The files

April 16, 2026

REQUEST FOR PROPOSAL

RP013-26

The Gwinnett County Board of Commissioners is soliciting competitive sealed proposals from qualified service providers for the Provision of Short-Term Rental Monitoring and License Administration on a Multi-Year Contract for the Department of Planning and Development.

Proposals must be returned in a sealed container marked on the outside with the Request for Proposal number and Company Name. Proposals will be received until 2:50 P.M. local time on May 21, 2026 at the Gwinnett County Financial Services - Purchasing Division – 2nd Floor, 75 Langley Drive, Lawrenceville, Georgia 30046. Any proposal received after this date and time will not be accepted. Proposals will be publicly opened and only names of submitting service providers will be read at 3:00 P.M. The opening will be virtual ONLY. To access the proposal opening, click the following Webex link (https://gwinnettgov.webex.com/gwinnettgov/j.php?MTID=mc4ddf938e945edbed8a9847d79a29c7c), or dial 408-418-9388, and enter Conference ID 2338 680 2142##. A list of service providers submitting proposals will be available the following business day on our website www.gwinnettcounty.com.

A Webex pre-proposal conference is scheduled for 3:00 P.M. local time on April 28, 2026. To access, click the following Webex link (https://gwinnettgov.webex.com/gwinnettgov/j.php?MTID=m03762629bfc4c3d80325aaa6b42bb5ae), or dial 408-418-9388, and enter Conference ID 2337 660 1737##. Questions regarding proposals should be directed to Casey Beauston, Purchasing Associate III, at Casey.Beauston@GwinnettCounty.com or by calling 770-822-7995, no later than 3:00 P.M. local time on May 5, 2026. Proposals are legal and binding upon the service provider when submitted. One single sided unbound original, five (5) copies, and one (1) electronic copy on a flash drive should be submitted. The cost proposal is to be submitted in a separate sealed envelope and should not be included in the copies mentioned above.

Successful service providers will be required to meet insurance requirements. The Insurance Company should be authorized to do business in Georgia by the Georgia Insurance Department and must have an A.M. Best rating of A-10 or higher.

Gwinnett County does not discriminate on the basis of disability in the admission or access to its programs or activities. Any requests for reasonable accommodations required by individuals to fully participate in any open meeting, program or activity of Gwinnett County Government should be directed to the ADA Coordinator at the Gwinnett County Justice and Administration Center, 770-822-8165.

The written proposal documents supersede any verbal or written prior communications between the parties.

Selection criteria are outlined in the request for proposal documents. Gwinnett County reserves the right to reject any or all proposals to waive technicalities, and to make an award deemed in its best interest.

Award notification will be posted after award on the County website, www.gwinnettcounty.com and companies submitting a proposal will be notified via email.

We look forward to your proposal and appreciate your interest in Gwinnett County.

Casey Beauston, CPPB Purchasing Associate III

The following pages should be returned:

References, Page 15 Service Provider Information, Page 16 Cost Proposal (separate sealed envelope), Page 17

Code of Ethics Affidavit, Page 30 Contractor Affidavit & Agreement, Page 31

Exhibit B – Functional Requirements Response Workbook (attached Excel file) https://gwinnettgov.webex.com/gwinnettgov/j.php?MTID=mc4ddf938e945edbed8a9847d79a29c7c http://www.gwinnettcounty.com/ https://gwinnettgov.webex.com/gwinnettgov/j.php?MTID=m03762629bfc4c3d80325aaa6b42bb5ae mailto:Casey.Beauston@GwinnettCounty.com http://www.gwinnettcounty.com/

RP013-26 Page 2

1.0 BACKGROUND AND INTRODUCTION

The Gwinnett County Department of Planning and Development (user department) is seeking qualified service providers to provide Short-Term Rental (STR) Monitoring and License Administration on a multi-year contract.

These services will assist the department with implementing the County’s Short-Term Rental Ordinance that was adopted by the Board of Commissioners on April 14, 2026. The ordinance will go into effect on April 14, 2027, and establishes the following requirements for short-term rental (STR) owners within unincorporated Gwinnett:

• Obtain a short-term rental (license) annually

• Designate a local agent that lives in Gwinnett or an adjacent County

• Obtain an interior property maintenance inspection every two years

• Comply with established operational requirements

The department is seeking a qualified and experienced service provider to implement and manage the new short-term rental licensing process, provide and maintain the software necessary to support the licensing process, and monitor short-term rental activity in Gwinnett.

2.0 SCOPE OF WORK

The scope of work for the selected service provider will fall into two (2) primary categories:

administration of the new STR licensing program and monitoring of STR activity in Gwinnett and more broadly.

A. Short-Term Rental Licensing Administration

The selected service provider will be expected to manage all aspects of the new STR licensing program, to include the following services. All forms, correspondence, web content, and other documents made available to the public or sent to applicants or STR owners must be approved by the department in advance.

1. Program Implementation

• Work with Gwinnett County to develop forms and applications necessary for the license application as well as web content and frequently asked questions to educate short-term rental owners and residents on the licensing process. All forms and web content must be branded and developed in collaboration with the County’s Communications Department.

2. License Application Review and Issuance

• Review all new applications and renewals to verify compliance with department policies and procedures, process license payments, and issue licenses.

• Proactively communicate with applicants regarding missing information in an application.

• Email two (2) reminder notifications in advance of license renewal deadlines and past due notices when a license renewal date has passed.

• Monitor deadlines for each license account to ensure renewals are processed timely and late fees are assessed as appropriate.

RP013-26 Page 3

• Any denial, suspension, or revocation of a license must be approved by the Code Enforcement Division Director or designee.

3. Customer Support and Service Level Agreements

• Provide customer support via phone and email to answer inquiries regarding the short-term rental licensing process from 8:00am – 5:00pm, with the exception of weekends and holidays observed by Gwinnett County Government.

• Meet established service level agreements, to include the following:

o Phone calls and emails will be returned by the next business day.

o When a license application is received, the applicant will receive a response within three (3) business days, indicating whether the application has been approved and a license has been issued, more information is needed, or the application has been denied. If more information is needed, the applicant will receive specific direction on what is missing. When an applicant resubmits their application with additional requested information, the selected service provider will respond within three (3) business days, again indicating whether the application is approved and a license has been issued, more information is needed, or the application has been denied.

o Average telephone hold times should not exceed five (5) minutes.

4. Online Application and Payment Portal – Solution Overview (Provide a detailed response to each of the items below. Be sure to include the item # and item repeated before each corresponding response.)

The County seeks a turnkey, web-based Online Application and Payment Portal as part of a comprehensive Software-as-a-Service (SaaS) Short-Term Rental (STR) Licensing and Monitoring solution. The portal shall serve as the primary public interface for short-term rental owners and operators to apply for, renew, track the status of, and pay for STR licenses, while providing a secure, efficient, and user-friendly experience.

4.1. Describe at least two (2) examples of service provider experience implementing STR Licensing and Monitoring solution portals, preferably in public sector.

The selected service provider shall deliver a fully hosted solution that requires no custom software development by the County and is operational upon deployment. The platform shall support the full STR licensing lifecycle, from initial application through renewal and ongoing compliance, and must be configurable to reflect the requirements of the County’s adopted Short-Term Rental Ordinance.

4.2. Describe the information your company will need from the County along with the types of participation from County staff to implement the SaaS service provider-managed solution.

4.3. Provide a detailed breakdown of how the software designed in the online portal takes applicants through the full lifecycle of applying, monitoring, receiving and renewing STR license applications.

4.4. Define how the service provider defines “configurable” with regards to the tasks required to incorporate Gwinnett County requirements.

RP013-26 Page 4

The online application portal shall be configured to collect all information, certifications, and supporting documentation required by the STR Ordinance, including any required attestations or acknowledgments. Where feasible, the County strongly prefers the use of fillable, web-based forms rather than static PDF documents that must be uploaded as attachments, to improve data quality, accessibility, and ease of use for applicants.

4.5. Describe all acceptable document types for uploading.

4.6. Describe security measures in the proposed platform to eliminate the risk of viruses, denial of service attacks, and related digital attacks that could limit the performance and availability of the service provider portal.

4.7. Provide screenshots of previously built STR portals that indicate the look and feel of the portal proposal.

4.8. Describe how the portal allows applicants to conduct the following tasks:

4.8.1. Create and manage user accounts

4.8.2. Submit new STR license applications

4.8.3. Renew existing licenses

4.8.4. Upload supporting documentation

4.8.5. View real-time application and license status

4.8.6. Receive automated notifications regarding application progress, approvals, denials, and renewal deadlines

The solution shall include an integrated online payment portal that allows applicants to securely pay all applicable application, renewal, and other associated fees. The payment functionality must comply fully with Payment Card Industry Data Security Standards (PCI DSS) to ensure the security and protection of applicant payment information and be separate from the County’s existing payment processing systems.

4.9. Provide proof of a current Attestation of Compliance (AOC) for proposed portal payment processing service.

4.10. Describe service provider experience providing payment processing systems for STR portal solutions in the public sector.

4.11. Describe usage guidelines, restrictions and requirements by the service provider for County residents that pay through the online payment portal.

The online application and payment portal shall be available 24 hours per day, 7 days per week. Any routine maintenance requiring system downtime shall be minimized and, when necessary, clearly communicated to users via online notice at least one (1) week in advance and conducted in early morning hours, preferably over weekends.

4.12. Provide maintenance schedule including day(s) of the week and times. Also include the duration of maintenance windows, frequency and notifications provided to portal users.

4.13. Provide the uptime percentage for the online portal, including the payment gateway, that the County can expect from the service provider.

RP013-26 Page 5

The portal shall be accessible through a link on the Gwinnett County website and must be branded in coordination with the County’s Communications Department to ensure a consistent look, feel, and user experience aligned with County digital standards and public-facing websites.

4.14. Provide at least two (2) examples of landing pages for existing STR portal websites.

All proposed solutions must comply with the County’s security requirements as outlined in Exhibit A – Security Requirements for Purchases. Service providers must explicitly acknowledge acceptance of all terms contained in Exhibit A. Any requested exceptions must be clearly itemized, justified, and submitted with the proposal. The County reserves the right to accept or reject any proposed exceptions.

4.15. Acknowledge acceptance of all terms contained in Exhibit A – Security Requirements for Purchases and specify any exceptions as noted above.

4.16. Clarify what browser requirements are needed to access all available features of the portal including browser type and release levels.

4.17. Departmental workstations accessing the portal will be on the Gwinnett County network. Describe portal network access requirements, if any, that may involve firewall access.

The County requires disclosure of the use of Artificial Intelligence (AI) or Machine Learning (ML) technology. If the proposed solution contains an AI or ML component, then provide responses to the following questions:

4.18. Provide a brief description of how AI or ML is used in the solution and specifically in what features/functions.

4.19. Is the AI/ML usage deterministic (meaning it is rules-based) or probabilistic (meaning it requires prediction, classification, or pattern detection)?

4.20. What data is required for the AI/ML component to function, and will the service provider’s solution continue to use the County’s data to enhance the solution’s efficiency?

4.21. Does the data contain personal, sensitive, or regulated information and how will data be stored, secured, and accessed?

4.22. Describe how the model works and how often it will require retraining.

Provide an answer to the questions for each of the security pillars below and rate each one based on an impact level of high, moderate, or low in the event of a security breach or an outage lasting a few days.

4.23. Confidentiality: What would happen if the data in this system were exposed to unauthorized individuals?

4.24. Confidentiality: Does the proposed solution store, process, or transmit any

County data?

RP013-26 Page 6

4.25. If yes to 4.24, is any of the data stored or used in proposed solution subject to Open Records or considered sensitive?

4.26. Integrity: What would happen if the data was tampered with or modified by unauthorized individual for malicious purposes?

4.27. Integrity: Could such actions result in negative consequences, such as compromised decision-making, financial loss, reputational damage, or legal issues?

4.28. Availability: What would happen if the proposed solution or data were unavailable to the department for some length of time? How would the County provide continuous operations?

Provide responses to the following security-related questions.

4.29. If available, provide a Service Organization Control (SOC) 2 Type ll report that is inclusive of all five (5) Trust Service Principles (Security, Availability, Processing Integrity, Confidentiality, and Privacy). This does not include SOC 2 certifications for web service platforms such as Microsoft Azure, Amazon Web Services, or Google Cloud Platform.

4.30. What encryption standard does the proposed solution provide for data at rest and in transit?

4.31. Does the proposed solution support multi-factor authentication (MFA) and single sign-on (SSO)?

4.32. Describe the solution service provider’s incident response protocol.

4.33. How is the County’s data segmented from other customers that may use the proposed solution, including whether architecture is multi-tenant or single-tenant?

4.34. Does the solution service provider provide security event detection and audit logging?

4.35. Describe data retention and deletion policies to inactive accounts.

4.36. Describe up-time guarantees and Service Level Agreement (SLA) terms for proposed solution.

4.37. Does the solution service provider outsource any aspect of the service portal or technology component of the proposed system to a third party? If so, describe how data is shared and if third-party service providers comply with service provider’s security standards.

4.38. If third parties are used as noted in 4.37, how does service provider audit the services provided?

5. Software system and maintenance (Section 5 questions are addressed in Exhibit B – Functional Requirements)

• The service provider will provide Gwinnett County with admin-level read-only access to the system to be able to review account information, payment information, and transaction history to help resolve disputes that are escalated to County staff.

RP013-26 Page 7

• Maintain all data and documents related to license applications, active licenses, and closed licenses in software system maintained by the service provider, to include the following information:

o STR owner name, email, phone number, and address o STR Local Agent name, email, phone number, and address o Location of the STR o Location of other STR within Gwinnett currently owned by the STR owner o Each code violation provided to the service provider by the department that could be grounds for license denial, suspension, or revocation o All documents and form information required to be submitted with the license application and renewals

• All data will be owned by Gwinnett County and should be made available upon request within 48 hours in .csv format.

• The software system should be cloud hosted, include regular backups and redundancy to prevent loss of data, and meet security requirements in Exhibit A - Security Requirements for Purchases.

• Identify the need for workstations on the Gwinnett County network to access the proposed SaaS solution. This may involve firewall access.

6. Regular Reporting

• Provide a monthly report to include the following for the month and year-to-date:

o New license applications received o New licenses issued o License renewals received o License renewals issued o Average days to issue a new license o Average days to renew a license o Average days to respond to an email or phone call o Average days to respond to a new license or renewal application o Average phone hold time o Total revenue collected o New license revenue collected o License renewal revenue collected o Late fee revenue collected o Violation and expiration reporting o 60-day upcoming expiration notifications o Complaint history and multiple offender properties o Outstanding unrenewed licenses, to include total number and detail

B. Short-Term Rental Monitoring and Trends Analysis

The selected service provider will ensure STR owners comply with the County’s Short-Term Rental Ordinance by actively monitoring STR locations throughout unincorporated Gwinnett. The selected service provider will be expected to perform the following services:

1. Develop, deploy, and maintain tools that actively monitor all major STR platforms online to identify STR locations within Gwinnett. Verify which STR identified through this process has/have an active license.

RP013-26 Page 8

2. Reach out to the property owner by phone and mail to inform them of the County’s licensing requirement. If no response is received within 30 days, another letter will be sent, and the issue will be escalated to Gwinnett County Code Enforcement via email.

3. Maintain a map-based interactive tool County staff may access that shows all licensed and unlicensed STR locations in unincorporated Gwinnett. The map should clearly display the address and parcel of the locations and outline municipal boundaries and Commission districts. The department will provide the service provider with parcel-level data on municipal boundaries and Commission districts.

3.0 PROPOSAL CONTENT

The proposal should outline the service provider’s proposed approach to accomplish the scope of work described, their organizational qualifications, experience, project management approach, and team members expected to lead this project. Service providers are asked to read this document carefully to ensure that they address the specific requirements of this request and submit all requested information.

Proposal packages should include the following information:

1. Technical Approach and Exhibit B – Functional Requirements (40 Points) A description of how the service provider will accomplish the scope of work described above, to include information on staffing, software, established processes, and quality assurance protocols to ensure efficient and effective customer service and support.

2. Service Provider Experience (25 Points) Describe service provider’s experience managing similar programs with other jurisdictions. Describe the volume of activity in those jurisdictions and how service provider has worked to implement effective processes and overcome challenges with implementing a new STR licensing program. The service provider should also provide an estimated number of short-term rentals they anticipate will obtain a license annually.

3. Project Management Approach and Team Qualifications (15 Points) Describe how the project will be managed, who will lead the project, and their qualifications relative to this project.

4. References (10 Points) Provide at least three (3) references (including names, addresses, phone numbers, and relevant projects) that demonstrate successful multidisciplinary work for government, institutional, or corporate entities. References should reflect the work of individuals proposed in the submission. Please notify your references that Gwinnett County will be contacting them and confirm that their contact information is current.

5. Cost (15 Points) Provide a flat cost per license/renewal that the service provider will assess for all short-term rentals that will cover the cost of the services outlined in this Request for Proposal.

Cost Proposals should be submitted in a separate sealed envelope and not with Technical Proposal.

RP013-26 Page 9

6. Optional Interview (10 Points) At the discretion of the Evaluation Committee, interviews may be requested to offer a brief explanation of the service provider’s services and how they will provide these services for the County. All costs associated with the interview (if required) will be at the expense of the proposing service provider.

Review and Rating of Evaluation Criteria

A selection committee will evaluate all responses to this Request for Proposals. Proposals will be evaluated based on the quality of responses to the requirements of this request. The evaluation criteria are outlined below with weighted values as shown. Gwinnett County reserves the right to reject any or all proposals, in whole or in part; to negotiate changes in the scope of services; and to waive any technicalities as deemed in its best interest.

Phase I Criteria Points

1 Technical Approach and Exhibit B – Functional Requirements 40

2 Service Provider Experience 25

3 Project Management Approach and Team Qualifications 15

4 References 10 Phase I Subtotal 90

Phase II 5 Cost 15

Phases I and II Subtotal 105 Phase III

6 Optional Interview 10 Maximum Total 115

Phase I – Initially, proposals will be evaluated based on relative responsiveness to the criteria described above and will be scored based on the point values as shown. Please note that references and subsequent reference checks are a required component of Phase I scoring. The selection committee may then shortlist the highest scoring service provider(s) to Phase II.

Phase II – The Cost Proposals of the short-listed service providers from Part I will be opened, reviewed, and scored, with the lowest cost receiving the most points and the other service providers receiving proportional points based on the differences in proposal costs. The highest scoring service provider may be selected at this point, or the committee may invite a number of the highest scoring service provider(s) to interview. The number of service providers shortlisted and interviewed, if any, will be at the discretion of the selection committee.

Phase III - If Phase III is deemed necessary for selection, interviews and evaluation will be performed and will be worth an additional 0-10 points in the selection process. The number of service providers shortlisted and interviewed will be at the discretion of the selection committee.

The service provider will be responsible for any cost associated with the request for an interview.

If unable to reach an agreement with the highest scoring service provider, the County may then negotiate with the second-ranked service provider and so on, until a satisfactory agreement has

RP013-26 Page 10 been reached, or the County may terminate the negotiation process, or make a recommendation of award to the Purchasing Division.

4.0 PROPOSAL REQUIREMENTS

The proposal response shall provide information necessary for the County to evaluate the qualifications, experience, and expertise of the service provider to provide the requested functionality and services.

The service provider is to make a written proposal that presents an understanding of the work to be performed. The proposal is to demonstrate and provide evidence that the service provider has the capabilities, professional expertise, and experience to provide the necessary services as described in this solicitation. The service provider is to ensure that all information required herein is submitted with the proposal. An authorized representative of the service provider shall sign the proposal.

To enhance the evaluation process and provide each service provider with an equal opportunity for consideration, all service providers should adhere to a standardized technical proposal format outlined in this proposal. Responses are to be as thorough and detailed as possible so that the County may properly evaluate the service provider’s capabilities to provide the required services. Responses must be received in both electronic and written formats. Submit all electronic files on a virus-free USB drive.

Elaborate brochures or presentations beyond what is needed for a complete and effective proposal will not be considered and are discouraged. Elaborate artwork, expensive paper, visual and other presentation aids are not required. Service providers are to respond clearly and concisely to all questions without referring to preprinted materials (unless the proposal specifically requests the service provider to do so) as a response.

Service providers are encouraged to submit clear and concise responses, and excessive length or extraneous information is discouraged. To help the County evaluate and select a service provider, please address the specific issues requested in this solicitation. Submission of excessive “boilerplate” information, including sales brochures, is discouraged. Proposers should not submit website links in lieu of written responses. Website links and any information contained within may not be reviewed or considered by the County.

RP013-26 Page 11

Exhibit A. Security Requirements for Purchases

Hardcopies are considered to be “Uncontrolled Documents”

Document #:

Effective Date:

Review Date:

Revision Date:

Approved By: Dorothy Parks, CIO / Department Director ITS

Reviewed By: Matthew Puckett, Chief Information Security Officer

Security Requirements for Purchases Standard

1.0 OVERVIEW

The purpose of this document is to outline requirements for software and services to ensure that the County’s security needs are covered. Deviations from this document should be discussed with Security before moving forward with a purchase.

2.0 SCOPE

This standard applies to purchases of software, hardware and services which will do any of the following:

• Connect to the County network

• Be installed on County owned IT assets

• Store County owned data

Regardless of the amount of support provided by the Department of Information Technology Services (DoITS)

3.0 STANDARD

This document is broken down into sections and a single purchase may qualify for multiple sections. For example, a cloud service dealing with sensitive data needs to meet requirements in both sections under Cloud Services, and the All Contracts section.

Note that requirements which use the term “should” are more flexible but should be discussed with the Security team before deviation. Requirements that use the term “must” or “shall” are not considered optional.

3.1 Cloud Services

1. All cloud services

a. Services should utilize Active Directory for authentication and be compatible with the

Microsoft Multi-Factor Authentication solution.

RP013-26 Page 12

b. The service should log detailed audit events and make these logs continuously available for ingestion by a Security Information and Event Management system (SIEM) without the need to manually download or transfer data.

2. Cloud based services which store sensitive data as defined by Georgia law, data regulated by CJIS, HIPAA or PCI in addition to the requirements established by those regulations and those stated above for all cloud services:

a. All County owned data must be stored within the United States.

b. Vendors which are storing data must provide a SOC 2 Type 2 report with an Unqualified opinion.

c. The requirement 1a above relating to authentication is mandatory.

d. The requirement 1b above relating to audit event logging is mandatory.

3.2 On-premise solutions (Windows)

1. All On-premise solutions

a. Must be capable of performing on systems with the County ITS approved Anti-Virus solution with minimal exceptions. Heuristic scanning must be enabled.

b. Must be capable of performing on systems with the ITS approved Vulnerability Scanning agent installed and configured for a weekly scan.

c. Must be architected in such a way that security updates can be applied while still meeting customer Department expectations for availability.

d. Should log detailed audit events and make these logs continuously available for ingestion by a SIEM without the need to manually download or transfer data.

e. Internal applications should utilize Active Directory for authentication.

f. Public / Internet facing applications must utilize Active Directory for authentication and be compatible with the Microsoft Multi-Factor Authentication solution. This requirement is not intended to apply to logins by County residents.

g. Must be compatible with currently supported versions of Microsoft Windows Server, with a minimum version of n-1 from latest.

2. On-premise solutions which store sensitive data as defined by Georgia law, data regulated by CJIS, HIPAA or PCI in addition to the requirements established by those regulations and those stated above:

a. Requirement 1d above relating to audit event logging is mandatory.

b. Requirement 1f above relating to Active Directory and Microsoft MFA is mandatory.

c. Should ideally have compatibility with Symantec’s Data Loss Prevention solution to identify and classify data.

d. Must be compatible with the County’s data encryption solution (Vormetric).

3.3 Contracts

1. All contracts should address the points below. Requirements shall apply to vendors and any sub-contractors.

a. Vendors must notify Gwinnett within 24 hours in writing if they or a sub-contractor experience security breaches which involve:

RP013-26 Page 13

i. County owned data, accounts, or systems

ii. Systems that are compromised while they are connected to the County network, including over VPN regardless of ownership.

iii. Any other circumstance which can reasonably be expected to negatively impact the County’s security posture.

b. Vendor may not provide County owned data to any third parties unless explicitly authorized. This includes network diagrams and system information.

c. Unless it would violate other legal requirements or is otherwise authorized, vendors should delete County owned data at the termination of the agreement.

d. Vendors shall promptly report observed security vulnerabilities to the County IT department.

e. Vendor must perform background checks on any employees that will be accessing sensitive County data and be willing to produce evidence as such if requested. Sensitive data refers to PII as defined by Georgia law, any data regulated by PCI, HIPAA, CJIS or any other legal requirements.

f. Any required support from the vendor should match the expectations placed on ITS. For example, applications which are expected to be available 24/7 should have 24/7 support.

2. Contracts which include services where the vendor will access County owned systems including the VPN should address the following conditions:

a. Any changes to County owned systems must be done in accordance with the DoITS Change Management Policy

b. Vendor must agree to turn over any relevant passwords on request. This requirement is for shared resources / accounts, and not individual users. For example, password protected documents, administrator accounts not tied to a specific user or service accounts.

c. Vendor must agree to accept as-is all applicable County policies.

d. Any systems used to perform services for the County must run an operating system currently supported by the vendor, have all security patches installed, and Windows systems must run anti-virus software.

e. Connections to the County VPN require the use of Multi-Factor Authentication.

f. The County provided VPN solution is only approved method for remotely accessing the

County network.

g. For personnel with access to County resources, the County should be notified in advance of employee terminations or re-assignment so that access can be terminated.

Notification must be within 24 hours for unplanned changes.

h. The vendor must respond to requests by the County to validate user access lists within 10 business days.

i. Vendor will not transfer County data to non-County owned systems unless authorized to do so are part of providing services. Data transferred must be protected according to industry best practices. At a minimum this includes disk encryption on all portable systems which store County data.

j. Vendor personnel shall not delete, disable, or bypass any encryption, anti-virus or other security software installed on Gwinnett County systems without approval from the Security team.

RP013-26 Page 14

k. Vendor personnel shall execute only applications that pertain to their specific contract work.

l. The County is not liable for any damages to the vendor computer equipment that may occur while installing or using software or hardware connected to any County systems.

m. Vendor personnel may not copy any data and/or software from any County resource for personal use.

n. Vendor personnel are prohibited from intercepting or monitoring network traffic by any means, including the use of network sniffers, unless authorized in writing by the Gwinnett County IT Department.

3. Contracts which include services where the vendor will access sensitive data as defined by Georgia law, data regulated by CJIS, HIPAA or PCI in addition to the requirements established by those regulations and those stated above:

a. May only be accessed by individuals in the United States.

GOVERNANCE

This standard has been defined by the Chief Information Officer of Gwinnett County and the Department of Information Technology. The standard shall become effective immediately upon approval and shall remain in effect until superseded by another standard or revised as business needs dictate.

RP013-26 Page 15

FAILURE TO RETURN THIS PAGE AS PART OF YOUR PROPOSAL DOCUMENT MAY RESULT IN

REJECTION OF PROPOSAL.

REFERENCES

Gwinnett County requests a minimum of three (3) references where work of a similar size and scope has been completed within the last five (5) years.

Note: References should be customized for each project, rather than submitting the same set of references for every project bid. The references listed should be of similar size and scope of the project being bid on. Do not submit a project list in lieu of this form.

1. Company Name

Brief Description of Project

Completion Date

Contract Amount $ Start Dates

Contact Person Telephone

E-Mail Address

2. Company Name

Brief Description of Project

Completion Date

Contract Amount $ Start Date

Contact Person Telephone

E-Mail Address

3. Company Name

Brief Description of Project

Completion Date

Contract Amount $ Start Date

Contact Person Telephone

E-Mail Address

SERVICE PROVIDER NAME

RP013-26 Page 16

SERVICE PROVIDER INFORMATION

(This page should be included as part of the technical proposal and NOT with the Cost Proposal)

Certification Of Non-Collusion in Proposal Preparation Signature Date

The services to be performed under this Agreement shall commence upon final approval by the Board of Commissioners. The initial term of this Agreement shall be through December 31, 2026. This Agreement shall terminate absolutely and without further obligation on the part of the County at the close of the calendar year of execution and at the close of each succeeding calendar year of renewal, if renewed. This Agreement shall be automatically renewed upon the same terms and conditions unless the County terminates the Agreement on the day of the close of the calendar year in which it was executed or within sixty (60) days after the day of the close of the calendar year of execution or of each succeeding calendar year for which it may be renewed, for a total lifetime obligation of five (5) years. If applicable, title to any supplies, materials, equipment or other personal property shall remain in the vendor until fully paid for by the County. In addition, this Agreement will terminate immediately and absolutely when appropriated and otherwise unobligated funds are no longer available to satisfy the obligations of the County under the Agreement. Any obligation of the County hereunder is only for such sums payable during the calendar year of execution or each calendar year of renewal, if renewed.

The undersigned acknowledges receipt of the following addenda, listed by number and date as issued appearing on each:

Addendum No. Date Addendum No. Date

In compliance with the attached specifications and the Instructions for Vendors, the undersigned acknowledges all requirements outlined in the "Instructions for Vendors" and all documents referred to therein, offers and agrees, if this proposal is accepted by the Board of Commissioners within one hundred twenty (120) days of the date of proposal opening, to furnish any or all of the items upon which prices are quoted, at the price set opposite each item, delivered to the designated point(s) within the time specified in the fee schedule. By submission of this proposal, I understand that Gwinnett County uses Electronic Payments for remittance of goods and services. Vendors should select their preferred method of electronic payment upon notice of award. For more information on electronic payments, please refer to the Electronic Payment information in the Instructions for Vendors.

Legal Business Name

Address

Does your company currently have a location within Gwinnett County? Yes No

Representative Signature Printed Name

Telephone Number E-mail Address https://www.gwinnettcounty.com/government/departments/financial-services/treasury

RP013-26 Page 17

COST PROPOSAL

(TO BE SUBMITTED IN A SEPARATE SEALED ENVELOPE.)

YEAR 1

Item # Services Pricing

1 Flat rate per license/renewal

$_____________/license or renewal

YEAR 2

YEAR 3

YEAR 4

YEAR 5

SERVICE PROVIDER NAME

RP013-26 Page 18

GENERAL CONDITIONS

To Service Provider AGREEMENT

Article

1 Definitions

2 Contract Documents

3 Changes and Extra Work

4 Personnel and Equipment

5 Accuracy of Work

6 Findings Confidential

7 Termination of Agreement for Cause

8 Termination for Convenience of the COUNTY

9 SERVICE PROVIDER to Cooperate with other SERVICE PROVIDERS

10 Indemnification

11 Covenant Against Contingent Fees

12 Insurance

13 Prohibited Interests

14 Subcontracting

15 Assignability

16 Equal Employment Opportunity

17 Anti-Kickback Clause

18 Audits and Inspectors

19 Ownership, Publication, Reproduction and Use

20 Verbal Agreement or Conversation

21 Independent Service provider

22 Notices

RP013-26 Page 19

1 DEFINITIONS

Wherever used in this Agreement, whether in the singular or in the plural, the following terms shall have the following meanings:

1.1 COUNTY-means Gwinnett County, Georgia, a political subdivision of the State of Georgia.

1.2 SUPPLEMENTAL AGREEMENT-means a written order to SERVICE PROVIDER signed by COUNTY and accepted by SERVICE PROVIDER, effecting an addition, deletion or revision in the Work, or an adjustment in the Agreement Price or the Contract Time, issued after execution of this Agreement.

1.3 CONTRACT-means the Agreement Documents specifically identified and incorporated herein by reference in Section 2, CONTRACT DOCUMENTS.

1.4 AGREEMENT EXECUTION-means the date on which SERVICE PROVIDER executes and enters into an Agreement with the COUNTY to perform the Work.

1.5 AGREEMENT PRICE-means the total monies, adjusted in accordance with any provision herein, payable to the SERVICE PROVIDER under this Agreement.

1.6 CONTRACT TIME-means the period of time stated in this Agreement for the completion of the Work.

1.7 SERVICE PROVIDER-means the party or parties contracting directly with the COUNTY to perform Work pursuant to this Agreement.

1.8 DEPARTMENT- means the Director or designee of requesting department(s) named in this solicitation.

1.9 DRAWINGS-means collectively, all the drawings, receipt of which is acknowledged by the COUNTY, listed in this Agreement, and also such supplementary drawings as the SERVICE PROVIDER may issue from time to time in order to clarify or explain such drawing or to show details which are not shown thereon.

1.10 SPECIFICATIONS-means the written technical provisions including all appendices thereto, both general and specific, which form a part of the Agreement Documents.

1.11 SUBSERVICE PROVIDER-means any person, firm, partnership, joint venture, company, corporation, or entity having a contractual agreement with SERVICE PROVIDER or with any of its subservice providers at any tier to provide a part of the Work called for by this Agreement.

1.12 WORK-means any and all obligations, duties and responsibilities, including furnishing equipment, engineering, design, workmanship, labor and any other services or things necessary to the successful completion of the Project, assigned to or undertaken by SERVICE PROVIDER under this Agreement.

RP013-26 Page 20

1.13 LIAISON-Representative of the COUNTY who shall act as Liaison between the County and the SERVICE PROVIDER for all matters pertaining to this Agreement, including review of SERVICE PROVIDER'S plans and work.

2 CONTRACT DOCUMENTS

2.1 LIST OF DOCUMENTS

The Agreement, any required bonds, the General Conditions, the Appendices, the Detailed Scope of Work, the Specifications, the Drawings, the Exhibits, and all Agreement Supplemental Agreements shall constitute the Agreement Documents.

2.2 CONFLICT AND PRECEDENCE

2.2.1 The Agreement Documents are complementary, and what is called for by one is as binding as if called for by all. In the event there are any conflicting provisions or requirements in the component parts of this Agreement, the several Agreement Documents shall take precedence in the following order:

1. Supplemental Agreements

2. Agreement

3. General Conditions

4. Detailed Scope of Work

5. Specifications

6. Drawings

3 CHANGES AND EXTRA WORK

The COUNTY may, at any time, request changes in the work to be performed hereunder. All such changes, including any increase or decrease in the amount of the SERVICE PROVIDER'S compensation, which are mutually agreed upon by and between the COUNTY and the SERVICE PROVIDER, shall be incorporated in written Supplemental Agreements to the Agreement.

4 PERSONNEL AND EQUIPMENT

The SERVICE PROVIDER represents that it has secured or will secure, at its own expense, all personnel necessary to complete this Agreement; none of whom shall be employees of, or have any contractual relationship with, the COUNTY. Primary liaison with the COUNTY will be through its designee. All of the services required hereunder will be performed by the SERVICE PROVIDER under its supervision, and all personnel engaged in the work shall be fully qualified and shall be authorized or permitted under law to perform such services.

RP013-26 Page 21

The SERVICE PROVIDER shall employ only persons duly registered in the appropriate category in responsible charge of supervision and design of the work; and further shall employ only qualified surveyors in responsible charge of any survey work.

The SERVICE PROVIDER shall endorse all reports, contract plans, and survey data. Such endorsements shall be made by a person duly registered in the appropriate category by the Georgia State Board of Registration, being in the full employ of the SERVICE PROVIDER and responsible for the work prescribed by this Agreement.

5 ACCURACY OF WORK

The SERVICE PROVIDER shall be responsible for the accuracy of the work and shall promptly correct errors and omissions in its plans and specifications without additional compensations.

Acceptance of the work by the COUNTY will not relieve the SERVICE PROVIDER of the responsibility for subsequent correction of any errors and the clarification of any ambiguities.

6 FINDINGS CONFIDENTIAL

The SERVICE PROVIDER agrees that its conclusions and any reports are for the confidential information of the COUNTY and that it will not disclose its conclusions in whole or in part to any persons whatsoever, other than to submit its written documentation to the COUNTY, and will only discuss the same with it or its authorized representatives. Upon completion of this Agreement term, all documents, reports, maps, data and studies prepared by the SERVICE PROVIDER pursuant thereto shall become the property of the COUNTY and be delivered to the DEPARTMENT.

Articles, papers, bulletins, reports, or other materials reporting the plans, progress, analyses, or results and findings of the work conducted under this Agreement shall not be presented publicly or published without prior approval in writing of the COUNTY.

It is further agreed that if any information concerning the PROJECT, its conduct, results, or data gathered or processed should be released by the SERVICE PROVIDER without prior approval from the COUNTY, the release of same shall constitute grounds for termination of this Agreement without indemnity to the SERVICE PROVIDER, but should any such information be released by the COUNTY or by the SERVICE PROVIDER with such prior written approval, the same shall be regarded as public information and no longer subject to the restrictions of this Agreement.

7 TERMINATION OF AGREEMENT FOR CAUSE

If through any cause the SERVICE PROVIDER shall fail to fulfill in a timely and proper manner its obligations under this Agreement, or if the SERVICE PROVIDER shall violate any of the covenants, agreements or stipulations of this Agreement, the COUNTY shall thereupon have the right to terminate this Agreement by giving written notice to the SERVICE PROVIDER of such termination, and specifying the effective date thereof, at least ten (10) days before the effective date of such termination. Failure to maintain the scheduled level of effort as proposed and prescribed, or deviation from the aforesaid scheduler without prior approval of the COUNTY shall constitute cause for termination. In such event, all finished or unfinished documents, maps, data, studies, work papers and reports prepared by the SERVICE PROVIDER under this Agreement shall become

RP013-26 Page 22 the property of the COUNTY, and the SERVICE PROVIDER shall be entitled to receive just and equitable compensation for any satisfactory work completed on such documents, as determined by the COUNTY.

8 TERMINATION FOR CONVENIENCE OF THE COUNTY

The COUNTY may terminate this Agreement for its convenience at any time upon 30 days notice in writing to the SERVICE PROVIDER. If the Agreement is terminated by the COUNTY as provided in this Article 8, the SERVICE PROVIDER will be paid compensation for those services actually performed. Partially completed tasks will be compensated for based on a signed statement of completion to be submitted by the SERVICE PROVIDER which shall itemize each task element and briefly state what work has been completed and what work remains to be done.

All such expenses shall be properly documented and submitted to the COUNTY for processing and payment. The County shall be the final authority in the event of any disputes over authorized costs between the COUNTY and the Service Provider.

9 SERVICE PROVIDERS TO COOPERATE WITH OTHER SERVICE PROVIDERS

If the COUNTY undertakes or awards other contracts for additional related work, the SERVICE PROVIDER shall fully cooperate with such other SERVICE PROVIDERS and the COUNTY employees or appointed committee(s), and carefully fit its own work to such additional work as may be directed by the COUNTY. The SERVICE PROVIDER shall not commit or permit any act which will interfere with the performance of work by any other SERVICE PROVIDER or COUNTY employees.

10 INDEMNIFICATION

SERVICE PROVIDER agrees to protect, defend, indemnify, and hold harmless the COUNTY, its commissioners, officers, agents and employees from and against any and all liability, damages, claims, suits, liens, and judgments, for whatever nature, including claims for contribution and/or indemnification, for injuries to or death of any person or persons, or damage to the property or other rights of any person or persons to the extent arising out of and attributed to the negligent acts, errors or omissions of the SERVICE PROVIDER.