RFQ_H150357_-_Veterans_Outreach.pdf

April 26, 2016

Request for Quote (RFQ) Veteran Outreach Campaign

You are invited to review and respond to this Request for Quote (RFQ) #H150357, Veteran Outreach Campaign, Veteran Service Division, CA Department of Veteran Affairs (CalVet). In submitting a quote, the bidder shall comply with the instructions found in this RFQ. Please read the enclosed document carefully. Neither e-mail submittals, nor fax transmittals will be accepted for this RFQ. Quotes shall be delivered no later than May 16, 2016 at 3:00 p.m. to the following address:

Attention: Tracy Barbosa Department of Veterans Affairs

IT Procurement and Administration 1227 O Street, Suite 620 Sacramento, CA 95814

(916) 651-9903 (Voice)

Tracy.Barbosa@CalVet.ca.gov

This address applies to both US Postal Service Deliveries and Hand Deliveries (UPS; Express Mail; or Federal Express).

Bidders are required to submit one (1) Original and two (2) copies of the Quote. The Original Quote shall be marked “ORIGINAL COPY.” All documents contained in the original Quote package shall have original signatures and shall be signed by a person who is authorized to bind the firm. All additional copies may contain photocopies of the original package. All cost copies shall be under sealed cover plainly marked “DO NOT OPEN "RFQ #H150357”. Quotes not received by the date and time specified above and in Key Action Dates will be rejected. The Quote envelopes/packages shall be plainly marked with the RFQ number and title, your firm name and address.

State of California Veterans Outreach Campaign Department of Veterans Affairs RFQ# H150357

TABLE OF CONTENTS

Section I - General Information Page

A. Purpose of RFQ B. Background C. Availability D. Period of Performance E. Key Action Dates F. Submission of Questions G. Information Technology Provisions H. Award of Contract I. State’s Right to Reject J. Protest K. Economic Incentive Program L. State Preference Program M. RFQ Response Guidelines

Section II – Evaluation Information Page

A. Evaluation Process B. Mandatory Administrative and Business Requirements C. Final Scoring Methodology D. RFQ Submission Checklist E. Cost Evaluation Appendix A, Administrative Requirements Appendix B, Business Requirements Appendix C, Technical Requirements

Attachment 1, Remote Access Policy Attachment 2, Patch Management Policy and Process

Section III – Sample Contract Package Page

Sample Standard Agreement (Std. 213) Exhibit A, Statement of Work

Attachment 1, Deliverable Expectations Document Attachment 2, Deliverable Acceptance Document Attachment 3, Work Authorization Document

Exhibit B, Budget Detail and Payment Provisions Exhibit B-1, Cost Worksheet

Exhibit C, IT General Provisions Exhibit D, Information Security and Confidentiality Acknowledgement Exhibit E, Remote Access User Acknowledgement Form Exhibit F, Bidder’s Response (Placeholder)

Section IV – Contractor’s Bid Submittal Checklist Summary Page

Contractor’s Bid Submittal Checklist Form 1, Bidder Preferences and Certifications Form 2, Declarations Form 3, Commercially Useful Function Form 4, Worker’s Compensation Certification Form 5, Commercial General Liability Certification Form 6, Payee Data Record (STD. 204) Form 7, Secretary of State Status Form 8, Bidder’s Qualifications Form 9, Client Reference Form Form 10, Contractor’s Bid Certification Sheet

Request for Quote (RFQ)

I. General Information

A. Purpose of RFQ

The State of California, Department of Veterans Affairs (CalVet), hereinafter referred to as the “State” or “CalVet”, requires the services of a bidder to use available myCalVet registration and website visitor data to engage in a statewide marketing campaign, ensuring veterans and their families are aware of benefits and services available. While broad-based in scope, this campaign needs to expand overall awareness of CalVet services and the myCalVet tool, thereby increasing the number of registered myCalVet users. The campaign will focus on targeting key California geographies and demographics for continued messaging/web presence, with the goal to increase visibility in targeted markets.

VSD seeks a solution to determine how the visitors to the myCalVet website “behave,” that is to say, understanding the user’s digital world. Key elements of this understanding would include a map of their myCalVet webpage navigation, what specific pages they are initially seeking, where they navigate from, what platform they are viewing the site from, how long they are visiting certain pages, general location of the querying device (zip code), and if they came from a social media site.

VSD would also like a solution to automatically display advertisements relevant to the users’ needs, based on user web navigation, including pages visited before, during, and after the users myCalVet visit. VSD also seeks to include analysis of users’ social media feeds, to determine the best method of performing veteran benefits outreach for each user. The advertisement placements shall allow for agency monitoring and interaction with the automated process, to include manual placement of advertising/marketing of events by zip code, county, region and/or statewide.

B. Background

The California Department of Veterans Affairs (CalVet) developed an Internet solution, myCalVet, that connects veterans, their dependents and their families with services they need and benefits they have earned. myCalVet site visitors can browse key benefits and services, and discover contact information for local service providers, while registered users utilizing the myCalVet features are provided with a self-service, personalized intentions-based user experience, tailoring information based on their perceived needs.

Service Providers may register with myCalVet, and once their operation is reviewed and approved, that provider is part of the direct services constellation which is presented to veterans indicating a need for those specific services, within a specified geographic area. When combined with the tailored, demographic based results, myCalVet automatically connects veterans with their local service providers which is integral to service delivery.

The citizen-centric solution fosters community and collaboration through seamless integration of social media throughout the site. Social “consumers” can use the “share” features that are included throughout the site while using the information gained from Facebook, Twitter and YouTube feeds to evaluate and make decisions about topics of interest.

https://www.calvet.ca.gov/_layouts/15/CalVetConnect.Authentication/calvetlogin.aspx?ReturnUrl=%2fmyCalVet%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fmycalvet&Source=%2Fmycalvet myCalVet integrates with CalVet’s Case Management solution and other interface partners via a secure web-service gateway to publish new registrants to approved partners. myCalVet also automatically pulls new veteran information from County systems. By extending the user-profile system, myCalVet provides automated outreach capabilities that enable CalVet to perform dynamic campaigns to distinct veterans groups.

C. Availability

All candidates submitted by the Contractor must be available during the term of agreement.

The selected contractor and proposed staff must be able to meet the requirements of the RFQ and be ready to begin work on the anticipated contract start date of June 1, 2016 unless notified otherwise by CalVet.

D. Period of Performance

The anticipated term of this agreement begins on the date indicated on the Standard Agreement (STD. 213, Exhibit A), for a term of one (1) year with option to extend for two (2) one year extensions. If the Contractor starts performance before final approval of the contract, it shall be considered voluntary on the part of the Contractor and free of charge.

E. Key Action Dates

Listed below are the Key Action Dates and times by which the actions shall be completed. If the State finds it necessary to change any of these dates, it will be accomplished via an addendum to this RFQ.

Key Action Dates Date Release of RFQ April 26, 2016 Submission of written questions May 2, 2016 by 3:00 pm PST Response to written questions May 4, 2016 Submission of Quotes May 16, 2016 by 3:00 pm PST Public Cost Opening May 18, 2016 at 2:00 pm PST

Information Services Division 1227 O Street, 6th Floor Sacramento, CA 95814

Notification of Intent to Award May 20, 2016 Anticipated Agreement Start Date June 1, 2016

It must be understood that time is of the essence for both the quote submittal and contract execution processes. If the State finds it necessary to change any requirement, it will be accomplished via an addendum to this RFQ.

F. Submission of Questions

All questions regarding the content of this RFQ shall be submitted in writing by mail or electronically to Tracy.Barbosa@CalVet.ca.gov and shall be received by the Key Action Date identified above. Submit questions according to the following format:

mailto:Tracy.Barbosa@CalVet.ca.gov

Item Section Reference

Bidder Question

Example:

Section I.A, Purpose of RFQ

What is the…?

Questions not submitted by the Key Action Date shall be answered at the State’s option.

When the State has completed its review of the questions, all of the questions and answers will be distributed in writing by electronic mail to all bidders who submitted questions.

G. Information Technology Provisions

The following information is incorporated into this RFQ. Please read the documents carefully.

Bidder must agree to the terms and conditions listed below by signing the Contractor’s Bid Certification Sheet which can be found in Section IV – Contractor’s Bid Submittal Checklist section of this RFQ. Please read the documents carefully.

1. Bidder Instructions (Effective 11/09/11) http://www.documents.dgs.ca.gov/pd/modellang/GSPD451-110911.pdf

2. Information Technology General Provisions (Effective 9/5/14) http://www.documents.dgs.ca.gov/pd/poliproc/GSPD401IT14_0905.pdf

H. Award of Contract

Award of contract, if made, shall be in accordance with the RFQ information and evaluation to a responsible bidder whose quote complies with all the requirements of the RFQ and any addenda. Award, if made, shall be made within forty-five (45) days after the scheduled date for Contract Award as specified in the RFQ; however, a bidder may extend the offer beyond 45 days in the event of a delay of contract award.

The State reserves the right to determine the successful bidder(s) either on the basis of individual items or on the basis of all items included in its RFQ, unless otherwise expressly provided in the State’s RFQ. Unless the bidder specifies otherwise in its quote, the State may accept any item or group of items of any quote. The State reserves the right to modify or cancel in whole or in part the RFQ.

Written notification of the State’s intent to award will be made to all bidders. If a bidder, having submitted a bid, can show that its bid, instead of the bid selected by the State, should be selected for contract award, the bidder will be allowed five (5) working days to submit a Notice of Intent to Protest, according to the instructions contained in the paragraph titled “Protests” of this RFQ.

I. State’s Right to Reject

A proposal/quotation may be rejected if it is conditional or incomplete, or if it contains any alterations of form or other irregularities of any kind. The State may reject all proposals and may waive any immaterial deviation in a proposal/quotation. The State’s waiver immaterial defect shall in no way modify the RFQ document or excuse the proposing firm from full http://www.documents.dgs.ca.gov/pd/modellang/GSPD451-110911.pdf http://www.documents.dgs.ca.gov/pd/poliproc/GSPD401IT14_0905.pdf compliance with all requirements if awarded the agreement. CalVet reserves the right to reject all proposals at its sole discretion. If all proposals are too high, CalVet is not required to award an agreement (PCC 10344(d), 10377(d)).

J. Protests

Any bidder’s issues regarding solicitation requirements shall be resolved (or attempts to resolve them shall have been made) before a protest may be submitted according to the procedure below. These issues will first be resolved by the contact for the solicitation or if they result in a protest, the protest will be submitted to DGS Procurement Division Deputy Director to hear and resolve issues and whose decision will be final.

If a bidder has submitted a quote which it believes to be responsive to the requirements of the RFQ and to be the quote that should have been selected according to the evaluation procedures in the solicitation and the bidder believes the State has incorrectly selected another bidder for award, the bidder may submit a protest of the selection as described below. Protests regarding selection of the "successful bidder" will be heard and resolved by the Victim Compensation and Government Claims Board whose decision will be final.

All protests of award shall be made in writing, signed by an individual authorized to bind the bidder contractually and financially, and contain a statement of the reason(s) for protest; citing the law, rule, regulation or procedure on which the protest is based. The protester shall provide facts and evidence to support the claim. Protests shall be mailed or delivered to:

Street and Mailing Address:

Deputy Director

Procurement Division 707 Third Street, Second Floor South

West Sacramento, CA 95605 Facsimile No.: (916) 375-4611

All protests to the RFQ or protests concerning the evaluation, recommendation, or other aspects of the selection process shall be received by the DGS Procurement Division Deputy Director as promptly as possible, but not later than the date indicated in the last day to Protest Notification of Intent to Award. Certified or registered mail shall be used unless delivered in person, in which case the protester should obtain a receipt of delivery.

K. Economic Incentive Program

Bidders may be eligible for additional preferences when their place of business is located within certain economic regions and when they hire persons living and working within those economic regions. Please access the following links to read information about these economic incentive programs.

TACPA CONTRACT PREFERENCE

This solicitation contains Target Area Contract Preference Act (TACPA) preference request forms. Please carefully review the forms and requirements. Bidders are not required to apply for these preferences. Denial of the TACPA preference request is not a basis for rejection of the bid.

The State as part of its evaluation process reserves the right to verify, validate, and clarify all information contained in the bid. This may include, but is not limited to, information from bidders, manufacturers, subcontractors and any other sources available at the time of the bid evaluation.

Bidder refusal to agree to and/or comply with these terms, or failure to provide additional supporting information at the State's request may result in denial of preference requested.

Contracts awarded with applied preferences will be monitored throughout the life of the contract for compliance with statutory, regulatory, and contractual requirements. The State will take appropriate corrective action and apply sanctions as necessary to enforce preference programs.

TACPA Preference Request (STD 830):

http://www.documents.dgs.ca.gov/osp/pdf/std830.pdf

Bidder’s Summary of Contract Activities and labor Hours:

http://www.documents.dgs.ca.gov/pd/edip/bidsum526.pdf

Manufacturer’s Summary of Contract Activities and Labor Hours:

http://www.documents.dgs.ca.gov/pd/dispute/mfgsum525.pdf

Any questions regarding the TACPA preference should be directed to the Department of general Services, procurement Division at (916) 375-4609.

L. State Preference Programs

1. Small Business Preference - The Small Business preference provides certified small businesses and micro-businesses a calculation preference in the amount of five (5) percent of the highest scored responsible and responsive proposal submitted by a proposing firm who is not a certified small business. The small business preference is used as a calculation for determining the highest score and does not affect the actual price proposed.

The awarding department applies a five (5) percent Small Business preference to small business proposals during proposal evaluation when a non-small business has submitted the highest scored, responsible/responsive proposal pursuant to the solicitation’s evaluation method identified in the proposal. The certified small business:

a. Must include in its bid evidence of a current DGS Office of Small Business and

DVBE Services (OSDS) Small Business certification.

b. If pending small business certification, a notification to the awarding department that it has submitted to DGS/OSDS a complete application no later than 5:00 p.m. on the bid due date, and is subsequently certified by the Department of General Services as a small business; and

c. Must submit a timely, responsive bid; and

d. Must be determined to be a responsible bidder.

Firms having pending Small Business or DVBE Certification applications under review by the Department of General Services concurrent with the proposal time frame should contact DGS/OSDS to request an expedite review/approval of their application in order to be considered for the small business preference during the evaluation of this proposal. Contact DGS/OSDS at (916) 375-4940 to obtain information about the application expedite process.

http://www.documents.dgs.ca.gov/osp/pdf/std830.pdf http://www.documents.dgs.ca.gov/pd/edip/bidsum526.pdf http://www.documents.dgs.ca.gov/pd/dispute/mfgsum525.pdf

Firms must notify the Department in writing at the time of the proposal submission that they have an application for Small Business or DVBE certification under review at the DGS Office of Small and Disabled Veteran Business Certification, and that they wish to be considered for the Small Business Preference Calculation.

2. DVBE Participation/DVBE Incentive

For the purpose of this solicitation, the DVBE participation requirement was waived;

however, this solicitation does provide an incentive for DVBE participation.

In accordance with Section 999.5(a) of the Military and Veterans Code an incentive will be given to bidders who provide DVBE participation. For evaluation purposes only, the State shall apply an incentive to quotes that propose California certified DVBE participation as identified on the Bidder Declaration GSPD-05-105 and confirmed by the State.

The following example illustrates the DVBE Incentive based on a bidder’s confirmed percentage of DVBE participation as applied to the total possible points.

DVBE Participation DVBE Incentive (based on maximum quote score)

5% or more 5% (points) 4% up to 4.99% 4% (points) 3% up to 3.99% 3% (points) 2% up to 2.99% 2% (points) 1% up to 1.99% 1% (points)

B I D D E R

MEETS SMALL

BUSINESS

REQUIREMENT

BUSINESS

TECHNICAL

REQUIREMENT

POINTS

(A)

COST

POINTS

(B)

TOTAL

SCORE

BEFORE

INCENTIVE

(C)

SMALL

BUSINESS

PREFERENCE

POINTS

(HIGHEST

NON-SB X 0.05)

(D)

TOTAL

POINTS W/

SMALL

BUSINESS

(E)

DVBE

INCENTIVE

(F)

DVBE

INCENTIVE

POINTS

(G)

TOTAL

SCORE

(H)

1 No 483 488 971 - 971 5% 50 1021

2 No 466 455 921 - 921 3% 30 951

3 Yes 500 500 1000 49 1049 0% - 1049

The highest Total Point score among the non-small business Bidders – in this case, 1049 (Bidder 3).

In the example above, Bidder 1, a non-small business with 5% DVBE participation would receive a final score of 1021. Bidder 2, a non-small business with 3% more than the minimum DVBE participation requirement, would receive a final score of 951. Bidder 3, a small business committing to the minimum DVBE participation, would receive a final score of 1049. The highest final score will determine the successful bidder, in this example, Bidder# 3.

M. RFQ Response Guidelines

The bidder’s quote in response to this RFQ shall be made a part of the final Agreement.

Responses to this RFQ shall contain all data/information requested. It is the bidder’s responsibility to provide all required data and any other information deemed necessary for the State’s evaluation team to determine and verify the bidder’s ability to meet the requirements of this RFQ.

At the State’s option prior to award, bidders may be required to submit additional written clarifying information, including rationale for their proposed solution. Failure to submit the required written information as specified may be grounds for quote rejection.

II. Evaluation Information

A. Evaluation Process

The Administrative requirements will be evaluated on a Pass/Fail basis. Quotes will first be screened to determine if the bidder has complied with appropriate submittal instructions and required components. Quotes that meet the “pass/fail” criteria will be eligible to have their cost quote opened. QUOTES THAT DO NOT PASS ALL THE MANDATORY REQUIREMENTS

WILL BE DEEMED NON-RESPONSIVE AND WILL BE REJECTED.

B. Mandatory and Scored Business, and Technical Requirements

The State has established certain requirements with respect to quotes to be submitted by prospective bidders. The use of “shall,” “must,” or “will” (except to indicate simple futurity) in this RFQ indicates a requirement or condition that is mandatory. Should a bidder respond to a mandatory requirement using language that fails to explicitly commit the bidder after contract award by using terms such as “may” or “could,” the State may interpret the response as a material deviation. A deviation, if not material, may be waived by the State. A deviation from a requirement is material if the deficient response is not in substantial accord with the RFQ requirements, provides an advantage to one bidder over other bidders, or has a potentially significant effect on the delivery, quantity, or quality of items quote, the amount paid to the bidder or on the cost to the State. Material deviations cannot be waived.

Suppliers unable to meet a Mandatory (M) requirement will result in a material deviation and will result in the quote being deemed non-responsive and rejected.

Requirements identified as Scored (S) will be evaluated and awarded points by the evaluation team. Bidders will be evaluated and awarded points based on how well the Bidder’s response matches the evaluation criteria. If the required information is included in the Bidder’s quote, the evaluation team will award points in accordance with the evaluation criteria as identified in the Scoring Component table.

Scoring Component Value Assigned

Administrative Requirements (M) Pass/Fail Business Requirements (M) Pass/Fail Technical Requirements (M)

Pass/Fail Bidder’s Quote (S)

- Describe statewide marketing plan to increase number of registered myCalVet users (maximum of 50 points)

- Describe how advertising will be developed and produced to strengthen veterans understanding of the benefits and services available to them. (maximum of 50 points)

- Describe how messaging will target prospective audiences.

(maximum of 50 points)

150 points

Bidders Qualifications (S)

- The Bidder must identify at least three (3) prior projects similar in size and complexity as this Agreement. (maximum of 50 points)

- The Bidder must have a minimum of at least three (3) years working with governmental entities. (maximum of 50 points)

100 points

Client References (S)

- Bidder must submit one (1) to three (3) company references using Form 9 located in Section IV, Contractor’s Bid Submittal Information. Points will be assigned for each reference up to three references. (up to 50 points per reference)

150 points

Cost

Each bidders cost score will be calculated based on the ratio of the lowest cost proposal to the bidders cost, multiplied by the maximum number of cost points available (50), as shown in the calculation below:

Lowest Total Cost Bid X Total cost points available Bidder Total Cost

50 points

Total Maximum Points Available 450 points

C. Final Scoring Methodology

CalVet has established a Review Team comprised of individuals selected from management and staff. The Review Team will review and compare Proposals in accordance with the Evaluation Process described in Exhibit A, Statement of Work, Section II, Evaluation Process.

CalVet may engage additional qualified individuals during the review process to assist the Review Team in understanding financial, legal, contractual, or program issues.

D. RFQ Submission Checklist

The RFQ Submission Checklist will be used to evaluate the bidder’s RFQ. Bidders may also use the checklist to verify that appropriate documentation and requirements are met. Bidders are not required to submit the checklist.

E. Cost Evaluation

The Bidder must submit their Cost Sheet in a separately sealed envelope and shall be marked “DO NOT OPEN – RFQ #H150357 – COST SHEET”. If a bidder’s quote has been determined to be non-responsive during the evaluation of requirements, cost will not be opened.

Quote must be based on CalVet’s Statement of Work, Section III, Exhibit A. Contractor must complete the cost sheet that identifies total cost per transaction as described in the Statement of Work. The Cost Sheet can be found in Section III – Sample Contract Package, Exhibit B-1.

The Cost Sheet shall not be completed in pencil and there shall be no erasures or corrections of any kind

Each bidder’s cost worksheet will be evaluated on the total extended cost for both the contracted term and any optional extension year/s. The contractor’s cost worksheet will be checked for mathematical accuracy.

Each bidder's cost shall be evaluated for responsive quotes from responsible bidders that passed the mandatory administrative and business requirements.

The final selection will be made on the basis of most points awarded and meeting all requirements of this RFQ.

APPENDIX A, ADMINISTRATIVE REQUIREMENTS

ADMINISTRATIVE REQUIREMENTS (M)

Statement of Work (SOW)

Exhibit A, Statement of Work, identifies how the State contract will be structured. No negotiations or alterations (unless specified otherwise) in the contract are permitted. Bidder must be able to perform the work identified in the SOW.

Declaration Forms

All bidders must complete the Bidder Declaration GSPD-05-105, Form 2, Declarations, and include it with the quote response. When completing the declaration, bidders must identify all subcontractors proposed for participation in the contract. Bidders awarded a contract are contractually obligated to use the subcontractors for the corresponding work identified unless the State agrees to a substitution and it is incorporated by amendment to the contract. If not using subcontractors, submit the form and indicate “NONE” in the appropriate section.

Bidders who have been certified by California as a DVBE (or who are proposing rental equipment and have obtained the participation of subcontractors certified by California as a DVBE) must also submit a completed form(s) STD. 843 (Disabled Veteran Business Enterprise Declaration). All disabled veteran owners and disabled veteran managers of the DVBE(s) must sign the form(s). The completed form must be included with the quote response. Form 2, Declarations.

Commercially Useful Function

Military and Veterans Code Section 999 et seq. requires all small business, micro businesses and disabled veteran enterprises to perform a “commercially useful function” in any contract they perform for the state.

The bidder must provide a written statement detailing the role, services and/or goods the subcontractor(s) will provide to meet the Commercially Useful Function requirement, using the Commercially Useful Function Certification. The criteria and definition for performing a commercially useful function are contained in the DVBE Program Requirements page entitled Resources & Information. Form 3, Commercially Useful Function (CUF).

Workers’ Compensation Insurance

The bidder must maintain in force (as required by State law) a valid Workers’ Compensation Insurance Policy for all employees engaged in the performance of the Contract and agree to furnish the State satisfactory evidence thereof at the time of the bid submittal and at any time the State may so request.

Satisfactory evidence of a certificate of insurance showing a minimum amount of not less than $1,000,000 employer’s liability, for all employees proposed in the performance of this Contract must be included in the quote and must be provided to the State at any time the State may request. Bidders must complete Form 4, Workers’ Compensation Insurance Certification.

Target Area Contract Preference (TACPA) (if applicable)

This section describes socioeconomic programs established by State law and further defined by regulations and policies to increase business opportunities to small and disabled veteran businesses and businesses operating economically distressed areas of the State. Bidders seeking to claim Target Area Contract Preferences Act (TACPA) must complete and submit the applicable forms as identified in Form 1, Bidder Preferences and Certification.

ADMINISTRATIVE REQUIREMENTS (M)

Commercial General Liability Insurance

The bidder and proposed subcontractors must maintain in force (as required by State law) a valid Commercial General Liability Insurance Policy. Satisfactory evidence of a certificate of insurance showing a minimum amount of not less than $1,000,000 must be included in the quote and must be provided to the State at any time the State may request. Form 5, Commercial General Liability Certification.

Payee Data Record

The successful bidder as a result of this RFQ will be required to sign in the Payee Data Record, STD.

204, before contract award. Form 6, Payee Data Record.

Secretary of State Certification

All Corporations, Limited Liability Corporations, and Limited Partnerships must be registered and in ‘Active’ status with the California Secretary of State (SOS) to be awarded a contract. Form 7, Secretary of State Certification.

Bidder’s quote must contain a copy of the bidder’s certification with the SOS to do business in California.

If certification has not been received, a copy of bidder’s application and statement of status must be included.

The bidder must be certified with the SOS, if required by law to do business in California. If the bidder does not currently have this certification, the successful bidder must be certified before contract award can be made.

The SOS may be contacted as follows:

California Secretary of State Division of Corporate Filing and Services 1500 Eleventh Street, Third Floor Sacramento, CA 95814-5701

The required document(s) may also be obtained through the Certification Unit at 916-657-5251 or at the SOS website http://kepler.ss.ca.gov.

Subcontractor(s) Exceeding ten (10%) percent of the Contract

All proposed subcontractors must be identified on the completed GSPD-05-105, Form 2, Declarations.

Any subcontractor that the bidder chooses to use in fulfilling the requirements of this RFQ, and which is expected to receive more than ten percent (10%) of the value of the Contract, must also meet all requirements of the RFQ, as applicable. The bidder’s quote must include the following RFQ Forms for each subcontractor expected to receive more than ten (10%) percent of the value of the Contract:

• Form 3, Commercially Useful Function

• Form 5, Commercial Liability Insurance

• Form 8, Bidder Qualifications http://kepler.ss.ca.gov/

APPENDIX B, BUSINESS REQUIREMENTS

BUSINESS REQUIREMENTS (M) SCORE

TYPE

BIDDER’S

RESPONSE

SUPPORTING

DOCUMENTATION

Bidder Quote

The Bidder must submit a quote in accordance with the scoring component table in Section II, Evaluation Process.

MS

Bidder Qualifications

1. The Bidder must identify at least three (3) prior projects similar in size and complexity as this Agreement.

2. The Bidder must have a minimum of at least three (3) years working with governmental entities.

See RFQ, Form #8, Bidder Qualifications

MS

Client References

The bidder must provide at least one (1) and up to three

(3) client references for services performed within the past three (3) years that are similar in size and complexity as this Agreement.

See RFQ, Form #9, Client References

MS

Resumes

The bidder must provide completed staff resumes for each proposed staff member.

M

All proposed subcontractors that the bidder chooses in fulfilling the requirements of this RFQ and is expected to receive more than ten percent (10%) of the value of the Contract must also meet these requirements.

M

APPENDIX C, TECHNICAL REQUIREMENTS

TECHNICAL REQUIREMENTS (M) SCORE TYPE BIDDER’S

RESPONSE

Bidder must provide verification software to detect and prevent fraudulent ad traffic to ensure that the CalVet Outreach Campaign is run strictly on brand-enhancing websites

M

Bidder shall provide transparency of the technical specifications and keep CalVet’s developers informed at every stage

M

Bidder must have secure and ethical technical methods M

Bidder shall use tracking methods that do not involve CalVet embedding code on CalVet’s side of files stored on Bidder’s server that can be altered without CalVet’s knowledge

M

Tracking and analysis should be able to work on all browsers that block cookies and on both iOS and Android based mobile devices

M

Bidder must be experienced in techniques using multiple tracking methods other than cookies such as Statistical IDs, Known Identifiers, and Stable Identifiers

M

Bidder must allow CalVet to track and monitor where CalVet’s ads are being displayed

M

Bidder must allow CalVet to control the advertising on external sites and be able to pull down ads at any time

M

Bidder must adhere to CalVet’s Website Privacy Policy M Remote access to CalVet systems will follow the terms outlined in CalVet’s Remote Access Policy (authorization form required for each staff member working on the agreement)

M

Any solution on CalVet’s network must comply with CalVet’s Patch Management Policy/Process.

M

Bidder must properly secure and maintain any computer systems that it will use during the performance of this agreement

M

Bidder shall agree to maintain as well as upgrade any system components used in the process of fulfilling the terms of the agreement

M

Bidder must utilize and maintain “commercial” antivirus software

M

Bidder shall use industry standard encryption technologies where appropriate to protect data against unauthorized access, modification, loss or theft while in transit over public networks

M

Bidder must agree to encrypt and confidential and/or proprietary information transmitted electronically to and from CalVet or when transmitting CalVet data to any other parties https://www.calvet.ca.gov/Pages/Privacy.aspx

TECHNICAL REQUIREMENTS (M) SCORE TYPE BIDDER’S

RESPONSE

Bidder must establish and maintain a CalVet approved “single tunneled” VPN with encryption technology while transmitting data across the internet

M

Bidder shall use “best practice” and “harden” all systems used to store, exchange, and/or transmit information with the CalVet

M

Bidder must allow CalVet Information technology and Information Security Personnel to inspect and/or audit any or all systems used during the course of this agreement

ATTACHMENT 1, REMOTE ACCESS POLICY

Remote Access Policy Policy Owner Information Security Office Policy Approver(s) Lisa Senitte, Agency Chief Information Officer (AIO) Related Policies

Authority/Guidance State Administrative Manual (SAM) Section 5360.1 – Remote Access (1), Statewide Information Management Manual (SIMM) 5360-A – Telework and Remote Access Security Standard

Effective Date Next Review Date

Purpose The purpose of this policy is to define standards, procedures, and restrictions for connecting to CalVet’s internal network(s) from external hosts via remote access technology, and/or on-site for business purposes using non-CalVet equipment and through remote desktop/screen sharing software (e.g. WebEx or GoToMeeting). CalVet’s corporate data, computer systems, networks, databases, etc., must be protected from unauthorized use and/or malicious attack that could result in loss of information, damage to critical applications, loss of revenue, and damage to our public image. Therefore, all remote access and mobile privileges for CalVet employees to enterprise resources – and for wireless Internet access via hotspots – must only employ company-approved methods.

Scope This policy applies to all CalVet employees, including full-time staff, part-time staff, and contractors, who utilize Department-owned or privately-owned computers to access the organization’s data and networks. Employment at CalVet does not automatically guarantee the granting of remote access privileges.

Any and all work performed for CalVet on said computers by any and all employees or contractors, through aforementioned approved connections, are covered by this policy. Work can include (but is not limited to) e-mail correspondence, Web browsing, utilizing intranet resources, and any other company application used over the Internet. Remote access is defined as any connection to CalVet’s network and/or other applications from off-site locations, such as the employee’s home, contractor’s office, a hotel room, airports, cafés, satellite office, wireless devices, etc.

Policy Each state entity shall establish and document allowed methods of remote access to its information systems; establish usage restrictions and implementation guidance for each allowed remote access method; and monitor the information asset for unauthorized remote access (1). Allowed methods shall also comply with the State of California’s Telework and Remote Access Security Standards (2).

Practices

A. Appropriate Use It is the responsibility of any employee or vendor/contractor of CalVet with remote access privileges to ensure that their remote access connection remains secure. It is imperative that any remote access connection used to conduct CalVet business be utilized appropriately, responsibly, and ethically. Therefore, the following rules must be observed:

1. Employees and vendors/contractors will follow secure remote access best practices in accordance with CalVet’s password policy. Employees and contractors agree to never disclose their passwords to anyone.

2. All remote computer equipment and devices used in conducting CalVet business, must display reasonable physical security measures such as up-to-date antivirus, operating system patches and multifactor authentication as defined within SIMM 5360-A – Telework and Remote Access Security Standard.

3. Remote users using public hotspots for wireless Internet access must employ for their devices a company-approved personal firewall, VPN, and any other security measure deemed necessary by ISD. Any remote connection (i.e. hotspot, ISDN, frame relay, etc.)

that is configured to access CalVet resources must adhere to the authentication requirements of CalVet’s Information Services. In addition, all hardware security configurations (private or department-owned) must be approved by CalVet’s ISD’s Manager of Infrastructure and Operational Support and the Agency information Security Officer.

4. Employees, contractors, and temporary staff will make no modifications of any kind to the remote access connection without the express approval of ISD’s Manager of Infrastructure and Operational Support and the Agency Information Security Officer. This includes, but is not limited to, split tunneling, dual homing, non-standard hardware or security configurations, etc.

5. All users with remote access privileges must ensure that their computers are not connected to any other network while connected to CalVet’s network via remote access, with the exception of Internet connectivity.

6. If a privately- or department-owned computer or related equipment used for remote access is damaged, lost, or stolen, the authorized user will be responsible for notifying their manager and CalVet’s Information Security Officer immediately.

7. The remote access user also agrees to immediately report to their manager and ISD’s Manager of Infrastructure and Operational Support and the Agency information Security Officer of any incident or suspected incidents of unauthorized access and/or disclosure of company resources, databases, networks, etc.

8. The remote access user also agrees to and accepts that his or her access and/or connection to CalVet’s networks may be monitored to record dates, times, duration of access, etc., in order to identify unusual usage patterns or other suspicious activity. As with in-house computers, this is done in order to identify accounts/computers that may have been compromised by external parties.

9. Where applicable, accounts used by vendors to access, support, or maintain system components via remote access are enabled only during the time period needed and disabled when not in use.

B. Eligible Users All employees or contractors requiring the use of remote access for business purposes must go through CalVet’s system access process which includes justification and approvals by ISD’s Manager of Infrastructure and Operational Support and the Agency information Security Officer

Once access is authorized, all CalVet employees and onsite contractors will access the system via department owned equipment. All off-site vendors performing support functions such as system maintenance or incident management tasks will connect via non-department owned equipment and through remote desktop/screen sharing software (e.g.

WebEx or GoToMeeting).

Remote maintenance or incident management performed by vendors must be authorized, actively monitored and audited upon completion. Remote maintenance must make use of appropriate risk mitigation techniques that include the use of encryption and strong authentication.

C. Supported Technology All Department-owned equipment used for remote access will be centrally managed by CalVet’s Information Services Division (ISD) and will utilize encryption and strong authentication measures. Remote access connections covered by this policy include (but are not limited to) Internet dial-up modems, frame relay, ISDN, DSL, VPN, SSH, cable modems, proprietary remote access/control software, etc.

In rare situations where it is not possible to use of Department-owned equipment for remote access, an alternate remote connection method, VMWare Horizon View Client, is available. Significant justification must be submitted and approved by the ISD’s Manager of Infrastructure and Operational Support and the Agency Information Security Officer before this alternate method of remote access is made available for use.

Regulation, Enforcement, and Compliance All CalVet’s remote access users shall comply with the provisions of this Remote Access Policy and sign the Remote Access User Acknowledgement Form that accompanies it. Further, the Information Security Office is responsible for investigating suspected non-compliance. If non-compliance is suspected, an investigation will be conducted and if non-compliance is validated, CalVet shall proceed in accordance with department and civil service rules. This includes, but is not limited to, discipline up to and including termination of employment, criminal or civil action.

Remote Access User Acknowledgement Form

I, [employee name], have read and understand this Remote Access Policy and consent to adhere to the rules outlined therein.

Employee Signature Date

Manager, Infrastructure and Operational Support Date Signature

Agency Information Security Officer Signature Date

ATTACHMENT 2, PATCH MANAGEMENT POLICY AND PROCESS FLOWCHART

Patch Management Policy

Overview

CalVet Computer Systems require patches and hot-fixes. Patches and hot-fixes are routinely created and published by various hardware and software vendors to correct potentially serious security and reliability flaws.

All hardware and software manufacturer recommended patches, hot-fixes, and updates for security vulnerabilities will be tested and installed on all applicable telecommunications and network systems within one (1) week of the general availability of the patch or update. Patches, hot-fixes and updates for security vulnerabilities deemed “high risk” or “critical” by the manufacturer will be assessed by CalVet’s Agency Information Security Office for implementation and resolution.

Goal

To ensure all CalVet systems are patched and do not pose an unmanaged security risk for the agency. Additionally, the policy will define agency standards for auditing, reporting, communicating, contingency planning, and managing security patches.

Scope

The scope of this document includesoperating system, application patches and hot-fixes (hardware, software, firmware, all-ware for every CalVet computer (desktop and laptop), mobile device (smartphone and tablet) and network device(servers and appliances) connected to any part of the Local Area Network (LAN) or Wide Area Network (WAN).

General Policy and Operational Guidelines

Operational Guidelines

1. The Information Security Office is responsible for monitoring, analysis, and notification of applicable patches to Enterprise Network Unit. The Agency Information Security Officer (AISO) will also monitor and provide notification on key non-Microsoft patches.

2. The Enterprise Network Unit is responsible for testing and applying all applicable patches to CalVet’s servers-both physical and virtual- desktops, and laptops via Microsoft System Center Configuration Manager (SCCM). System maintenance for the application of patches will be vetted through CalVet’s Change Management Team (CMT) and calendared.

3. The AISO will also provide timely information regarding patch availability to the

Headquarters’ Help Desk, Technical Support Leads within the Homes, and Enterprise Network Staff. The AISO will also provide recommendations and suggestions for implementation as appropriate i.e., risk-levels-“high” (critical), “medium, and “low.”

Technical Guidelines

1. CalVet’s Network Security Operations will monitor SCCM for available patches monthly to determine the need for application of said security patches.

2. CalVet’s Network Security Operations will determine patch applicability and coordinate deployment with Headquarters’ Help Desk, Technical Support Leads within the Homes, and Enterprise Network Staff prior to distribution of updates via SCCM.

3. CalVet’s AISO will approve patch distribution and schedule.

4. Current patches for the following Microsoft supported products must be maintained:

a. Windows OS

b. Internet Explorer – All Versions

c. Microsoft SQL Server Desktop Engine (MSDE)

d. Microsoft Data Access Components (MDAC)

e. Microsoft Office Suite, including Outlook

f. Windows Media Player

g. DirectX

h. Windows Servers – Physical and Virtual

5. Current patches for the following non-Microsoft supported products must be maintained:

a. Adobe – Flash and Player

b. Java

c. VMWare

d. Meditech

e. Mitas

f. Monarch

g. Attachmate

h. Amicus (Legal)

i. HP (hardware, drivers)

j. Enterprise Network Backbone (hardware, firmware, software, drivers)

k. HP Procurve Switches

l. Cisco ASA/Palo Alto

m. Aruba (Wireless)

n. Shoretel

o. Hirsch (Velocity Software)

p. American Dynamics (Intellex Software)

Configuration

Client Configuration

1. All of CalVet clients will be configured according to the CalVet standard naming convention.

2. All of CalVet clients will have the SCCM client installed on them for patching and inventory purposes.

Patch Approval Process

CalVet’s AISO will approve patch distribution and schedule. It is the responsibility of application owners to identify any problem(s) with a patch or patches and to notify their local Help Desk, Network Security Operations, and the AISO of any problem(s). Additionally, as mentioned previously, the CMT will be alerted upon scheduling of patches and the entry will also be posted on the IT Change Calendar.

Deployment and Time Frames for Distribution

All hardware and software manufacturer recommended patches, hot-fixes, and updates for security vulnerabilities which have been identified by the AISO as required, will be tested and installed on all applicable telecommunications and network systems within one (1) week of the general availability of the patch or update e,g, Patch Tuesday. Patches, hot-fixes and updates for security vulnerabilities deemed “high risk” or “critical” by the manufacturer will be assessed by the AISO for implementation and resolution by The Information Security Unit, Help Desks, and Chief of Infrastructure and Operational Support.

Patches, hot-fixes, and updates for security vulnerabilities identified as “high risk” or “critical” by the AISO must be tested and implemented within (48) hours of availability. If the patch or update cannot be implemented in the stated time limit, a notifcation will be sent to the AISO with justification for the delay.

Systems deemed non-compliant by the AISO, will be reported to the Chief of Infrastructure and Operational Support and Agency Chief Information Officer (AIO). Systems that will be unable to be patched in the given time will be reported to the AISO as being vulnerable. The AISO, upon agreement with the Chief of Infrastructure and Operational Support and AIO, will determine whether the system should be removed from service until the patch, hot-fix, or update has been implemented, or until the implementation plan has been reviewed and approved by both individuals.

Anti-virus software patches, updates, and virus definition files must be implemented on all servers and workstations within one (1) day of general availability. The SCCM Client must be installed on all CalVet machines, including servers, in order to maintain anti-virus software compliance.

All CalVet laptops must be brought in for service and updated quarterly. Users of said devices may be required to bring them in more frequently if a “zero day” or “high risk” vulnerability is released. If remote users fail to bring in their respective machines for updating, following a recall, their network priveleges will be deactived until they become compliant.

Auditing and Monitoring

1. SCCM Compliance Reports will be generated by Network Security Operations to determine patch compliance each month and provided to the AISO.

2. Once produced and delivered, SCCM reports must be maintained by the AISO for a 1 year period.

Contingency Planning

System Failure

1. In the event that a critical patch cannot be…