __________________________________________________________________

2. If you have submitted a response to this solicitation, but wish to offer suggestions or express concerns, please use the REMARKS section below. (Attach additional pages as needed.)

REMARKS:

Vendor Name: ________________________________ Date: _______________________

Contact Person: _________________________________ Phone (____) _____ - _________________

Address: ______________________________________________________________________

E-mail Address: ________________________________________________________________

Department of the Environment Page iii of 33

STATE OF MARYLAND

DEPARTMENT OF THE ENVIROMENT (MDE)

KEY INFORMATION SUMMARY SHEET

Request for Quote Service Solicitation Number: U00R5600190/BPM050628 RFQ Issue Date: April 21, 2025 RFQ Issuing Office: MDE Air and Radiation Administration Procurement Officer: June Dwyer

Department of the Environment 1800 Washington Boulevard Baltimore, Maryland 21230 e-mail:

Office Phone:

June.dwyer1@maryland.gov 410.537.4014

Bids are to be sent to:

All Bid Must be submitted in eMMA. Submissions not sent through eMMA will not be Accepted:

https://emma.maryland.gov

Submit Bids by uploading to eMMA before Bid due date and time.

If you have difficulty submitting your proposal in eMMA, please contact the Help Desk at eMMA.helpdesk@maryland.gov

Questions Due Date and Time April 28, 2025 5:00 pm Bid Due (Closing) Date and Time:

May 6, 2025 2:00 pm EST Bidders are reminded that a completed Feedback Form is requested if a no-bid decision is made (see page ii).

Contract Type: Indefinite Quantity, Fixed Rate Contract Duration: May 15, 2025 – June 30, 2026 Federal Funding: N/A https://emma.maryland.gov/ mailto:eMMA.helpdesk@maryland.gov

Department of the Environment Page 1 of 33

1 Minimum Qualifications

1.1 Bidder Minimum Qualifications

As part of the determination to be considered responsive, the Bidder must document in its Bid that it satisfies the following Minimum Qualifications:

1.1.1 The Bidder shall have three (3) years of experience in radioactive materials licensing and be a qualified license reviewer for all modalities.

Required Documentation: As proof of meeting this requirement, the Bidder shall provide with its Bid documentation supporting the number of years working in radioactive materials, the training records for training taken, and/or a qualification journal that demonstrates full qualification to review radioactive materials licenses.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

Department of the Environment Page 2 of 33

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.1.1 The Department of the Environment, Air and Radiation Administration is releasing this Request

For Quote (RFQ) in order to procure the services defined in this RFQ from a contract between the successful bidder(s) and the Department of the Environment (MDE).

2.1.2 It is the State’s intention to obtain goods and services, as specified in this RFQ, from a Contract between the selected Bidder and the State.

2.1.3 The MDE intends to make a single award for the work under this RFQ. See RFQ Section 4.8 Award Basis for more Contract award information.

2.1.4 A Bidder, either directly or through its subcontractor(s), must be able to provide all goods and services and meet all the requirements requested in this solicitation and the successful Bidder (the Contractor) shall remain responsible for Contract performance regardless of subcontractor participation in the work.

2.2 Background and Purpose

The Radiological Health Program (RHP) is mandated by Title 8: "Radiation" of the Annotated Code of Maryland, Environment Article, to control the uses of radiation and to protect public health and safety and the environment from inadvertent and unnecessary radiation exposure. This is accomplished through registration and certification of radiation (x-ray) machines, licensing of radioactive materials, inspections, and enforcement actions, where required, to ensure regulatory compliance.

The RHP regulates the use of both radiation machines and radioactive materials. Radiation machines are used by dentists and veterinarians, and in hospitals, mammography facilities, and other medical, academic and industrial facilities. Radioactive materials are used primarily by radiologists in hospital nuclear medicine units, but also by other qualified physicians and radiographers and qualified radioisotope users in the manufacturing and construction industries, academia and other authorized locations. There are more than 5,100 radiation machine facilities housing 15,000 x-ray tubes, and nearly 550 radioactive material licensees in Maryland. Additionally, more than 150 Out of State radioactive materials users (on average) may work in Maryland for limited periods of time under reciprocal recognition of their Agreement State or NRC license after applying for and receiving approval from the RHP.

Additionally, RHP staff health physicists assume the responsibility of Radiation Accident Assessment coordination, analysis, communication, and field team surveyors in response to any actual or staged emergencies at either the Calvert Cliffs Nuclear Power Plant (Maryland) or Peach Bottom Atomic Power Station (Pennsylvania). Designated radiation staff health physicists also respond to any industrial, medical or transportation radiation accident or serious incidents involving radiation.

The RHP is charged with ensuring that the public as well as radiation workers are protected from unnecessary levels of radiation. The general public and the environment are at risk if the users and handlers of radioactive materials and radiation producing electronic devices fail to recognize potential radiation hazards or follow proper radiation safety practices and procedures.

To prevent unnecessary exposures to radiation, the RHP inspects x-ray machines at dental and veterinary facilities every three years to determine whether the machines are performing according to rigid specifications and whether the machine operators are following proper safety procedures. The RHP also certifies the performance of medical, industrial and academic electronic radiation machines following inspection by State-licensed inspectors, and performs inspections of State mammography facilities under contract with the federal Food and Drug Administration. Facilities that use radioactive materials are issued licenses and are inspected on set schedules by the RHP to determine whether the facility is using

Department of the Environment Page 3 of 33 proper safety procedures. Inspections are also performed on selected out of state radioactive materials users operating under reciprocity.

The purpose of the RFQ is to award a Contract to a qualified subject matter expert who can conduct quality assurance reviews of radioactive material license applications for all NRC source categories, sealed source and device approval requests, and financial assurance documents (applicable to certain radioactive materials licenses). The review by the expert is to determine any deficiencies in the documents with respect to meeting applicable regulatory requirements. After any deficiencies are resolved, the expert will be required to develop a draft license or approval document for eventual issuance.

2.2.1 Other State Responsibilities

a) The State is responsible for providing the required information, data, documentation, and test data to facilitate the Contractor’s performance of the work and will provide such additional assistance and services as is specifically set forth.

b) The State will provide equipment to perform the tasks in this RFQ.

2.3 Responsibilities and Tasks

Information about the Radiological Health Program is available at:

https://mde.maryland.gov/programs/air/RadiologicalHealth/Pages/index.aspx

2.3.1 Review radioactive materials license applications submitted to the Department.

2.3.2 Compare license application information submitted with applicable regulatory requirements.

2.3.3 Review all NRC source categories, sealed source and device approval requests and financial assurance documents (required for radioactive materials licenses).

2.3.4 Notify Program staff of deficiencies in the application submitted. (Contact to notify shall be provided by the Department.)

2.3.5 Upon resolution of deficiencies in the application, develop a draft license or approval document that will be issued by the Department.

2.3.6 Information regarding RHP Licensing Guidelines is available at:

https://mde.maryland.gov/programs/air/RadiologicalHealth/Pages/LicensingGuidelines.aspx

2.3.7 Additional links are available:

2.3.7.1 Radiation Control Advisory Board

https://mde.maryland.gov/programs/air/RadiologicalHealth/Pages/RadiationBoard.aspx

2.3.7.2 United States Nuclear Regulatory Commission (U.S.NRC) Biological Effects of Radiation https://www.nrc.gov/reading-rm/doc-collections/fact-sheets/bio-effects-radiation.html

2.3.7.3 USNRC Basic References https://www.nrc.gov/reading-rm/basic-ref.html

2.3.8 This function may be performed remotely and is approximately ten (10) hours per week. The Contract term will be for one year or upon termination of the need for the service, whichever arrives first.

2.3.9 Compensation for the awarded Contractor shall be the amount on the bid submission form to include all costs to perform the service for the Department.

https://mde.maryland.gov/programs/air/RadiologicalHealth/Pages/index.aspx https://mde.maryland.gov/programs/air/RadiologicalHealth/Pages/LicensingGuidelines.aspx https://mde.maryland.gov/programs/air/RadiologicalHealth/Pages/RadiationBoard.aspx https://www.nrc.gov/reading-rm/doc-collections/fact-sheets/bio-effects-radiation.html https://www.nrc.gov/reading-rm/basic-ref.html

Department of the Environment Page 4 of 33

Contractor Requirements: General

2.4 Contract Initiation Requirements

The awarded Contractor shall meet with the Program Manager prior to beginning any work. This meeting may be virtual or if required, in person.

2.5 End of Contract Transition

2.5.1 Return and Maintenance of State Data

a) Upon termination or the expiration of the Contract Term, the Contractor shall: (a) return to the State all State data in either the form it was provided to the Contractor or in a mutually agreed format along with the schema necessary to read such data; (b) preserve, maintain, and protect all State data until the earlier of a direction by the State to delete such data or the expiration of 90 days (“the retention period”) from the date of termination or expiration of the Contract term; (c) after the retention period, the Contractor shall securely dispose of and permanently delete all State data in all of its forms, such as disk, CD/DVD, backup tape and paper such that it is not recoverable, according to National Institute of Standards and Technology (NIST)-approved methods with certificates of destruction to be provided to the State; and (d) prepare an accurate accounting from which the State may reconcile all outstanding accounts. The final monthly invoice for the services provided hereunder shall include all charges for the 90-day data retention period.

b) During any period of service suspension, the Contractor shall maintain all State data in its then existing form, unless otherwise directed in writing by the Contract Monitor.

c) In addition to the foregoing, the State shall be entitled to any post-termination/expiration assistance generally made available by Contractor with respect to the services.

2.6 Invoicing

2.6.1 General

a) The Contractor shall e-mail each invoice and signed authorization to the mde.ap@maryland.gov with a copy to the Contract Monitor listed in the RFQ.

All invoices for services shall be verified by the Contractor as accurate at the time of submission.

An invoice not satisfying the requirements of a Proper Invoice (as defined in COMAR 21.06.09) cannot be processed for payment. To be considered a Proper Invoice, invoices must include the following information, without error:

1) Contractor name and address;

2) Remittance address;

3) Federal taxpayer identification (FEIN) number, social security number, as appropriate;

4) Invoice period (i.e. time period during which services covered by invoice were performed);

5) Invoice date;

6) Invoice number;

7) State assigned Contract number;

mailto:mde.ap@maryland.gov

Department of the Environment Page 5 of 33

8) State assigned (Blanket) Purchase Order number(s);

9) Goods or services provided;

10) Amount due; and

11) Any additional documentation required by regulation or the Contract.

The MDE reserves the right to reduce or withhold Contract payment in the event the Contractor does not provide the MDE with all required deliverables within the time frame specified in the Contract or otherwise breaches the terms and conditions of the Contract until such time as the Contractor brings itself into full compliance with the Contract.

Any action on the part of the MDE, or dispute of action by the Contractor, shall be in accordance with the provisions of Md. Code Ann., State Finance and Procurement Article §§ 15-215 through 15-223 and with

COMAR 21.10.04.

The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of Columbia sales taxes and transportation taxes. The Contractor, however, is not exempt from such sales and use taxes and may be liable for the same.

Invoices for final payment shall be clearly marked as “FINAL” and submitted when all work requirements have been completed and no further charges are to be incurred under the Contract. In no event shall any invoice be submitted later than 60 calendar days from the Contract termination date.

2.6.2 Invoice Submission Schedule

The Contractor shall submit invoices in accordance with the following schedule:

a) Invoices shall be submitted monthly, no later than the first week of the following month.

2.6.3 For the purposes of the Contract an amount will not be deemed due and payable if:

a) The amount invoiced is inconsistent with the Contract;

b) The proper invoice has not been received by the party or office specified in the Contract;

c) The invoice or performance is in dispute or the Contractor has failed to otherwise comply with the provisions of the Contract;

d) The item or services have not been accepted;

e) The quantity of items delivered is less than the quantity ordered;

f) The items or services do not meet the quality requirements of the Contract;

g) If the Contract provides for progress payments, the proper invoice for the progress payment has not been submitted pursuant to the schedule;

h) If the Contract provides for withholding a retainage and the invoice is for the retainage, all stipulated conditions for release of the retainage have not been met; or

i) The Contractor has not submitted satisfactory documentation or other evidence reasonably required by the Procurement Officer or by the Contract concerning performance under the Contract and compliance with its provisions.

2.6.4 Travel Reimbursement

Travel will not be reimbursed on this Contract.

Department of the Environment Page 6 of 33

2.7 Data Ownership and Access

a) Data, databases and derived data products created, collected, manipulated, or directly purchased as part of the RFQ and resulting Contract are the property of the State. The purchasing State agency is considered the custodian of the data and shall determine the use, access, distribution and other conditions based on appropriate State statutes and regulations.

Public jurisdiction user accounts and public jurisdiction data shall not be accessed, except (1) in the course of data center operations, (2) in response to service or technical issues, (3) as required by the express terms of the Contract, including as necessary to perform the services hereunder or (4) at the State’s written request.

The Contractor shall limit access to and possession of State data to only Contractor Personnel whose responsibilities reasonably require such access or possession and shall train such Contractor Personnel on the confidentiality obligations set forth herein.

At no time shall any data or processes – that either belong to or are intended for the use of the State or its officers, agents or employees – be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the State.

The Contractor shall not use any information collected in connection with the services furnished under the Contract for any purpose other than fulfilling such services.

2.7.1 Provisions in Section 3.4.1 shall survive expiration or termination of the Contract. Additionally, the Contractor shall flow down the provisions of Section 3.4.1 (or the substance thereof) in all subcontracts.

2.8 Insurance Requirements

The Contractor shall maintain, at a minimum, the insurance coverages outlined below, or any minimum requirements established by law if higher, for the duration of the Contract, including option periods, if exercised:

2.8.1 The following type(s) of insurance and minimum amount(s) of coverage are required:

a) Commercial General Liability - of $500,000 combined single limit per occurrence for bodily injury, property damage, and personal and advertising injury and $1,000,000 annual aggregate.

The minimum limits required herein may be satisfied through any combination of primary and umbrella/excess liability policies.

b) Worker’s Compensation - The Contractor shall maintain such insurance as necessary or as required under Workers’ Compensation Acts, the Longshore and Harbor Workers’ Compensation Act, and the Federal Employers’ Liability Act, to not be less than. one million dollars ($1,000,000) per occurrence (unless a state’s law requires a greater amount of coverage).

Coverage must be valid in all states where work is performed.

2.8.2 The State shall be listed as an additional insured on the faces of the certificates associated with the coverages listed above, including umbrella policies, excluding Workers’ Compensation Insurance and professional liability.

2.8.3 All insurance policies shall be endorsed to include a clause requiring the insurance carrier provide the Procurement Officer, by certified mail, not less than 30 days’ advance notice of any non-renewal, cancellation, or expiration. The Contractor shall notify the Procurement Officer in writing, if policies are cancelled or not renewed within five (5) days of learning of such cancellation or nonrenewal. The Contractor shall provide evidence of replacement insurance coverage to the Procurement Officer at least 15 days prior to the expiration of the insurance policy then in effect.

Department of the Environment Page 7 of 33

2.8.4 Any insurance furnished as a condition of the Contract shall be issued by a company authorized to do business in the State.

2.8.5 The recommended awardee must provide current certificate(s) of insurance with the prescribed coverages, limits and requirements set forth in this section within five (5) Business Days from notice of recommended award. During the period of performance for multi-year contracts, the Contractor shall provide certificates of insurance annually, or as otherwise directed by the Contract Monitor.

2.8.6 The Contractor shall require any subcontractors to obtain and maintain comparable levels of coverage and shall provide the Contract Monitor with the same documentation as is required of the Contractor.

The following requirements are applicable to the Contract:

2.8.7 Information Technology

(a) Contractors shall comply with and adhere to the State IT Security Policy and Standards.

These policies may be revised from time to time and the Contractor shall comply with all such revisions. Updated and revised versions of the State IT Policy and Standards are available online at: www.doit.maryland.gov – keyword: Security Policy.

(b) The Contractor shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State. The Contractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the State to connect Contractor-owned equipment to a State LAN/WAN.

The Contractor shall:

1) Implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security such as those listed below (see Section 3.5.8 (10));

2) Ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of the Contract; and

3) The Contractor, and Contractor Personnel, shall (i) abide by all applicable federal, State and local laws, rules and regulations concerning security of Information Systems and Information Technology and (ii) comply with and adhere to the State IT Security Policy and Standards as each may be amended or revised from time to time. Updated and revised versions of the State IT Policy and Standards are available online at:

www.doit.maryland.gov keyword: Security Policy.

2.8.8 Data Protection and Controls

A. Contractor shall ensure a secure environment for all State data and any hardware and software (including but not limited to servers, network and data components) provided or used in connection with the performance of the Contract and shall apply or cause application of appropriate controls so as to maintain such a secure environment (“Security Best Practices”).

Such Security Best Practices shall comply with an accepted industry standard, such as the NIST cybersecurity framework.

1) Ensure that State data is not co-mingled with non-State data through the proper application of compartmentalization Security Measures.

http://www.doit.maryland.gov/ http://www.doit.maryland.gov/

Department of the Environment Page 8 of 33

2) Apply data encryption to protect Sensitive Data at all times, including in transit, at rest, and also when archived for backup purposes. Unless otherwise directed, the Contractor is responsible for the encryption of all Sensitive Data.

3) For all State data the Contractor manages or controls, data encryption shall be applied to such data in transit over untrusted networks.

4) Encryption algorithms which are utilized for encrypting data shall comply with current Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules”, FIPS PUB 140-2:

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm

5) Ensure system and network environments are separated by properly configured and updated firewalls.

6) Restrict network connections between trusted and untrusted networks by physically or logically isolating systems from unsolicited and unauthenticated network traffic.

7) By default “deny all” and only allow access by exception.

8) Review, at least annually, the aforementioned network connections, documenting and confirming the business justification for the use of all service, protocols, and ports allowed, including the rationale or compensating controls implemented for those protocols considered insecure but necessary.

9) Perform regular vulnerability testing of operating system, application, and network devices. Such testing is expected to identify outdated software versions; missing software patches; device or software misconfigurations; and to validate compliance with or deviations from the security policies applicable to the Contract. Contractor shall evaluate all identified vulnerabilities for potential adverse effect on security and integrity and remediate the vulnerability no later than 30 days following the earlier of vulnerability’s identification or public disclosure, or document why remediation action is unnecessary or unsuitable. The MDE shall have the right to inspect the Contractor’s policies and procedures and the results of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

10) Enforce strong user authentication and password control measures to minimize the opportunity for unauthorized access through compromise of the user access controls. At a minimum, the implemented measures should be consistent with the most current Maryland Department of Information Technology’s Information Security Policy (https://doit.maryland.gov/policies/Pages/default.aspx), including specific requirements for password length, complexity, history, and account lockout.

11) Ensure State data is not processed, transferred, or stored outside of the United States (“U.S.”). The Contractor shall provide its services to the State and the State’s end users solely from data centers in the U.S. Unless granted an exception in writing by the State, the Contractor shall not allow Contractor Personnel to store State data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The Contractor shall permit its Contractor Personnel to access State data remotely only as required to provide technical support.

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm https://doit.maryland.gov/policies/Pages/default.aspx

Department of the Environment Page 9 of 33

12) Ensure Contractor’s Personnel shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State, which may be revoked at any time for any reason. The Contractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the State to connect Contractor -owned equipment to a State LAN/WAN.

13) Ensure that anti-virus and anti-malware software is installed and maintained on all systems supporting the services provided under the Contract; that the anti-virus and anti-malware software is automatically updated; and that the software is configured to actively scan and detect threats to the system for remediation. The Contractor shall perform routine vulnerability scans and take corrective actions for any findings.

14) Conduct regular external vulnerability testing designed to examine the service provider’s security profile from the Internet without benefit of access to internal systems and networks behind the external security perimeter. Evaluate all identified vulnerabilities on Internet-facing devices for potential adverse effect on the service’s security and integrity and remediate the vulnerability promptly or document why remediation action is unnecessary or unsuitable. The MDE shall have the right to inspect these policies and procedures and the performance of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

2.8.9 Security Logs and Reports Access

a) For a SaaS or non-State hosted solution, the Contractor shall provide reports to the State in a mutually agreeable format.

b) Reports shall include latency statistics, user access, user access IP address, user access history and security logs for all State files related to the Contract.

2.8.10 Security Plan

a) The Contractor shall protect State data according to a written security policy (“Security Plan”) no less rigorous than that of the State, and shall supply a copy of such policy to the State for validation, with any appropriate updates, on an annual basis.

The Security Plan shall detail the steps and processes employed by the Contractor as well as the features and characteristics which will ensure compliance with the security requirements of the Contract.

3.5.11 Security Incident Response

A. The Contractor shall notify the MDE when any Contractor system that may access, process, or store State data or State systems experiences a Security Incident or a Data Breach as follows:

1) notify the MDE within twenty-four (24) hours of the discovery of a Security Incident by providing notice via written or electronic correspondence to the Contract Monitor, MDE chief information officer and MDE chief information security officer;

2) notify the MDE within two (2) hours if there is a threat to Contractor’s solution as it pertains to the use, disclosure, and security of State data; and

3) provide written notice to the MDE within one (1) Business Day after Contractor’s discovery of unauthorized use or disclosure of State data and thereafter all information the State (or MDE) requests concerning such unauthorized use or disclosure.

Department of the Environment Page 10 of 33

B. Contractor’s notice shall identify:

1) the nature of the unauthorized use or disclosure;

2) the State data used or disclosed,

3) who made the unauthorized use or received the unauthorized disclosure;

4) what the Contractor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure; and

5) what corrective action the Contractor has taken or shall take to prevent future similar unauthorized use or disclosure.

6) The Contractor shall provide such other information, including a written report, as reasonably requested by the State.

C. The Contractor may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the Contract. Discussing Security Incidents with the State should be handled on an urgent as-needed basis, as part of Contractor communication and mitigation processes as mutually agreed upon, defined by law or contained in the Contract.

D. The Contractor shall comply with all applicable laws that require the notification of individuals in the event of unauthorized release of State data or other event requiring notification, and, where notification is required, assume responsibility for informing all such individuals in accordance with applicable law and to indemnify and hold harmless the State (or MDE) and its officials and employees from and against any claims, damages, and actions related to the event requiring notification.

3.5.12 Data Breach Responsibilities

A. If the Contractor reasonably believes or has actual knowledge of a Data Breach, the Contractor shall, unless otherwise directed:

1) Notify the appropriate State-identified contact within 24 hours by telephone in accordance with the agreed upon security plan or security procedures unless a shorter time is required by applicable law;

2) Cooperate with the State to investigate and resolve the data breach;

3) Promptly implement commercially reasonable remedial measures to remedy the Data Breach; and

4) Document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services.

B. If a Data Breach is a direct result of the Contractor’s breach of its Contract obligation to encrypt State data or otherwise prevent its release, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by State law; (3) a credit monitoring service required by State or federal law; (4) a website or a toll-free number and call center for affected individuals required by State law; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause; all [(1) through (5)] subject to the Contract’s limitation of liability.

Department of the Environment Page 11 of 33

2.8.11 The State shall, at its discretion, have the right to review and assess the Contractor’s compliance to the security requirements and standards defined in the Contract.

2.8.12 Provisions in Sections 3.5.1 – 3.5.10 shall survive expiration or termination of the Contract.

Additionally, the Contractor shall flow down the provisions of Sections 3.5.4-3.5.10 (or the substance thereof) in all subcontracts.

Department of the Environment Page 12 of 33

3 Procurement Instructions

3.1 eMaryland Marketplace Advantage (eMMA)

3.1.1 eMMA is the electronic commerce system for the State of Maryland. The RFQ, Conference summary and attendance sheet, Bidders’ questions and the Procurement Officer’s responses, addenda, and other solicitation-related information will be made available via eMMA.

3.1.2 In order to receive a contract award, a vendor must be registered on eMMA. Registration is free.

Go to emma.maryland.gov, click on “New Vendor? Register Now” to begin the process, and then follow the prompts.

3.2 Questions

3.2.1 All questions, including concerns regarding any applicable MBE or VSBE participation goals, shall identify in the subject line the RFQ # MDE 25RHP, and shall be submitted in writing via e-mail to the Procurement Officer at least five (5) days prior to the Bid due date. The Procurement Officer, based on the availability of time to research and communicate an answer, shall decide whether an answer can be given before the Bid due date.

3.2.2 Answers to all questions that are not clearly specific only to the requestor will be distributed via the same mechanism as for RFQ amendments and posted on eMMA.

3.2.3 The statements and interpretations contained in responses to any questions, whether responded to verbally or in writing, are not binding on the MDE unless it issues an amendment in writing.

3.3 Procurement Method

A Contract will be awarded in accordance with the Competitive Sealed Bidding method under COMAR 21.05.02.

3.4 Bid Due (Closing) Date and Time

3.4.1 Bids, in the number and form set forth in Section 5 Bid Format, must be received by the

Procurement Officer no later than the Bid due date and time indicated on the Key Information Summary Sheet in order to be considered.

3.4.2 Requests for an extension of this date or time shall not be granted.

3.4.3 Bidders submitting Bids should allow sufficient delivery time to ensure timely receipt by the Procurement Officer. Except as provided in COMAR 21.05.02.10, Bids received after the due date and time listed in the Key Information Summary Sheet will not be considered.

3.4.4 The date and time of an e-mail submission is determined by the date and time of arrival in the e-mail address indicated on the Key Information Summary Sheet.

3.4.5 Bids may be modified or withdrawn by written notice received by the Procurement Officer before the time and date set forth in the Key Information Summary Sheet for receipt of Bids.

3.4.6 Potential Bidders not responding to this solicitation are requested to submit the “No Bid Notice/Vendor Feedback” form, which includes company information and the reason for not responding (e.g., too busy, cannot meet mandatory requirements).

3.5 Multiple or Alternate Bids

Multiple or alternate Bids will not be accepted.

https://emma.maryland.gov/page.aspx/en/usr/login?ReturnUrl=%2fpage.aspx%2fen%2fbuy%2fhomepage

Department of the Environment Page 13 of 33

3.6 Receipt, Opening and Recording of Bids

3.6.1.1 Upon receipt, each Bid and any timely modification(s) to a Bid shall be stored in a secure place until the time and date set for bid opening. Before Bid opening, the State may not disclose the identity of any Bidder.

3.7 Confidentiality of Bids / Public Information Act Notice

3.7.1 The Bidder should give specific attention to the clear identification of those portions of its Bid that it considers confidential and/or proprietary commercial information or trade secrets, and provide justification why such materials, upon request, should not be disclosed by the State under the Public Information Act, Md. Code Ann., General Provisions Article, Title 4. This information should be identified by page number and placed in the Transmittal Letter with the Bid.

3.7.2 The Bids shall be tabulated, or a Bid abstract made. The opened Bids shall be available for public inspection at a reasonable time after Bid opening, but in any case before contract award, except to the extent the Bidder designates trade secrets or other proprietary data to be confidential as set forth in this solicitation. Material so designated as confidential shall accompany the Bid and shall be readily separable from the Bid in order to facilitate public inspection of the non-confidential portion of the Bid, including the Total Bid Price.

3.7.3 For requests for information made under the PIA, the Procurement Officer shall examine the Bids to determine the validity of any requests for nondisclosure of trade secrets and other proprietary data identified in writing. Nondisclosure is permissible only if approved by the Office of the Attorney General.

3.8 Award Basis

3.8.1 A Contract shall be awarded to the responsible Bidder(s) submitting a responsive Bid with the most favorable bid price or most favorable evaluated bid price (as referenced in COMAR 21.05.02.13) for providing the goods and services as specified in this RFQ. Bidders must meet minimum qualifications to be considered for award. Partial or incomplete bids will be rejected unless otherwise stated in the solicitation. See RFQ Section 6 for Bid evaluation and award information.

3.8.2 Award of this contract will not be final and complete until after: (1) the Contractor submits complete and satisfactory documentation required under the Contract and/or documentation required by the Procurement Officer; and (2) the Contract is signed by the Department following any required approvals of the Contract, including approval by the Board of Public Works, if such approval is required.

Tie Bids will be decided pursuant to COMAR 21.05.02.14.

3.9 Duration of Bids

Bids submitted in response to this RFQ are irrevocable for the latest of the following: 120 days following the Bid due date and time or the date any protest concerning this RFQ is finally resolved.

This period may be extended at the Procurement Officer’s request only with the Bidder’s written agreement.

3.10 Revisions to the RFQ

3.10.1 If the RFQ is revised before the due date for Bids, the MDE shall post any addenda to the RFQ on eMMA and shall endeavor to provide such addenda to all prospective Bidders that were sent this

Department of the Environment Page 14 of 33 solicitation or are otherwise known by the Procurement Officer to have obtained this RFQ. It remains the responsibility of all prospective Bidders to check eMMA for any addenda issued prior to the submission of Bids.

3.10.2 Bidders shall acknowledge the receipt of all addenda to this RFQ issued before the Bid due date.

3.10.3 Failure to acknowledge receipt of an addendum does not relieve the Bidder from complying with the terms, additions, deletions, or corrections set forth in the addendum, and may cause the Bid to be deemed not responsive.

3.11 Cancellations

3.11.1 The State reserves the right to cancel this RFQ, accept or reject any and all Bids, in whole or in part, received in response to this solicitation and to waive or permit the cure of minor irregularities.

3.11.2 In the event a government entity proposes and receives the recommendation for award, the procurement may be cancelled, and the award processed in accordance with COMAR 21.01.03.01.A(4).

3.11.3 If the services that are the subject of the RFQ are currently being provided under an interagency agreement with a public institution of higher education and the State determines that the services can be provided more cost effectively by the public institution of higher education, then the RFQ may be cancelled in accordance with Md. Code Ann., State Finance and Procurement Art., § 3- 207(b)(2).

3.12 Incurred Expenses

The State will not be responsible for any costs incurred by any Bidder in preparing and submitting a Bid or performing any other activities related to submitting a Bid in response to this solicitation.

3.13 Protest/Disputes

Any protest or dispute related to this solicitation or the Contract award shall be subject to the provisions of COMAR 21.10 (Administrative and Civil Remedies).

3.14 Bidder Responsibilities

3.14.1 Bidders must be able to provide all goods and services and meet all of the requirements requested in this solicitation and the successful Bidder shall be responsible for Contract performance including any subcontractor participation.

3.14.2 If the Bidder is the subsidiary of another entity, all information submitted by the Bidder, including but not limited to references, financial reports, or experience and documentation (e.g.

insurance policies, bonds, letters of credit) used to meet minimum qualifications, if any, shall pertain exclusively to the Bidder, unless the parent organization will guarantee the performance of the subsidiary. If applicable, the Bidder’s Bid shall contain an explicit statement, signed by an authorized representative of the parent organization, stating that the parent organization will guarantee the performance of the subsidiary.

3.14.3 A parental guarantee of the performance of the Bidder under this Section will not automatically result in crediting the Bidder with the experience or qualifications of the parent under any evaluation criteria pertaining to the actual Bidder’s experience and qualifications. Instead, the Bidder’s responsibility will be assessed to the extent to which the State determines that the experience and qualifications of the parent are applicable to and shared with the Bidder, any

Department of the Environment Page 15 of 33 stated intent by the parent to be directly involved in the performance of the Contract, and the value of the parent’s participation as determined by the State.

3.15 Acceptance of Terms and Conditions

By submitting a Bid in response to this RFQ, the Bidder, if selected for award, shall be deemed to have accepted the terms and conditions of this RFQ and the sample Contract, attached hereto as Attachment M.

Any exceptions to this RFQ or the Contract must be raised prior to Bid submission. Changes to the solicitation, including the Bid Form or Contract, made by the Bidder may result in Bid rejection.

3.16 Bid/Proposal Affidavit

A Bid submitted by the Bidder must be accompanied by a completed Bid/Proposal Affidavit. A copy of this Affidavit is included as Attachment B of this RFQ.

3.17 Contract Affidavit

All Bidders are advised that if a Contract is awarded as a result of this solicitation, the successful Bidder will be required to complete a Contract Affidavit. A copy of this Affidavit is included for informational purposes as Attachment N of this RFQ. This Affidavit must be provided within five (5) Business Days of notification of apparent award. For purposes of completing Section “B” of this Affidavit (Certification of Registration or Qualification with the State Department of Assessments and Taxation), a business entity that is organized outside of the State of Maryland is considered a “foreign” business.

3.18 Compliance with Laws/Arrearages

By submitting a Bid in response to this RFQ, the Bidder, if selected for award, agrees that it will comply with all federal, State, and local laws applicable to its activities and obligations under the Contract.

By submitting a response to this solicitation, each Bidder represents that it is not in arrears in the payment of any obligations due and owing the State, including the payment of taxes and employee benefits, and shall not become so in arrears during the term of the Contract if selected for Contract award.

3.19 Verification of Registration and Tax Payment

Before a business entity can do business in the State, it must be registered with the State Department of Assessments and Taxation (SDAT). SDAT is located at State Office Building, Room 803, 301 West Preston Street, Baltimore, Maryland 21201. For registration information, visit https://www.egov.maryland.gov/businessexpress.

It is strongly recommended that any potential Bidder complete registration prior to the Bid due date and time. The Bidder’s failure to complete registration with SDAT may disqualify an otherwise successful Bidder from final consideration and recommendation for Contract award.

3.20 False Statements

Bidders are advised that Md. Code Ann., State Finance and Procurement Article, § 11-205.1 provides as follows:

3.20.1 In connection with a procurement contract a person may not willfully:

https://www.egov.maryland.gov/businessexpress

Department of the Environment Page 16 of 33

a) Falsify, conceal, or suppress a material fact by any scheme or device.

b) Make a false or fraudulent statement or representation of a material fact.

c) Use a false writing or document that contains a false or fraudulent statement or entry of a material fact.

3.20.2 A person may not aid or conspire with another person to commit an act under Section 4.20.1.

3.20.3 A person who violates any provision of this section is guilty of a felony and on conviction is subject to a fine not exceeding $20,000 or imprisonment not exceeding five (5) years or both.

3.21 Payments by Electronic Funds Transfer

By submitting a Bid in response to this solicitation, the Bidder, if selected for award:

3.21.1 Agrees to accept payments by electronic funds transfer (EFT) unless the State Comptroller’s Office grants an exemption. Payment by EFT is mandatory for contracts exceeding $200,000. The successful Bidder shall register using the COT/GAD X-10 Vendor Electronic Funds (EFT) Registration Request Form.

3.21.2 Any request for exemption must be submitted to the State Comptroller’s Office for approval at the address specified on the COT/GAD X-10 form, must include the business identification information as stated on the form, and must include the reason for the exemption. The COT/GAD X-10 form may be downloaded from the Comptroller’s website at: GAD X-10 Form

3.22 Prompt Payment Policy

This procurement and the Contract(s) to be awarded pursuant to this solicitation are subject to the Prompt Payment Policy Directive issued by the Governor’s Office of Small, Minority & Women Business Affairs (GOSBA) and dated August 1, 2008. Promulgated pursuant to Md. Code Ann., State Finance and Procurement Article, §§ 11-201, 13-205(a), and Title 14, Subtitle 3, and COMAR

21.01.01.03 and 21.11.03.01, the Directive seeks to ensure the prompt payment of all subcontractors on non-construction procurement contracts. The Contractor shall comply with the prompt payment requirements outlined in the Contract, Section 31 “Prompt Pay Requirements” (see Attachment M).

Additional information is available on GOSBA’s website at:https://gomdsmallbiz.maryland.gov/Documents/Resources/Prompt%20Payment%20Guide_09.2024_ Finalv2.pdf

Electronic Procurements Authorized

3.22.1 Under COMAR 21.03.05, unless otherwise prohibited by law, the MDE may conduct procurement transactions by electronic means, including the solicitation, proposing, award, execution, and administration of a contract, as provided in Md. Code Ann., Maryland Uniform Electronic Transactions Act, Commercial Law Article, Title 21.

3.22.2 Participation in the solicitation process on a procurement contract for which electronic means has been authorized shall constitute consent by the Bidder to conduct by electronic means all elements of the procurement of that Contract which are specifically authorized under the solicitation or Contract. In the case of electronic transactions authorized by this RFQ, electronic records and signatures by an authorized representative satisfy a requirement for written submission and signatures.

3.22.1 “Electronic means” refers to exchanges or communications using electronic, digital, magnetic, wireless, optical, electromagnetic, or other means of electronically conducting transactions.

Electronic means includes e-mail, internet-based communications, electronic funds transfer, https://www.marylandcomptroller.gov/content/dam/mdcomp/md/state-accounting/forms/GADX10Form.pdf https://gomdsmallbiz.maryland.gov/Documents/Resources/Prompt%20Payment%20Guide_09.2024_Finalv2.pdf…