S000000251 MAP RFP AIRS Maintenance and Support.pdf

STATE OF ARKANSAS

DEPARTMENT OF TRANSFORMATION AND SHARED SERVICES

OFFICE OF STATE PROCUREMENT

501 Woodlane St., Ste. 220

Little Rock, Arkansas 72201-1023

REQUEST FOR PROPOSAL (MAP)

SOLICITATION DOCUMENT

SOLICITATION INFORMATION

Solicitation Number: S000000251 Solicitation

Issued: June 23, 2023

Description: Technical Resources for Support and Enhancement of the Arkansas Integrated Revenue Systems (AIRS) (AIRS-Tax and AIRS-DSMV)

Department: Department of Finance and Administration Revenue

SUBMISSION DEADLINE AND DELIVERY OF RESPONSE DOCUMENTS

Proposal Opening Date: July 21, 2023 Proposal Opening Time: 1:00 PM, Central Time

Proposal submissions for this Request for Proposal must be submitted through ARBuy, the State’s eProcurement system. It can be accessed at https://arbuy.arkansas.gov. Proposals received after the submission deadline may be rejected as untimely. See Section 1.2 for information regarding Live Proposal Openings.

TSS OFFICE OF STATE PROCUREMENT CONTACT INFORMATION

TSS OSP Buyer: Tiffany Maddox Buyer’s Direct Phone Number: 501-324-9320

Email Address: Tiffany.Maddox@arkansas.gov TSS OSP’s Main Number: 501-324-9316

TSS OSP

Website: https://www.transform.ar.gov/procurement/ https://arbuy.arkansas.gov/ https://www.transform.ar.gov/procurement/

SECTION 1 – GENERAL INFORMATION AND INSTRUCTIONS

1.1 INTRODUCTION

This Request for Proposal (RFP) is issued by the TSS Office of State Procurement (TSS OSP) for the Department of Finance and Administration Revenue Tax and Driver Services Motor Vehicle (DFA AIRS) to obtain pricing and a contract for the support and enhancement of the Arkansas Integrated Revenue Systems (AIRS), which is comprised of two separate systems: AIRS-Tax and AIRS-DSMV. This contract will be in addition to the licensing and software maintenance contract for the GENTAX and the DSVS platforms.

Contract(s) awarded will be made to the Prospective Contractor determined to have submitted the proposal that is the most advantageous to the State. Direct all questions, comments, or concerns you may have regarding this solicitation to the TSS OSP, not the Department.

1.2 LIVE PROPOSAL OPENING

Use the information below to view the proposal opening online.

Teams Meeting Link: Click here to join the meeting Meeting ID: 230 315 738 160 Passcode: VQ3FBp Call in (audio only): +1 501-244-3310 Phone conference ID: 320 463 118#

1.3 TYPE OF CONTRACT

A. As a result of this RFP, TSS OSP intends to award a contract to a single Contractor. The Contract shall be a Firm Fixed Price contract in order to provide maximum incentive for the awarded Contractor to control costs and meet and/or exceed performance expectations.

B. The anticipated starting date for any resulting contract is October 1, 2023, except that the actual contract start date may be adjusted unilaterally by the State for up to three (3) calendar months. By submitting a signed proposal in response to the RFP, the Prospective Contractor represents and warrants that it will honor its proposal as being held open as irrevocable for this period.

C. The initial term of a resulting contract will be for three (3) years. Upon mutual agreement by the Contractor and Department, the contract may be renewed by TSS OSP for up to four (4) additional one-year terms or portions thereof, not to exceed a total aggregate contract term of seven (7) consecutive years.

1.4 SOLICITATION SCHEDULE

For informational purposes, TSS OSP is providing a Solicitation Schedule; however, dates listed and noted with an asterisk (*) are anticipated dates only and are subject to change at the discretion of the State. All times are listed in Central Time.

TABLE A: TENTATIVE SOLICITATION SCHEDULE [Dates are provided for reference]

ACTIVITY DATE

RFP Release to Prospective Contractors 06/23/2023 Bidders Conference 06/28/2023 @ 10 am Deadline for Prospective Contractor Questions 07/02/2023 Answers to Questions Posted to ARBuy* 07/07/2023 Proposal Due Date 07/21/2023 @ 1 pm Initial Proposal Evaluation* 07/25-07/31/2023 Interviews* 08/03-08/04/2023 Final Proposal Evaluation* 08/04/2023 https://teams.microsoft.com/l/meetup-join/19%3ameeting_Mjg5ZTM3YzAtNzhmYS00NjY2LTg0NDgtMjQzYWU5NWQyODI1%40thread.v2/0?context=%7b%22Tid%22%3a%225ec1d8f0-cb62-4000-b327-8e63b0547048%22%2c%22Oid%22%3a%229e90e135-bbe1-4767-b7b7-ba808ff42eae%22%7d

Discussions Kick Off Meeting* 08/09/2023 Finalize Discussions* 08/23/2023 Post Anticipation to Award* 08/23/2023 Award Contract* October 1, 2023

1.5 BIDDERS CONFERENCE

A. TSS OSP will host a bidders conference to provide additional information and clarification regarding the RFP.

1. The conference will take place on the date and time listed in Section 1.4, Table A.

2. The conference is important for Prospective Contractors to understand the tasks a Prospective Contractor shall complete when submitting a proposal (“Submission Requirements”).

3. Prospective Contractors may attend the conference via Teams.

Teams Meeting Link: Click here to join the meeting Meeting ID: 210 434 747 821 Passcode:7RXTcx Call in (audio only): +1 501 244 3310 Phone conference ID: 449 362 532#

4. The bidders conference presentation will be posted to the Solicitation posting in ARBuy.

1.6 CLARIFICATION OF SOLICITATION

A. Submit questions requesting clarification of information contained in this Solicitation via the

Solicitation posting in ARBuy by the date and time listed in Section 1.4, Table A.

1. For each question submitted, Prospective Contractor should reference the specific Solicitation item number to which the question refers.

2. Prospective Contractors’ written questions will be consolidated and responded to by the State as deemed appropriate. The State’s consolidated written response is anticipated to be posted to the Solicitation posting in ARBuy by the close of business on the date provided in Section 1.4, Table A. If Prospective Contractor questions are unclear or non-substantive in nature, the State may request clarification of a question(s) or decline to answer.

B. The Prospective Contractor should notify the TSS OSP Procurement Specialist of any term, condition, etc., that precludes the Prospective Contractor from submitting a compliant, Responsive Proposal. Prospective Contractors should note that it is the responsibility of the Prospective Contractor to seek resolution of all such issues, including those relating to the terms and conditions of the contract, prior to the submission of a proposal.

C. Prospective Contractors may contact the TSS OSP Procurement Specialist with non-substantive questions at any time prior to the proposal opening.

D. An oral statement by TSS OSP will not be part of any contract resulting from this Solicitation and may not reasonably be relied on by any Prospective Contractor as an aid to interpretation unless it is reduced to writing and expressly adopted by TSS OSP.

E. Only an addendum written and authorized by the State will modify the Solicitation.

1. An addendum posted within three (3) calendar days prior to the proposal opening may extend the proposal opening and may or may not include changes to the Solicitation.

1.7 DEFINITION OF TERMS

A. Unless otherwise defined herein, all terms defined in Arkansas Procurement Law have the same meaning herein.

https://teams.microsoft.com/l/meetup-join/19%3ameeting_NjI3YjM1MzYtMTRjZi00MmI4LTkxYjItMTNhNWVmNTdiMTA5%40thread.v2/0?context=%7b%22Tid%22%3a%225ec1d8f0-cb62-4000-b327-8e63b0547048%22%2c%22Oid%22%3a%229e90e135-bbe1-4767-b7b7-ba808ff42eae%22%7d

B. “Contract” means a contract awarded to a Prospective Contractor as a result of this RFP.

C. “Contractor” means a person or company awarded a contract by the State to perform services as a result of this RFP.

D. “Cybersecurity Incident” means any compromise of the security, confidentiality, or integrity of an information system maintained by DFA Revenue, a contractual provider of an information system that contracts with DFA Revenue, or other computer-related services of DFA AIRS, that is caused by any unauthorized:

1. Access to an information system of DFA AIRS

2. Destruction of an information system of DFA AIRS or the data of an information system of DFA

AIRS

3. Acquisition of data or loss of data from an information system of DFA AIRS

E. “Enhancements” means a perfective activity that enhances both the function and efficiency of the code and changing the functionalities of the system as per the users’ changing needs.

F. “Maintenance” means modifications of the system after implementation in order to correct errors and monitor and adjust performance to maximize the security and efficiency of the system.

G. “Operations” means the day-to-day system management responsibility for IT infrastructure such as data center, client/desktop, or connectivity/network.

H. “Prospective Contractor” means a responsible offeror who submits a proposal in response to this solicitation.

I. The terms “Request for Proposal,” “RFP,” and “Solicitation” are used synonymously in this document.

J. “Requirement” means something required.

K. “Responsive Proposal” means a proposal submitted in response to this solicitation that conforms in all material respects to this RFP.

L. “Services” means the furnishing of labor, time, or effort by a contractor to meet the requirements of this RFP.

M. “Shall” and “Must” mean the imperative and are used to identify requirements.

N. “Specification” means any technical or purchase description or other description of the physical or functional characteristics, or of the nature, of a commodity or service. “Specification” may include a description of any requirement for inspecting, testing, or preparing a commodity or service for delivery.

O. “State” means the State of Arkansas. When the term “State” is used herein to reference any obligation of the State under a contract that results from this solicitation, that obligation is limited to the Department using such a contract.

P. “Subcontractor” means a person or entity that has been engaged by the Contractor to perform work or services for a contract that has been awarded between the State and the Contractor and is not an employee of the Contractor.

Q. “Support” means technical and functional help to users of the system.

1.8 RESPONSE DOCUMENTS

A. All proposal responses must be submitted through ARBuy, the State’s eProcurement system. The system can be accessed at arbuy.arkansas.gov.

1. Prospective Contractors must be registered in ARBuy to submit proposals responses.

B. Technical Proposal Packet https://arbuy.arkansas.gov/

1. Responses within the Information for Evaluation and Exceptions sections must not contain the Prospective Contractor’s name or any other identifiers, including without limitation names of staff members, projects, clients, products, and addresses.

2. Prospective Contractors shall utilize the Technical Proposal Packet to submit their responses.

3. The following items are proposal Submission Requirements and must be submitted as part of a Prospective Contractor’s proposal response.

a. Signed Proposal Signature Page; signature may be ink or digital

b. Technical Proposal response to the Information for Evaluation section included in the Technical Proposal Packet, which must be in the English language

c. Completed Pricing Response: Official Solicitation Price Sheet attached to the Solicitation posting in ARBuy.

i. Pricing must be proposed in U.S. dollars and cents.

ii. Quantities stated are estimates only and are not guaranteed. Prospective Contractor must submit unit price on the estimated quantity and unit of measure specified.

iii. If pricing documents do not allow for accurate pricing, Prospective Contractor should notify the OSP Procurement Specialist at least seventy-two (72) hours before the proposal opening time.

iv. Prices must be firm offers and adjustments may be negotiated at the time of contract renewal..

• A request for a price increase must include supporting documentation demonstrating that the increase in contract price is based on an increased cost to the Contractor and that the proposed pricing is still competitive in the marketplace. The State has the right to approve or deny any request for a price adjustment.

v. Discount from list pricing is not acceptable unless requested elsewhere in the Solicitation.

vi. State or local sales taxes should not be included in the price. Trade discounts should be deducted from the unit price and the net price should be shown in the Pricing Response.

d. Recommended Options Form

i. The Recommended Options form included in the Technical Proposal Packet allows Prospective Contractors to identify any recommended options or optional service ideas that may benefit the State that were not included in the Requirements and the proposed solution.

e. Copy of Prospective Contractor’s Equal Opportunity Policy

i. Pursuant to Arkansas Code Annotated § 19-11-104, OSP requires a Prospective Contractor bidding on a state contract to submit a copy of the Prospective Contractor’s Equal Opportunity (EO) Policy.

ii. Prospective Contractors not required by law to have an EO Policy must submit a written statement to that effect.

f. Proposed Subcontractors Form (see SRV-1, section 14)

4. The following items, which must be submitted prior to a contract award to the Prospective Contractor, may also be included with the Prospective Contractor’s proposal:

a. EO 98-04: Contract and Grant Disclosure Form (see SRV-1, section 11)

b. Voluntary Product Accessibility Template (VPAT), if applicable https://www.transform.ar.gov/wp-content/uploads/Services-Contract-SRV-1-Fillable-Form-V.3.6.27.22.pdf https://www.transform.ar.gov/wp-content/uploads/Services-Contract-SRV-1-Fillable-Form-V.3.6.27.22.pdf https://www.section508.gov/sell/vpat/

5. Prospective Contractors should not include any other documents or ancillary information, such as a cover letter or promotional/marketing information.

C. Redacted copy of the Technical Proposal Packet

1. One (1) redacted (marked “REDACTED”) copy of the Prospective Contractor’s proposal response (see Proprietary Information)

D. Prospective Contractors should not alter language in Solicitation document(s) or Official Proposal Price Sheet provided by the State.

E. Prospective Contractor’s proposals cannot be altered or amended after the proposal opening except as permitted by law or rule.

F. Prospective Contractors may submit multiple proposals.

1.9 ACCEPTANCE OF REQUIREMENTS

A. A Prospective Contractor's past performance with the State may be used to determine if the

Prospective Contractor is responsible (OSP Rule R8:19-11-229).

1. Proposals submitted by Prospective Contractors determined to be non-responsible will be rejected.

B. A single Prospective Contractor must be identified as the prime contractor.

1. The prime Contractor shall be responsible for the resulting contract and jointly and severally liable with any of its subcontractors, affiliates, or agents to the State for the performance thereof.

C. By submission of a proposal, the Prospective Contractor represents and warrants:

1. That the prices in the proposal have been arrived at independently, without any collusion with another competing Prospective Contractor.

a. Collusion violates Arkansas Procurement Law and can lead to suspension, debarment, and can be referred to the Attorney General’s officer for investigation and appropriate legal action (Arkansas Code Annotated § 19-11-240 and 19-11-245).

2. That the Prospective Contractor has not retained a person to solicit or secure the resulting contract upon an agreement or understanding for a commission, percentage, brokerage, or contingent fee, except for retention of bona fide employees or bona fide established commercial selling agencies maintained by the Prospective Contractor for the purpose of securing business.

D. Prospective Contractor should not discuss the Solicitation or proposal response, issue statements or comments, or provide interviews to public media during the Solicitation and award process.

E. Qualifications and services must meet or exceed the required Specifications as set forth in the Solicitation.

F. The State will not pay costs incurred in the preparation of a proposal.

1.10 GENERAL TERMS AND CONDITIONS

A. The Contractor must be registered as a vendor to receive payment and may register online by visiting https://www.ark.org/contractor/index.html and clicking the Start Here button.

B. Pursuant to Arkansas State Procurement Law, the Contractor shall:

1. Certify that they do not employ or contract with illegal immigrants and shall not employ or contract with illegal immigrants during the aggregate term of a contract (for services contracts, Arkansas Code Annotated § 19-11-105).

2. Certify that they are not engaged in and shall not, during the aggregate term of the resulting contract, engage in a boycott of Israel (Arkansas Code Annotated § 25-1-503).

https://www.ark.org/contractor/index.html

C. To comply with the provision of Act 954 of 1977, relating to unfair employment practices, the Contractor:

1. Shall not discriminate against any employee or applicant for employment because of race, sex, color, age, religion, handicap, or national origin.

2. In all solicitations or advertisements for employees, shall state that all qualified applicants shall receive consideration without regard to race, color, sex, age, religion, handicap, or national origin.

3. Furnish such relevant information and reports as requested by the Human Resources Commission for the purpose of determining compliance with the statute.

4. Failure of the Contractor to comply with the statute, the rules and regulations promulgated thereunder, and this nondiscrimination clause shall be deemed a breach of contract and it may be cancelled, terminated, or suspended in whole or in part.

5. Shall include the provisions of above items (1) through (4) in every subcontract so that such provisions shall be binding upon such subcontractor or Contractor.

D. Specifications, drawings, technical information, dies, cuts, negatives, positives, data, other such item furnished by the State to the Contractor, or a combination thereof hereunder or in contemplation hereof or developed by the Contractor for use hereunder shall:

1. Remain property of the State.

2. Be kept confidential as permitted or required by law.

3. Be used only as expressly authorized.

4. Be returned at the Contractor's expense to the F.O.B. destination point provided by the State, as requested by the State.

a. The Contractor shall properly identify items being returned.

E. The Contractor shall invoice the State as required by the Department and should not invoice the State in advance of delivery and acceptance of any goods or services (Arkansas Code Annotated § 19-4-1206).

1. The Contractor should invoice the agency by an itemized list of charges. The Department’s purchase order number and/or the contract number should be referenced on each invoice.

2. Payment will be made in accordance with applicable State of Arkansas accounting procedures upon acceptance of goods and services by the Department.

3. Payment will be made only after the Contractor has successfully satisfied the Department as to the reliability and effectiveness of the goods or services purchased as a whole.

F. The Contractor should be able to accept the State’s authorized VISA Procurement Card (p-card) as a method of payment. Price changes or additional fee(s) must not be levied against the State when accepting the p-card as a form of payment.

G. Unless a Prospective Contractor expressly and conspicuously identifies exception(s) to the terms, conditions, Requirements, or a combination thereof in this RFP by listing them on the Exceptions Form (see Technical Proposal Packet), Prospective Contractor agrees and shall adhere to all terms, conditions, and Requirements if selected as the Contractor.

1. This RFP incorporates all terms of the Services Contract (SRV-1) Fillable Form (found here) and attached as a sample for your information only.

2. Prospective Contractor’s proposal may be rejected if a Prospective Contractor takes exception to any terms, conditions, or Requirements in this RFP.

https://www.transform.ar.gov/wp-content/uploads/Services-Contract-SRV-1-Fillable-Form-V.3.6.27.22.pdf

1.11 TECHNOLOGY ACCESS

A. When procuring a technology product or when soliciting the development of such a product, the State of Arkansas is required to comply with the provisions of Arkansas Code Annotated § 25-26-201 et seq., as amended by Act 308 of 2013, which expresses the policy of the State to provide individuals who are blind or visually impaired with access to information technology purchased in whole or in part with state funds. The Contractor expressly acknowledges and agrees that state funds may not be expended in connection with the purchase of information technology unless that technology meets the statutory Requirements found in 36 C.F.R. § 1194.21, as it existed on January 1, 2019 (software applications and operating ICSs) and 36 C.F.R. § 1194.22, as it existed on January 1, 2019 (web-based intranet and internet information and applications), in accordance with the State of Arkansas technology policy standards relating to accessibility by persons with visual impairments.

B. Accordingly, the Contractor expressly represents and warrants to the State of Arkansas through the procurement process by submission of a Voluntary Product Accessibility Template (VPAT) for 36 C.F.R. § 1194.21, as it existed on January 1, 2019 (software applications and operating ICSs) and 36 C.F.R. § 1194.22, that the technology provided to the State for purchase is capable, either by virtue of features included within the technology, or because it is readily adaptable by use with other technology, of:

1. Providing, to the extent required by Arkansas Code Annotated § 25-26-201 et seq., as amended by Act 308 of 2013, equivalent access for effective use by both visual and non-visual means.

2. Presenting information, including prompts used for interactive communications, in formats intended for non-visual use.

3. After being made accessible, integrating into networks for obtaining, retrieving, and disseminating information used by individuals who are not blind or visually impaired.

4. Providing effective, interactive control and use of the technology, including without limitation the operating system, software applications, and format of the data presented is readily achievable by nonvisual means.

5. Being compatible with information technology used by other individuals with whom the blind or visually impaired individuals interact.

6. Integrating into networks used to share communications among employees, program participants, and the public.

7. Providing the capability of equivalent access by nonvisual means to telecommunications or other interconnected network services used by persons who are not blind or visually impaired.

C. State agencies cannot claim a product as a whole is not reasonably available because no product in the marketplace meets all the standards. Agencies must evaluate products to determine which product best meets the standards. If an agency purchases a product that does not best meet the standards, the agency must provide written documentation supporting the selection of a different product, including any required reasonable accommodations.

D. For purposes of this section, the phrase “equivalent access” means a substantially similar ability to communicate with, or make use of, the technology, either directly, by features incorporated within the technology, or by other reasonable means such as assistive devices or services which would constitute reasonable accommodations under the Americans with Disabilities Act or similar state and federal laws. Examples of methods by which equivalent access may be provided include, but are not limited to, keyboard alternatives to mouse commands or other means of navigating graphical displays, and customizable display appearance. As provided in Arkansas Code Annotated § 25-26-201 et seq., as amended by Act 308 of 2013, if equivalent access is not reasonably available, then individuals who are blind or visually impaired shall be provided a reasonable accommodation as defined in 42 U.S.C.

§ 12111(9), as it existed on January 1, 2019.

E. If the information manipulated or presented by the product is inherently visual in nature, so that its meaning cannot be conveyed non-visually, these specifications do not prohibit the purchase or use of an information technology product that does not meet these standards.

F. The proposed commodities, services, or both must comply with the State’s shared Technical Architecture Program which is a set of policies and standards that can found here. Only those standards that are fully promulgated or have been approved by the Governor’s Office apply to the solution.

1.12 MINORITY AND WOMEN-OWNED BUSINESS

A. A minority-owned business is defined by Arkansas Code Annotated § 15-4-303 as a business owned by a lawful permanent resident of this State who is:

• African American

• American Indian

• Asian American

• Hispanic American

• Pacific Islander American

• A Service-Disabled Veteran as designated by the United States Department of Veteran Affairs

B. A women-owned business is defined by Act 1080 of the 91st General Assembly Regular Session

2017 as a business that is at least fifty-one percent (51%) owned by one (1) or more women who are lawful permanent residents of this State.

C. The Arkansas Economic Development Commission conducts a certification process for minority-owned and women-owned businesses. If certified, the Prospective Contractor’s Certification Number should be included on the Proposal Signature Page.

1.13 PROPRIETARY INFORMATION

A. The release of public records is governed by the Arkansas Freedom of Information Act (Arkansas

Code Annotated § 25-19-101 et. seq.).

B. Submission documents pertaining to the Solicitation become the property of the State and are subject to the Arkansas Freedom of Information Act (FOIA).

C. In accordance with FOIA, and to promote maximum competition in the State competitive sealed proposals, the State may maintain the confidentiality of certain types of information described in FOIA. Such information may include trade secrets and other information exempted from public disclosure pursuant to FOIA.

D. Consistent with and to the extent permitted under FOIA, any Prospective Contractor may designate appropriate portions of a proposal as confidential by submitting a redacted copy of the proposal. By so redacting any information contained in the proposal, the Prospective Contractor warrants that, after having received such necessary or proper review by counsel or other knowledgeable advisors, it has formed a good faith opinion that the portions redacted are not considered public records under

FOIA.

E. If a Prospective Contractor deems part of the information contained in a response not to be a public record, the Prospective Contractor should submit one (1) complete copy of the submission documents from which any proprietary or confidential information has been redacted in their proposal response. Except for the redacted information, the redacted copy must be identical to the original copy, reflecting the same pagination as the original and showing the space from which information was redacted.

F. The Prospective Contractor is responsible for identifying all proprietary information and for ensuring the electronic copy is protected against restoration of redacted data.

G. The redacted copy will be open to public inspection under the FOIA without further notice to the Prospective Contractor. If the State deems redacted information to be subject to a public record request under FOIA, the State will endeavor to notify the Prospective Contractor prior to release of the redacted record.

https://www.transform.ar.gov/information-systems/policies-standards/

H. The State has no liability to a Prospective Contractor with respect to the disclosure of Prospective Contractor’s confidential or proprietary information ordered by a court of competent jurisdiction pursuant to FOIA or other applicable law.

SECTION 2 – REQUIREMENTS

• Do not provide responses to items in this section unless specifically and expressly required.

2.1 BACKGROUND

A. Prospective Contractors are invited to submit proposals for the requirements described in this

Request for Proposal (RFP) to obtain pricing and a contract for software maintenance and support of the Arkansas Integrated Revenue System (AIRS), which includes two commercial off-the-shelf (COTS) GenTax systems (AIRS-Tax and AIRS-DSMV) installed and configured for the State of Arkansas Department of Finance and Administration Revenue Tax and Driver Services Motor Vehicle Divisions. The AIRS Tax System (AIRS-Tax) and AIRS Driver Services/Motor Vehicle System (AIRS-DSMV) are integrated software solutions used for vehicle registration and titling, driver’s license and permit issuance, driving records maintenance, driver’s license examination, tax registration and processing, and the associated revenue accounting and reporting. The DFA-Office of Information Services-AIRS Service Center (DFA-OIS-AIRS Service Center) is responsible for the management and coordination of all critical information technology components that make up DFA Revenue Division AIRS functions. The resources and services needed are for the support and enhancement of the Arkansas Integrated Revenue Systems (AIRS) IT ecosystem, which is comprised of both AIRS-DSMV and AIRS-Tax.

B. DFA Revenue Tax and Driver Services Motor Vehicle is comprised of the following:

1. Central Offices: Provides necessary support services for field staff and to administer the AIRS- DSMV and AIRS-Tax Systems at the State level.

2. Field Offices: Driver Services Motor Vehicle – 148 State Revenue and Driver Services Hearing offices are located across the State to provide direct services to customers using AIRS-DSMV.

There are seven (7) Tax Field Audit offices using AIRS-Tax across the state.

3. DFA Office of Information Services (OIS): Provides the information technology support for DFA

AIRS.

a. DFA OIS AIRS Service Center: Responsible for support, maintenance, and management of the DFA AIRS Systems (AIRS-DSMV and AIRS-Tax).

b. Chief Information Security Office: Responsible for developing agency security policy and overseeing the development of application ecosystem specific security policy and procedures.

c. OIS Technical Services and Division of Information Services: Responsible for maintaining the network and desktop support for DFA AIRS customers.

2.2 CURRENT ENVIRONMENT AND COMPLIANCE

A. The Arkansas Integrated Revenue System (AIRS) is fully implemented and provides DFA Revenue

Division workers, administrators, operations personnel, and the public with integrated systems that encompass tax, driver services, and motor vehicle services related functionality and data. These software applications provide a customer service-oriented approach to the revenue divisions day to day support services and provide the staff with the technology needed to effectively and efficiently manage their interactions with DFA Revenue Division customers.

B. System Applications: The AIRS-Tax and AIRS-DSMV Systems are fully custom developed solutions that are wholly owned and the intellectual property of the State of Arkansas. AIRS utilizes multiple custom-built web-based applications to perform day-to-day activities. It is compromised of the following six (6) major components:

1. AIRS-DSMV Driver License Issuance and Driver Control: This part of AIRS-DSMV addresses the issuance of REAL-ID and non-REAL-ID compliant commercial, non-commercial licenses, and State identification cards. This part also addresses the convictions, accidents, driver history of an individual driver’s license, and the driver control hearings. This component is also interfaced real-time with American Association of Motor Vehicle Administrators (AAMVA) during the issuance of commercial and non-commercial licenses, and interfaces with other State departments, including the law enforcement agencies. Driver’s knowledge and skills exams for commercial and non-commercial drivers is also part of this component.

2. AIRS-DSMV Motor Vehicle Titling and Registration: This part of AIRS-DSMV addresses the titling and registration of new and used motor vehicles in the state of Arkansas. This component also collects state, local and city taxes from the customers during registration. This component is interfaced real-time for the verification of vehicle insurance and validates the vehicle theft and title status with AAMVA.

3. AIRS-Tax: The main part of this component is tax return processing and payment and refund processing for numerous individual and business taxes, calculation of city and county sales tax distribution, revenue distribution, audit handling, collection services, tax fraud evaluation, business registration, and motor fuel tracking.

4. Cash Management and Disbursement: The numerous transactions in the AIRS-Tax and AIRS- DSMV Systems involve complex revenue accounting to process payments from numerous sources in various formats, apply them to the appropriate accounts, generate any associated billing or refund required, and prepare the daily revenue distribution and disbursement to the State Treasury.

5. Reporting: Different reporting tools (reports, adhocs, and datacubes) are used to present detailed and/or statistical information to users. Web front-end portals allow AIRS-Tax and AIRS- DSMV users to access reports in a variety of formats, including .pdf, text, XML, and Excel files.

Batch processes also generate reports that may be emailed or FTP’d to the appropriate recipients.

6. e-Services: The AIRS Service Center maintains public-facing web applications to provide DFA Revenue Division services for DFA Revenue Division customers, as well as special web applications for law enforcement, courts, and other authorized users. These are all web-based applications utilizing GenTax proprietary services for session management and Microsoft SQL Server as the database management system (DBMS) integrated with web service interfaces.

These applications were developed using Microsoft .NET framework, MVC (Model-View- Controller) and GenTax architectures.

C. Software Environment: The software components detailed below are used for the day-to-day operations and support of AIRS. The State purchases all software components for AIRS.

1. Core Application Software: The AIRS Systems (AIRS-Tax and AIRS-DSMV) utilize GenTax Version 12, which is a COTS software solution from Fast Enterprises, as the core application software solutions for both AIRS Systems.

2. Additional Development Software: AIRS utilizes Microsoft Visual Studio in conjunction with GenTax for the development of web-based applications. Microsoft SQL Server Management Studio is used for database layer development. Additional XML editor software is utilized for return form editing. Postman is used for web service interface development and testing.

3. Code Management Software: The AIRS Service Center utilizes the GenTax Fast Code Repository (FCR) integrated solution to maintain version control of the applications, and as the primary location to store all system related documentation. FCR is also the change management solution utilized for submission and tracking of all change requests for AIRS-Tax and AIRS-DSMV systems. In addition, FCR is used exclusively to record test cases and testing results from the various stages of the software development lifecycle.

4. System Software: The system software provides essential functions necessary for the successful operation of the DFA AIRS systems. Products include:

a. Database Management System: Microsoft SQL Server is the database management system used. The database is compatible with Windows Server and has Internet integration allowing organizations to build active websites and internal Intranet sites. Microsoft SQL

Server Analysis Services is being utilized for fraud analytics. The current version in use is Microsoft SQL Server 2016.

b. Operating System: Microsoft Windows Server is the operating system used for all DFA AIRS servers. It keeps track of user authentication, file services, print services, and GenTax services. Other features include multiple websites on a single machine, innovative web publishing features, customizable tools, and new wizard technologies. The current version being used is Windows Server 2016.

5. Client Software: Client software installed on staff workstations to perform necessary duties includes:

a. Microsoft Office Suite 365: The productivity suite in use by DFA staff. Individual products include Microsoft Word, Excel, Outlook, and PowerPoint.

b. Google Chrome: The web browser is the primary gateway for DFA Revenue Tax and Driver Services Motor Vehicle staff to access the AIRS applications and other IT tools.

c. Microsoft Edge: The web browser is the primary gateway for DFA Revenue Tax and Driver Services Motor Vehicle staff to access the AIRS applications and other IT tools.

D. Hardware Environment: This section identifies the hardware that is utilized by the DFA AIRS IT infrastructure. The different categories of hardware are outlined below.

1. Network Connectivity: DFA OIS Technical Services currently operates and maintains a series of interconnected LANs. These LANs make up the switched network and provide Statewide communications between the DFA AIRS Systems and various field offices in the State. In a typical DFA Tax or Driver Services Motor Vehicle field office, Cisco switches are linked to Cisco routers provisioned by the Arkansas TSS Division of Information Systems (TSS DIS). TSS DIS provides all WAN connectivity. Within each field office Cisco switches provide LAN connectivity.

DFA AIRS uses the DIS network to provide the data connection between the DFA Tax and Driver Services Motor Vehicle field offices and the DIS hosted data center. The transmission between the field office and the data center is encrypted and TCP/IP is the protocol used for communication between the client and the web servers. Services also include Voice over Internet Protocol (VoIP) Telephony. VoIP services are delivered via dedicated VLANs with the service itself being managed by TSS DIS utilizing Cisco CallManager.

2. Server Environment: DFA Tax and Driver Services Motor Vehicle uses AIRS, an Intranet application, and other auxiliary applications for its day-to-day operations. All data is accessed through https requests to the Intranet information web server, which in turn provides the data by fetching it from the relational database (MS SQL) server. DFA AIRS uses the TSS DIS network to provide the data connection between the DFA Tax and Driver Services Motor Vehicle field offices and the DIS hosted data center.

a. The transmission between the field office and the data center is encrypted and TCP/IP is the protocol used for communication between the clients and the web servers. The DFA AIRS SQL Cluster farm is the main database engine that runs the DFA AIRS enterprise providing data warehousing capabilities. The primary technologies used in the DFA AIRS environment are:

i. Windows Server

ii. Microsoft SQL Server for database management

iii. HP 3PAR Storage Area Network for SQL Server databases, VMWare Data Stores, and SAN Replication

iv. VMWare as hypervisor technology for virtualization of servers

v. AIRS Service Center Tech Team manages administering patches, critical fixes, and service packs

vi. GenTax services for applications hosting

vii. Office 365 for DFA AIRS mail and system mail functions

viii. Cisco Umbrella for web content and site filtering

ix. Cylance as End Point Protection software

x. Tenable as Nessus Scanner software for vulnerability and configuration scans

xi. ManageEngine Log360 for audit repository and security maintenance

xii. SFTP and SMTP Servers to support GenTax architecture requirements of Application hosting

xiii. TSM/CommVault as backup solution for VM Servers, Databases, File Servers

xiv. Fortinet for Dynamic Site to Site VPN Tunnel interfaces

xv. Deployment and hosting of AAMVA UNI application and maintenance of Private Net/Vendor Net for AAMVA interfaces

xvi. Palo Alto for intrusion detection and prevention with ASA firewall; and

xvii. F5 BigIP load balancing

3. Workstations: Windows 10 business class desktops and laptops are standard workstations with 24-inch or larger flat screen monitors. Workstation standards are maintained by DFA OIS Technical Services through various group policies and limitations on administrator’s privileges.

4. Printers: Standard network-based printing is used as the print solution. Each printer on the network will be IP addressable. Most printers are multi-function devices capable of printing, scanning, copying, and faxing when appropriate.

E. Regulatory Compliance: The AIRS applications, as well as all information technology infrastructure within the State, must abide by the following regulatory guidance.

1. IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (http://www.irs.gov/pub/irs-pdf/p1075.pdf).

2. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 4 Security and Privacy Controls for Federal Information Systems and Organizations, (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf).

3. Department of Homeland Security CFR PART 37-Real ID Drivers Licenses and Identification Cards, Subpart C (§ 37.33 DMV databases) and Subpart D (§ 37.41 Security plan), (https://www.ecfr.gov/current/title-6/chapter-I/part-37).

4. Social Security Administration (SSA) Technical Systems Security Requirements (TSSR). (See Attachment 11)

5. Social Security Administration (SSA) Security Reminders for State Agencies April 2023. (See Attachment 10)

F. System Metrics:

1. Organization Structure including current O&M contractor staff (See Attachment 1).

2. Program Complexity (See Attachment 2).

G. Security:

1. Contractor shall develop and maintain managerial, operational, and technical procedures and standards relevant to support operations as is necessary to maintain compliance with regulatory standards specified in section 2.2.E. All procedures, technical diagrams, and other materials http://www.irs.gov/pub/irs-pdf/p1075.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://www.ecfr.gov/current/title-6/chapter-I/part-37 developed by the Contractor pursuant to the performance of Contractor’s duties must be the property of DFA.

2. Contractor staff shall adhere to DFA security policy when performing work.

3. Information regarding DFA Information Systems, processes, and procedures, must remain the property of DFA. The Contractor shall not disclose information obtained through the performance of its duties to any third-party and information obtained shall only be accessed by those individuals as is necessary for the performance of Contractor’s duties. The requirements of this section must live in perpetuity.

4. Contractor shall develop an annual security plan in accordance with applicable regulatory standards specified in section 2.2.E subject to approval by the DFA Chief Information Security Officer.

5. Contractor shall participate in regulatory audit, inspection, and risk assessment activities as is required by the regulatory standards as specified in section 2.2.E. The first plan is due within 90 days of contract award.

6. Contractor shall participate in vulnerability and penetration testing exercises as is deemed necessary by the DFA Chief Information Security Officer.

7. Contractor shall utilize best practices in development and modification of systems configurations, software, and applications. Development and implementation practices must align with the applicable elements of the SANS Institute “Securing Web Application Technologies” Checklist (Securing Web Application Technologies : [SWAT] Checklist | SANS Institute) and the Department of Transformation and Shared Services Division of Information Systems “Securing Web Applications Policy” (See Attachment 9).

8. In the event of a Cybersecurity Incident, Contractor shall notify the DFA Primary Point of Contact and the DFA Chief Information Security Officer as soon as feasible, but not longer than twenty-four (24) hours after any discovery of a Cybersecurity Incident. The initial report must include, but is not limited to:

a. Date and time of discovery

b. Date and time of incident

c. Scope description of incident detailing available information regarding exposure of information, systems impacted, and current status

d. Initial mitigation actions taken, if any

2.3 SERVICE REQUIREMENTS

A. DFA AIRS, which includes both AIRS-Tax and AIRS-DSMV, is looking for a Contractor to provide qualified resources for each of the areas listed below. Attachment 3 details the expected duties and qualifications of the resources the Contractor shall provide.

B. In coordination with the DFA AIRS Information Systems Manager, the Contractor shall provide services in the following areas:

1. Project Management:

a. Contractor shall provide qualified project management oversight of all operations, maintenance, and development tasks covered under the Contract. This must include all project schedules, work plans, issue management, and risk management activities, as well as weekly and monthly reporting requirements as defined by the State.

b. Key operations and maintenance work and activity must be managed through industry standard project management processes and practices, including already established operational plans (software development, release management, change management, etc.)

and project management plans.

https://www.sans.org/cloud-security/securing-web-application-technologies/ https://www.sans.org/cloud-security/securing-web-application-technologies/

c. The Contractor shall, as part of the ongoing baseline application maintenance and support of AIRS, consistently improve the applications by incorporating business needs and best practices, addressing new State and Federal requirements, improving operational performance, and incorporating new technology when appropriate.

d. The Contractor shall provide services that are inclusive of all the requirements, tasks, services, in scope activities, and deliverables outlined herein. Application maintenance and development activities must be inclusive of project initiation, planning and management, requirements, functional design, system design, construction, testing, implementation and post-implementation, and any related batch process support.

e. A detailed list of duties and qualifications for project management resource(s) can be found in Attachment 3.

2. Application Technical Architecture Administration:

a. The Contractor shall provide technical operations and application architecture support services. These services include support for application builds, application databases, configuration changes, performance-related changes, and any other application architecture changes. The Contractor shall also be responsible for the overall application and system performance monitoring to meet performance metrics defined by the State.

b. State staff will be responsible for the acquisition and physical installation of infrastructure for systems, including but not limited to physical servers, virtual servers, network equipment, and security/firewall appliances.

c. Contractor staff shall be responsible for application software installation and initial configuration for all development, test, and production environments.

d. Contractor shall provide support for operations, code promotion, and deployment in all environments including any modifications to system parameters. The Contractor shall also provide support in all environments including the following activities:

i. Database Management: The Contractor shall provide database expertise with respect to system changes, upgrades, Microsoft SQL programming, monitoring, performance tuning, auditing, security, and maintenance of all application databases.

ii. Technical Support: This must include support for operations related helpdesk tickets to support system monitoring, as well as actively addressing any system issues. (See Attachment 4)

iii. System Monitoring: This must include overall system monitoring and performance management. Monitor, identify, and resolve any system related tickets while continuing to ensure all system performance metrics are met.

iv. Security Operations: This must include operational tasks as defined by the State’s Chief Information Security Office, as well as tasks related to State security operations.

Examples include research/resolution of any security findings/reports, assistance with security audits, or technical projects related to security tools such as data masking.

v. Tools Support: Contractor shall provide support of all system development tools utilized by the project. Many of the tools may reside on State systems, however, operations are still the responsibility of the Contractor.

e. The Contractor shall provide support for Fast Code Repository (FCR), as well as the back-up and maintenance thereof.

f. The Contractor shall be required to work with State staff to implement disaster recovery (DR) solutions and conduct any necessary DR tests.

g. A detailed list of duties and qualifications for application technical architecture administration resource(s) can be found in Attachment 3.

h. Application Technical Architecture Administration resource(s) shall, at the expense of the Contractor, complete Fast Enterprises Technical training within thirty (30) days after beginning work with the AIRS Service Center.

3. Production Support:

a. Contractor shall provide support of all production support tasks covered under the Contract.

This must include all operation and maintenance schedules, work plans, issue management, and risk management activities, as well as weekly and monthly reporting requirements as defined by the State.

b. The Contractor shall, as part of the ongoing baseline application maintenance and support of AIRS, consistently improve the application by…