S000000354 Driver's License & ID Card Printing Solution.pdf

STATE OF ARKANSAS

DEPARTMENT OF TRANSFORMATION AND SHARED SERVICES

OFFICE OF STATE PROCUREMENT

501 Woodlane St., Ste. 220

Little Rock, Arkansas 72201-1023

REQUEST FOR PROPOSAL

SOLICITATION DOCUMENT

SOLICITATION INFORMATION

Solicitation Number: S000000354 Solicitation Issued: August 16, 2024

Description: Driver’s License and State Identification Card Printing Solution

Department: Arkansas Department of Finance and Administration – Revenue Services

SUBMISSION DEADLINE AND DELIVERY OF RESPONSE DOCUMENTS

Proposal Opening Date: September 6, 2024 Proposal Opening Time: 10:00 AM, Central Time

Proposal submissions for this Request for Proposal must be submitted through ARBuy, the State’s eProcurement system. It can be accessed at arbuy.arkansas.gov. Proposals received after the submission deadline may be rejected as untimely.

LIVE PROPOSAL OPENING INFORMATION

Teams Meeting Link: Join the meeting now

Meeting ID: 210 153 702 417

Passcode: AytZAo

Call in (audio only):

Phone Conference ID:

501-244-3310

823 430 487#

TSS OFFICE OF STATE PROCUREMENT CONTACT INFORMATION

TSS OSP Procurement Specialist:

Julie Robnolt Procurement Specialist’s Direct Phone Number:

501-371-6070

Email Address: julie.robnolt@arkansas.gov TSS OSP’s Main Number: 501-324-9311

TSS OSP Website: transform.ar.gov/procurement/ https://arbuy.arkansas.gov/ https://teams.microsoft.com/l/meetup-join/19%3ameeting_M2Y4OWNjNGEtN2E3Yy00ZDc3LTg2NGMtYjVhZTY3MjFjOWJj%40thread.v2/0?context=%7b%22Tid%22%3a%225ec1d8f0-cb62-4000-b327-8e63b0547048%22%2c%22Oid%22%3a%22a5e9cf20-c478-4e36-8fed-351f1ae086e2%22%7d mailto:julie.robnolt@arkansas.gov https://www.transform.ar.gov/procurement/

Rev 06/2024

SECTION 1 – GENERAL INFORMATION AND INSTRUCTIONS

1.1 INTRODUCTION

This Request for Proposal (RFP) is issued by the TSS Office of State Procurement (TSS OSP) for the Arkansas Department of Finance and Administration (DFA) Office of Driver Services and Motor Vehicle (DSMV) to obtain pricing and a contract for a fully functional turn-key secure Arkansas Driver’s License and State Identification (ID) card printing solution.

This RFP is not for replacing the current Driver’s License System of Record (SOR) and is only to create and print secure Arkansas Driver’s Licenses and State Identification (ID) cards.

Contract(s) will be awarded to the Prospective Contractor determined to have submitted the proposal that is the most advantageous to the State. Direct all questions, comments, or concerns regarding this solicitation to the TSS OSP, not the Department.

1.2 TYPE OF CONTRACT

A. As a result of this RFP, TSS OSP intends to award a contract to a single Contractor.

B. The anticipated starting date for any resulting contract is July 1st, 2025, except that the actual contract start date may be adjusted unilaterally by the State for up to three (3) calendar months. By submitting a signed proposal in response to the RFP, the Prospective Contractor represents and warrants that it will honor its proposal as being held open as irrevocable for this period.

C. The initial term of a resulting contract will be for three (3) years. Upon mutual agreement by the Contractor and Department, the contract may be renewed by TSS OSP for up to four (4) additional one-year terms or portions thereof, not to exceed a total aggregate contract term of seven (7) consecutive years.

1.3 DEFINITION OF TERMS

A. Unless otherwise defined herein, all terms defined in Arkansas Procurement Law have the same meaning herein.

B. “AAMVA” means American Association of Motor Vehicle Administrators.

C. “AIRS” means Arkansas Integrated Revenue System; aka System of Record (SOR).

D. “Applicant” means the person who is applying for the driver’s license or State ID card.

E. “Bidder” means the entity that is submitting a proposal for this contract – used interchangeably with the words “Vendor” or “Contractor” in this document.

F. “Card” means a generic term that represents either a driver’s license or ID card, or any other Card Type that may be produced by the Issuance System.

G. “Card Type” means a Card dedicated to a specific purpose, with a specific format and defined set of data.

H. “DFA” means Department of Finance and Administration, State of Arkansas.

I. “DR” means Disaster Recovery.

J. “DRP” means Disaster Recovery Plan.

K. “Issuance Solution” means the combination of hardware and software that form the complete Digital Image Capture and Card Printing Solution.

L. “Image Capture Workstation” means a physical workstation employed by the Contractor’s Card Issuance System to perform its functions.

M. “Normal Business Hours” means 8:00 AM to 4:30 PM Central Time, Monday through Friday, excluding any State holidays. After-hours is any time outside these parameters.

N. “ODS” means Office of Driver Services, DFA.

O. “OIS” means Office of Information Services, DFA.

P. “Operator” means the cashier or other State employee who is operating the Contractor’s solution.

Q. “OS” means Computer Operating System.

R. “Prospective Contractor” means a responsible offeror who submits a proposal in response to this Solicitation.

S. “RFP” means the terms “Request for Proposal”, “RFP” and “Bid Solicitation” are used synonymously in this document.

T. “Requirement” means a term, condition, provision, deliverable, Specification, or a combination thereof, that is obligated under the Solicitation, resulting contract, or both.

U. “Responsive Proposal” means a proposal submitted in response to this Solicitation that conforms in all material respects to this RFP.

V. “Revenue Office” means an office operated by the State and interfacing with the public for the purpose of collecting revenue and providing, among other products, driver services.

W. “Security Breach” is any compromise of the security, confidentiality, or integrity of an information system, including but not necessarily limited to any unauthorized access to information, destruction of information, modification of information, acquisition of information, or disclosure of information.

X. “Shall” and “must” mean the imperative and are used to identify Requirements.

Y. “Solution” the Contractor’s Solution, which provides services required to satisfy the request for proposal.

Z. “Specification” means any technical or purchase description or other description of the physical or functional characteristics, or of the nature, of a commodity or service. “Specification” may include a description of any Requirement for inspecting, testing, or preparing a commodity or service for delivery.

AA. “State” means the State of Arkansas. When the term “State” is used herein to reference any obligation of the State under a contract that results from this Solicitation, that obligation is limited to the Department using such a contract.

BB. “System” means, unless otherwise clarified in context, the Issuance System.

CC. “Workstation” means unless otherwise clarified in context, the Imaging Capture Workstation.

1.4 SOLICITATION SCHEDULE

For informational purposes, TSS OSP is providing a Solicitation Schedule; however, dates listed and noted with an asterisk (*) are anticipated dates only and are subject to change at the discretion of the State. All times are listed in Central Time.

TABLE A: TENTATIVE SOLICITATION SCHEDULE

ACTIVITY DATE

RFP Release to Prospective Contractors August 16, 2024

Deadline for Prospective Contractor Questions August 25, 2024, midnight CST

Answers to Questions Posted to ARBuy* August 28, 2024

Proposal Due Date September 6, 2024, 10:00 AM CST

Initial Proposal Evaluation* September 9, 2024

Interviews* September 13, 2024

Final Proposal Evaluation* September 13, 2024

Discussions Kick Off Meeting* September 20, 2024

Finalize Discussions* September 24, 2024

Post Anticipation to Award* September 26, 2024

Award Contract* October 21, 2024

1.5 CLARIFICATION OF SOLICITATION

A. Submit questions requesting clarification of information contained in this Solicitation via the

Solicitation posting in ARBuy by the date and time listed in Table A.

1. For each question submitted, Prospective Contractor should reference the specific Solicitation item number to which the question refers, as applicable.

2. Prospective Contractors’ written questions will be consolidated and responded to by the State as deemed appropriate. The State’s consolidated written response is anticipated to be posted to the Solicitation posting in ARBuy by the close of business on the date provided in Table A. If Prospective Contractor questions are unclear or non-substantive in nature, the State may request clarification of a question(s) or decline to answer.

B. The Prospective Contractor should notify the TSS OSP Procurement Specialist of any term, condition, etc., that precludes the Prospective Contractor from submitting a compliant, Responsive Proposal. Prospective Contractors should note that it is the responsibility of the Prospective Contractor to seek resolution of all such issues, including those relating to the terms and conditions of the contract, prior to the submission of a proposal.

C. Prospective Contractors may contact the TSS OSP Procurement Specialist with non-substantive questions at any time prior to the proposal opening.

D. An oral statement by TSS OSP will not be part of any contract resulting from this Solicitation and may not reasonably be relied on by any Prospective Contractor as an aid to interpretation unless it is reduced to writing and expressly adopted by TSS OSP.

E. Only an addendum written and authorized by the State will modify the Solicitation.

1. An addendum posted within three (3) calendar days prior to the proposal opening may extend the proposal opening and may or may not include changes to the Solicitation.

1.6 RESPONSE DOCUMENTS

A. All proposal responses must be submitted through ARBuy, the State’s eProcurement system. The system can be accessed at arbuy.arkansas.gov.

1. Prospective Contractors must be registered in ARBuy to submit proposals responses.

B. Technical Proposal Packet

1. Prospective Contractors shall utilize the Technical Proposal Packet to submit their responses.

2. The following items are proposal Submission Requirements and must be submitted as part of a Prospective Contractor’s proposal response.

a. Signed Proposal Signature Page; signature may be ink or digital.

b. Technical Proposal response to the Information for Evaluation section included in the Technical Proposal Packet, which must be in the English language.

https://arbuy.arkansas.gov/

c. Completed Official Solicitation Price Sheet attached to the Solicitation in ARBuy.

i. Pricing must be proposed in U.S. dollars and cents.

ii. Quantities stated are estimates only and are not guaranteed. Prospective Contractor must submit unit price on the estimated quantity and unit of measure specified.

• The State may order more or less than the estimated quantity on term contracts, and the Contractor shall sell to the Department quantities ordered at no more than the submitted price.

iii. If pricing documents do not allow for accurate pricing, Prospective Contractor should notify the OSP Procurement Specialist at least seventy-two (72) hours before the proposal opening time.

iv. Prices must be firm offers and adjustments may be negotiated at the time of contract renewal/annually/quarterly.

• A request for a price increase must include supporting documentation demonstrating that the increase in contract price is based on an increased cost to the Contractor and that the proposed pricing is still competitive in the marketplace. The State has the right to approve or deny any request for a price adjustment.

v. Discount from list pricing is not acceptable unless requested elsewhere in the Solicitation.

vi. State or local sales taxes should not be included in the price. Trade discounts should be deducted from the unit price and the net price should be shown in the Pricing Response.

d. Recommended Options Form

i. The Recommended Options form included in the Technical Proposal Packet allows Prospective Contractors to identify any recommended options or optional service ideas that may benefit the State that were not included in the Requirements and the proposed solution.

e. Copy of Prospective Contractor’s Equal Opportunity Policy

i. Pursuant to Arkansas Code Annotated § 19-11-104, OSP requires a Prospective Contractor bidding on a state contract to submit a copy of the Prospective Contractor’s Equal Opportunity (EO) Policy.

ii. Prospective Contractors not required by law to have an EO Policy must submit a written statement to that effect.

f. Proposed Subcontractors Form (see SRV-1, section 14)

3. The following items, which must be submitted prior to a contract award to the Prospective

Contractor, may also be included with the Prospective Contractor’s proposal:

a. EO 98-04: Contract and Grant Disclosure Form (see SRV-1, section 11)

b. Voluntary Product Accessibility Template (VPAT), if applicable

4. Prospective Contractors should not include any other documents or ancillary information, such as a cover letter or promotional/marketing information.

C. Redacted copy of the Technical Proposal Packet

1. One (1) redacted (marked “REDACTED”) copy of the Prospective Contractor’s proposal response (see Proprietary Information), if applicable.

D. Prospective Contractors should not alter language in Solicitation document(s) or Official Proposal Price Sheet provided by the State.

https://www.transform.ar.gov/wp-content/uploads/Services-Contract-SRV-1-Fillable-Form-V.3.6.27.22.pdf https://www.transform.ar.gov/wp-content/uploads/Services-Contract-SRV-1-Fillable-Form-V.3.6.27.22.pdf https://www.section508.gov/sell/vpat/

E. Prospective Contractor’s proposals cannot be altered or amended after the proposal opening except as permitted by law or rule.

F. Prospective Contractors may submit multiple proposals.

SECTION 2 – REQUIREMENTS

2.1 BACKGROUND AND ENVIRONMENT

Arkansas Department of Finance and Administration (DFA) Office of Driver Services and Motor Vehicle (DSMV) printed 661,671 cards in year 2023. These cards are printed over the counter at 137 locations throughout the State.

2.2 OBJECTIVES & GOALS

DFA is seeking a secure, web-based, Driver’s License/Identification (DL/ID) Card Printing Solution that will provide the following functions:

• Collect digital images and demographic information.

• Interface with a web-based solution to store and retrieve information.

• Include a facial recognition system.

• Include all necessary hardware and software products.

• Include professional design, development, and customization services.

• Include installation, and transition management including training for State employees.

• Print a variety of driver’s licenses and ID cards for the State of Arkansas.

• Include a Contractor-authorized, standby, service staff whose priority is to respond immediately when calls are received from any of the State’s Revenue Offices, or card-issuing locations.

• Include regular maintenance and supply of all consumables.

• Provide a disaster recovery plan.

2.3 PROSPECTIVE CONTRACTOR MINIMUM QUALIFICATIONS

A. The Prospective Contractor shall have a minimum of five (5) years of implementing Driver’s

License/State ID Card Printing Solutions of similar size and scope to those described in this RFP.

B. The Prospective Contractor shall have successfully implemented the proposed Solution for a minimum of five (5) or more states with a minimum annual volume of five hundred thousand (500,000) cards printed per State, per year.

2.4 STANDARDS AND REGULATIONS

A. The DL/ID card produced by the Contractor must be fully compliant with State of Arkansas and Federal statutes including the Real ID Act and applicable regulations.

B. DL/ID cards must meet or exceed all standards contained in American Association of Motor Vehicle Administrator’s (AAMVA) Personal Identification Specification.

(https://www.aamva.org/getmedia/99ac7057-0f4d-4461-b0a2-3a5532e1b35c/AAMVA-2020-DLID-Card- Design-Standard.pdf)

2.5 SYSTEM ACCESS

A. The Contractor shall provide user access to the system through a secure, web-based portal.

B. The system must provide a user-friendly administrative interface with automated workflows for common functions (referrals, applications, eligibilities, plans, performance-data collection, reports, etc.).

C. The system should stress consistency across all the different modules so that the business process is easy to learn and understand.

https://www.aamva.org/getmedia/99ac7057-0f4d-4461-b0a2-3a5532e1b35c/AAMVA-2020-DLID-Card-Design-Standard.pdf https://www.aamva.org/getmedia/99ac7057-0f4d-4461-b0a2-3a5532e1b35c/AAMVA-2020-DLID-Card-Design-Standard.pdf

D. The system must be browser and operating system neutral for all user types.

E. The system must function accurately on common modern browsers such as Internet Explorer, Microsoft

Edge, Mozilla Firefox, Google Chrome, and Safari.

F. The system must not require additional browser plug-ins, add-ons, or helper applications.

G. The system must allow users with multiple roles/accounts to switch between roles/accounts to view/update/create data under the same login ID.

H. The system must allow users to reset passwords by email.

2.6 IMAGE WORKSTATION APPLICATION (IWA)

A. The Image Workstation Application (IWA) must be the primary graphical user interface for users in the process that ultimately produces the card credentials.

B. The application must be 100% web based, with no need for a local client or agent.

C. The Contractor’s application must not be dependent on java applications or runtime components which cannot be updated with the normal update release cycle of the Contractor.

D. The Contractor’s application must be supported on all current Microsoft Operating Systems (OS) (64 bit), including but not limited to Windows 11 or newer version.

E. The application must allow DFA to access individual workstations remotely.

F. The Contractor’s application must display the current version of the image application.

G. The Contractor’s application must support updates of the workstation OS and image application from a central update distribution point.

H. The Contractor’s application must be integrated with Microsoft Active Directory services for user authentication.

I. The Contractor’s application must be capable of multi-factor authentications.

J. Image Workstation Application must capture a digital image in color of applicant’s full facial head and shoulders. Digital image must be sufficiently detailed to allow facial recognition software to perform comparison between the most recent captured image to the previous image on the customer account during the issuance of DL/ID card.

2.7 IMAGE CAPTURE WORKSTATION

A. Image Capture Workstation (ICW) must be able to fit within a 4 foot long by 2-foot-deep flat surface area and must consist of the following:

1. Small Form Factor Computer

2. USB Keyboard and Mouse

3. Flat Panel LCD Monitors, two (2) for Each Workstation, (Minimum 22” and Maximum 24”)

4. Universal Power Supply with Uninterruptible Power Backup

5. Image Capture Camera (See 2.7 for requirements)

6. Signature Pad

7. Card Issuance Printer

8. Photo Backdrop

B. The Contractor shall provide, at minimum, one hundred fifty-seven (157) completely equipped Image

Capture Workstations. There are multiple ICWs in certain selected offices.

C. The Contractor shall maintain an adequate number of spare equipment (minimum of ten percent (10%) of the initial installation count) to keep on hand to provide the required support throughout the life of any resulting contract. The spare equipment must be stored at the Contractor’s local maintenance facility.

D. Each monitor supplied must be able to limit the viewing angle of the screen, making it difficult for people beside or behind the display the ability to see what's on screen. This can be achieved as a built-in function of the monitor or by using a secondary screen/filter. In case DFA must replace any screens, additional backup privacy monitor screens must be available.

E. The ICW components must be separated from each other to accommodate space limits.

F. The system must have the capability to process photo first using the same system used for issuance of the card.

G. The ICW components must be Energy Star certified.

H. The ICW operating system must be 64-bit Windows 11 or newer version.

I. The ICW must be a member of a DFA Active Directory Domain.

J. The ICW must be scanned for common vulnerabilities and exposures on a frequency to be established by DFA.

K. The ICW must utilize endpoint protection software to be provided by DFA.

L. Uninterruptible Power Supply (UPS) battery backup must support the image capture workstation for up to fifteen (15) minutes.

M. Monitor resolutions must support application needs, with a minimum of 1280x1024 pixels.

N. The Contractor’s application workstation and DL/ID image application must support the use of Microsoft

Defender software on the workstation.

O. The Contractor shall provide photo backdrop, for each issuance location, and it must be of sufficient size to provide full coverage of the background of a photograph taken of the applicant that meets the standards.

2.8 IMAGE CAPTURE CAMERA REQUIREMENTS

A. The Contractor shall meet these standards outlined in ISO/IEC 19794-5:2011(E)

(http://www.iso.org/iso/catalogue_detail.htm?csnumber=50867) Information technology--Biometric Data Interchange Formats-- Part 5: Face Image Data for specific guidelines for facial imaging.

B. The image capture camera must include Full Frontal image capture.

C. The image capture camera must include a projectable light source that must render a clear and concise image and must not depict shadows or hot spots.

D. The image capture camera must have resolution that generates facial features which includes complete http://www.iso.org/iso/catalogue_detail.htm?csnumber=50867 visibility of pupils and iris.

E. The image capture camera must include automatic or manual elevation and zoom adjustment capabilities that must allow the subject’s image to be properly centered and sized.

F. The image capture camera must include automatic focus capable of focusing on subjects seventy-two

(72) inches away.

G. The image capture camera must be capable of capturing images of applicants between heights of twelve

(12) to ninety (90) inches.

H. Due to space limitations, smaller camera size is preferable.

2.9 FACIAL RECOGNITION REQUIREMENTS

A. The Contractor shall provide a mechanism to compare the most recent captured image to all the images in Arkansas Image Database and all the images on that record.

B. The Facial Recognition solution must provide capability to search by demographics.

C. The Solution must provide investigatory tools, including, but not limited to:

1. Gridlines

2. Image flipping

3. Imaging overlay

4. Split screens

5. Signature enlarging

6. Enrollment of law enforcement photos

7. Super imposing of images

8. Reset images

9. Rotate and zoom images

10. Crop images

11. Link/unlink images

12. Color scale

2.10 SIGNATURE CAPTURE

A. Signatures must be captured using a signature pad and stored according to the American

Association of Motor Vehicle Administrators’ (AAMVA) standards.

2.11 REAL ID REQUIREMENTS

A. The Contractor shall provide the State with a Design Security Features Report to be submitted to the

U.S. Department of Homeland Security.

B. The report must address the ability of the card to resist forgery and counterfeiting as required by the REAL ID Act.

C. DL/ID Card Issuance Solution must also be able to produce both REAL ID and non-REAL ID cards at each issuance location.

2.12 CARD PRINTING AND CARD DESIGNS

A. The Contractor shall use a smaller printer size due to space limitations.

B. The printer must print the finished cards, within two (2) minutes, in a single-step process and must not require operator intervention other than initiation.

C. Operator maintenance, (such as replacing laminates, or loading cards), on the recommended printer must be minimal.

D. The Contractor shall provide design services for the card types and implement those designs. Card design templates must follow AMMVA standards and must be approved by DFA Revenue Office of Motor Vehicle and Driver Services (DSMV) before implementation.

E. The State shall be able to order a new card type, or modify the design of any card type, at any time.

F. The Solution must not be capable of printing cards if printer and printing system is not physically located in a DFA card issuance location. (Example: operator required dongle or other similar functioning security technology.)

G. The Contractor shall have an existing ANSI INCITS 322 test report from an independent testing laboratory for the same type of printing system (printer plus laminator) being quoted to the State.

A copy of the report must be submitted by the selected Contractor

2.13 PHYSICAL CARD REQUIREMENTS

A. The cards must be designed and fabricated to maintain full durability with no degradation for a period of nine (9) years.

B. The physical integrity of the cards must remain intact under conditions of strenuous wear and tear for a period of at least nine (9) years.

C. Digitized image must not deteriorate or discolor during the nine (9) year life of the card.

D. Printed matter on the cards must not deteriorate or become illegible during the nine (9) year life of the card.

2.14 CARD SECURITY REQUIREMENTS

A. The cards must meet all the requirements of the REAL ID Act of 2005 and the 2020 AAMVA DL/ID Card Design Standard (https://www.aamva.org/assets/best-practices,-guides,-standards,-manuals,-whitepapers/aamva-dl-id-card-design-standard-(2020).

B. At a minimum, the cards must include the four (4) AAMVA families of security features (https://www.aamva.org/getmedia/19072a17-e9f2-45e0-975f-5e00588cb3f8/Design-Principles-and- Guidelines-for-Secure-DLID-Cards.pdf) which must, at minimum, include the following:

1. Forensic Level - (1) Level three (3) security feature

2. Card Body Design – One (1) Mandatory feature and two (2) Optional features

3. Security design, resistant to reproduction – Two (2) Mandatory features and three (3) Optional features

4. Security Inks/pigments – One (1) Mandatory feature and two (2) Optional features.

5. Protecting personalized data – Four (4) Mandatory features and one (1) Optional feature, preferably an optically variable element or another equivalent device

C. In good faith, the State plans to use the same original card during the initial three (3) year term of any resulting contract. However, the State reserves the right to change the optional security features on the card at no charge or at a negotiated price.

D. Cards must not be able to be photographically reproduced.

E. Cards must be able to prove authenticity by the State, law enforcement, or others, for security reasons https://www.aamva.org/assets/best-practices,-guides,-standards,-manuals,-whitepapers/aamva-dl-id-card-design-standard-(2020) https://www.aamva.org/assets/best-practices,-guides,-standards,-manuals,-whitepapers/aamva-dl-id-card-design-standard-(2020) https://www.aamva.org/getmedia/19072a17-e9f2-45e0-975f-5e00588cb3f8/Design-Principles-and-Guidelines-for-Secure-DLID-Cards.pdf https://www.aamva.org/getmedia/19072a17-e9f2-45e0-975f-5e00588cb3f8/Design-Principles-and-Guidelines-for-Secure-DLID-Cards.pdf to determine if the card has been altered or is counterfeited.

2.15 INVENTORY MANAGEMENT

A. The Contractor shall provide a proposed Inventory Management Plan during the Discussions phase.

The Inventory Management Plan must, at minimum, meet all requirements set forth in this section of the RFP.

B. The Contractor shall supply an online real-time automated inventory control system that monitors inventory (consumables used by the system daily) levels at each location and automatically generates resupply orders when inventory reaches certain levels established by the State.

C. The Contractor shall provide a bar code scanning device, if required to scan the inventory barcode, for each card issuing location Statewide.

D. The Contractor shall supply all the required consumables, for each card issuing location Statewide, for the DL/ID Card Issuance Solution to work efficiently during the full period of any resulting contract.

E. System must require operators to manually indicate, to the inventory control system, when they use particular consumables, such as changing a ribbon in the printer.

F. The Contractor shall provide an inventory tracking system that will ensure accurate inventory reconciliation.

2.16 REAL-TIME DASHBOARD

A. The Contractor shall provide a real-time dashboard and access to authorized individuals on the

State side. Some of the data items that must be included in the dashboard are:

1. Services Repair items open during the previous month.

2. List all requests made during the previous month related to the Image Application Workstation (IWA) and Issuance Application.

3. Description of the item (laminator, camera, printer, monitor, workstation PC, signature pad, consumables, facial recognition, application, UPS, keyboard, mouse, and others).

4. Time repair request was made and duration to repair.

5. Indication of whether this is a repeated issue.

6. Status of the request if not resolved during the previous month.

7. All these above items must be grouped by card issuing location.

2.17 REPORTING AND ANALYTICAL REQUIREMENTS

A. The system must include a robust ad-hoc and pre-defined reporting functionality for DFA’s use.

B. The system must allow DFA to define new reports in the system and edit as needed without assistance or ongoing support from the Contractor.

C. The system must be able to export report data to a variety of formats including, but not limited to the following:

• Microsoft Excel

• .csv

• .txt

• .pdf

D. If the Contractor’s proposed solution requires the use of a third-party reporting tool such as Crystal

Reports, the costs of any and all required licenses to operate the reporting tool with the System must be included in the licensing cost proposed in the Official Bid Price Sheet.

E. The system must have the ability to batch print reports, allow advanced filtering, and set customized printouts.

F. The Issuance Solution must provide a detailed report of all security violations or attempts to gain access to the system.

G. The system must produce a report of the DL/ID cards issued by each location indicating the number of cards generated by the system. The report must include a count of cards issued and not issued. Cards not issued must be defined as to reason for not being issued, including errors, defects, equipment failures, etc.

H. AUDIT FUNCTIONALITY

1. The system must track all inquiries and data changes including, but not limited to, the following:

a. Date and time of inquiry and/or modification

b. Type of activity

c. Identification of the user

d. All fields inquired and/or modified

2. The system must provide a searchable log for every record viewed, including the above information.

3. Only Authorized users shall have the ability to login and view the audit details online.

2.18 IMPLEMENTATION AND TESTING

A. The Contractor shall provide a proposed Implementation and Testing Plan during the Discussions phase. The Implementation and Testing Plan must, at minimum, meet all the requirements set forth in this section of the RFP.

B. The Contractor shall deliver and install two (2) complete Pilot Program Systems, together with all necessary supplies to the State. Locations for these Pilot Program Systems will be determined at a later date.

C. Delivery of the Pilot Program Systems must be made at least 90 days prior to the date which product delivery and deployment is scheduled to commence.

D. The Implementation & Testing Plan must include a final acceptance testing phase in which the State can confirm that the system adheres to all contractual requirements. In the event that the solution does not conform with Contract requirements, the State may:

1. Grant the Contractor an opportunity to repair and/or modify the system and restart the testing; or

2. Upon mutual agreement, perform additional acceptance tests until the system(s) have operated within the specifications as stated in the Contract for thirty (30) consecutive days; or

3. Accept minor deviations from the specifications; or

4. Terminate the contract in its entirety

2.19 TRAINING

A. The Contractor shall provide a proposed Training Plan during the Discussions Phase. The Training Plan must, at minimum, meet all requirements set forth in this section of the RFP.

B. Contractor shall provide all training sufficiently in advance to the “Go-Live” of the proposed System such that all Users required to be trained have had a sufficient amount of exposure to capably use the system.

C. The Contractor shall conduct all training on site at the time of the installation of the equipment.

D. The Contractor shall provide all training materials and training for employee use of the Solution at all State locations where the DL/ID Card Issuance Solution is installed. Training materials must include, but not be limited to:

1. User manual

2. Frequently asked questions (FAQs)

3. Helpline phone numbers and how to submit an electronic request for help

4. Website URLs or location information for all other online and printed resources

E. In the event that the Contractor makes any material alterations to the solution, the Contractor shall be required to update the training materials accordingly. The Contractor shall provide updated training materials at no additional cost to the State.

F. The Contractor shall be responsible for providing a continuing education program for the duration of any resulting contract in the form of web-based tutorials, instructional videos, etc.

2.20 STAFFING

A. The Contractor shall provide a Staffing Plan during the Discussions phase. The Staffing Plan must, at minimum, meet the requirements set forth in this section of the RFP.

B. PROJECT MANAGER

The Contractor shall include in the Staffing Plan a Project Manager. The Project Manager shall, at a minimum:

1. Have three (3) years of project management experience working with the implementation of projects of similar size and scope to this RFP.

2. The Contractor Project Manager shall report to the State assigned Project Manager and manage the Contractor resources, produce project schedule/plan, status reports, attend meetings, and manage the software development life cycle.

3. Coordinate with the DFA through a staff team to finalize a solution, implement technology components, and manage needed changes to project scope.

C. The Contractor shall include, in the Staffing Plan, individuals with sufficient technical expertise and experience to accomplish the Implementation Plan.

D. DFA shall have the right to approve or reject proposed staff members prior to the finalization of the plan after Contract Award.

E. The Contractor shall include, in the Staffing Plan, a provision to address the vacancies of the Project Manager or other key personnel. In the event of the vacancy of a key person, the Contractor shall provide replacement candidates to DFA for review within fifteen (15) calendar days of the Contractor learning of the vacancy. DFA will have the right to approve or reject proposed replacements if they do not meet the minimum requirements set forth in the RFP.

F. The Contractor shall replace key personnel upon request by DFA for justified reasons including, but not limited to, performance, behavior, and security.

G. The Contractor shall provide and maintain sufficient staffing resources to provide timely service for the life of any resulting contract.

H. The Contractor shall not propose resources who are currently engaged full time on other contracts with the State. A single resource shall not hold more than one full time position with the State.

I. BACKGROUND CHECKS

1. At commencement of any resulting contract and prior to the hiring of staff, the Contractor shall provide proof of the background checks for all personnel involved in any aspect of the process described in this RFP at the Contractor’s expense as a requirement of any resulting contract.

2. The Contractor shall provide information necessary to conduct Criminal Background Checks on all key personnel and subcontractors who perform or supervise work on any resulting contract for purposes of auditing.

3. DFA will have the right to refuse personnel based on results of the criminal background checks.

2.21 SYSTEM UPTIME AND PERFORMANCE

A. The Contractor shall provide a proposed System Uptime and Performance Plan during the Discussions phase.

B. DFA will not provide dedicated bandwidth for the proposed solution and the system must not negatively impact or interfere with services from DFA’s other existing systems.

D. The Contractor shall minimize the bandwidth needed by the application in each phase of the DL/ID Issuance process as availability of total bandwidth varies between DFA Revenue locations.

E. The Contractor shall utilize data circuits in testing that can simulate that of a minimum 4MB bandwidth data circuit configuration to determine performance metrics that may be seen in some agency revenue locations.

F. Dedicated bandwidth will not be provided for the proposed solution and the system must not negatively impact or interfere with services from other existing systems.

G. The Contractor shall provide a monthly System Usage and Performance Report which shall include, at minimum, data related to the requirements set forth in this section of the RFP. The System Usage and Performance Report must be provided to DFA’s designee on the first business day of the month following the previous reporting period in a Microsoft Excel format

2.22 HOSTING

A. The Contractor shall provide a web-based DL/ID card printing application which the Contractor hosts in the cloud or on premise.

B. The issuance application architecture design must include recommended hardware specifications to successfully meet State of Arkansas requirements for performance and capacity.

C. All servers and data associated with the Arkansas instance of the Contractor Hosted Solution must reside in the continental United. States.

D. The State prefers the proposed system be hosted on a private cloud or a virtual private cloud.

For the purposes of this RFP, a private cloud is either a single-tenant environment where the hardware, storage, and network are dedicated to the State, or a virtual private cloud, a multi-tenant environment with network isolation and private subnets.

E. The Contractor shall perform all work on the proposed Solution from within the continental United States of America. The Solution must not be accessed from outside of the U.S.

F. The Contractor shall be responsible for the acquisition and operation of all hardware, software, and network support related to the hosting services being provided.

G. The Contractor shall develop and implement the system and all dependent hosted hardware in such a manner that allows for direct network communications with the Contractor’s system and the exchange of data via approved industry standard protocols for interfacing with other systems as deemed necessary.

H. The Contractor shall provision all the standard environments, such as development, testing, staging, and production.

I. The security controls employed within the Solution must meet or exceed requirements specified within this RFP and any other applicable regulatory requirements.

J. The Contractor shall provide configuration information, evidentiary documentation, or other information as is required in the event the State requires such information as to satisfy regulatory audit requirements in relation to the solution.

K. The Contractor shall keep all hosting-related software current and up to date.

2.23 REQUIRED INTERFACES

A. The Solution must integrate with the existing State Driver Licensing System of Record (SOR) for any data exchange between the Solution and SOR. The SOR is in the .NET framework.

B. The Solution must interface with the SOR via web service utilizing Representational State Transfer (REST) webservice to transmit data elements to and from the SOR system.

C. The Solution must be capable of consuming SOR System web services which will be hosted utilizing the latest version of Transport Layer Security (TLS) which will provide encryption of the information while in transit between the Solution and SOR.

D. DFA Office of Information Services will be the final authority in approving the proposed format and authentication method for all interfaces used between the SOR and the Contractor’s proposed solution.

E. The State will be responsible for the SOR System storage and retrieval processes for the image files.

2.24 DATA CONVERSION PLAN

A. The Contractor shall develop a proposed Comprehensive Customer Image and Data Conversion Plan for processing existing State files to create the initial Facial Recognition System database.

B. The Comprehensive Customer Image and Data Conversion Plan must accommodate the transfer of approximately twenty-three (23) million records. The photos will be in AAMVA standards, demographic information, and the rest of the fields from the front of the card.

2.25 USER ROLES

A. The system must authenticate and assign the appropriate level of access to users based on the appropriate user roles.

B. System Administrators shall be able to create custom user roles with security parameters that define access.

C. The system must be able to assign controls for multiple users via work group and/or roles.

D. The system must allow access levels to be custom defined.

2.26 SOFTWARE UPDATES

A. The Contractor shall provide any software changes and/or updates to implement Federal or State required changes during any resulting contract period. Changes and/or updates must comply with State or Federal implementation deadlines.

2.27 DATA SECURITY REQUIREMENTS

A. The Contractor shall provide a proposed Data Security Plan during the Discussions phase. The

Data Security Plan must, at a minimum, meet all requirements set forth in this RFP.

B. The Contractor shall not store any personally identifiable applicant information or driver’s license information for any time longer than necessary to issue a card.

C. All log files that may contain transactional data that could contain personally identifiable data or demographic data related to the transaction must be encrypted using AES-256.

D. All data being transmitted must be encrypted and all stored data must be encrypted at rest. Encrypting must be done with AES-256.

E. The Solution must be configurable to lock out an operator after a State-assigned number of failed attempts to log in.

F. In provision of the services anticipated by this RFP, the Contractor shall adhere to all applicable regulatory and statutory security requirements in the National Institute of Standards and Technology (NIST) SP 800-53 Rev 5. Framework (https://csrc.nist.gov/pubs/sp/800/53/a/r5/final), moderate baseline, or later revision (https://csrc.nist.gov/pubs/sp/800/53/b/upd1/final).

G. The Contractor shall establish and provide points of contact in relation to security matters. In the event of a known or suspected Security Breach, any unauthorized access to DFA information, or unauthorized disclosure of data must be reported to DFA Office of Information Services (DFA-OIS) within twenty-four

(24) hours of discovery. In the event of known or suspected unauthorized access to the Solution or unauthorized disclosure of data, the Contractor shall provide DFA-OIS an incident report detailing specifics of the incident including, at a minimum:

1. Date and time of discovery.

2. Scope of unauthorized access and/or disclosure of data.

3. Initial mitigation actions taken.

4. Any long-term mitigation action taken; and,

5. Date of resolution of closure of incident.

2.28 MAINTENANCE AND SUPPORT

A. The Contractor shall provide a proposed Maintenance & Support Plan during the Discussions phase.

The Maintenance & Support Plan must, at minimum, meet the requirements set forth in this section of the RFP.

B. The Contractor shall provide ongoing maintenance of the Solution for any resulting the contract.

C. The Contractor shall provide ongoing user and technical support beginning at the time of soft launch and continuing for any resulting contract.

D. The Contractor shall provide technical support between Monday – Friday 8:00 a.m. – 4:30 p.m.

Central Time, excluding State holidays.

E. The Contractor shall provide English speaking telephone support staff.

F. The Contractor shall provide properly trained user and technical support staff in sufficient quantities to support DFA.

G. The State may, at its discretion, choose to cancel or reduce technical support at any time during https://csrc.nist.gov/pubs/sp/800/53/a/r5/final https://csrc.nist.gov/pubs/sp/800/53/b/upd1/final the life of any resulting contract.

2.29 DISASTER RECOVERY

A. The Contractor shall provide a proposed Disaster Recovery Plan during the Discussions phase. The Disaster Recovery Plan must, at minimum, meet the requirements set forth in this section of the RFP.

B. The Contractor shall include the following in the final plan(s):

1. Plan Objectives

2. What situations and conditions are covered by the Plan

3. Technical considerations

4. System fail over plans

5. Roles and responsibilities of Contractor staff

6. How and when to notify the Contract Monitor

7. Recover procedures

8. Procedures for deactivating the Disaster Recovery Plan

C. The Contractor shall provide a complete Disaster Recovery solution equivalent to production setup.

D. DFA shall have the right to test the Disaster Recovery Plan during the final testing phase prior to the initial pilot and again during the initial pilot. DFA does not have to give advance notice for these tests.

E. Testing must include a complete fail over of all test/production systems to Disaster Recovery (DR) systems.

F. Any changes made to the production environment must have a demonstrated way to be replicated in the Contractor’s DR environment and must have a way for testing to be verified.

G. Changes to the DRP must require the review and approval of DFA Office of Information Services (OIS) IT staff.

H. The Contractor’s DRP solution must be tested annually according to the rules and regulations of DFA

OIS.

2.30 OPTIONAL STATE HOSTING (NOT SCORED)

A. DFA is interested in the possibility of hosting the Contractor’s system on site in Little Rock, Arkansas at a State Datacenter. Contractors may include as part of their proposal an optional scenario for a State Hosted Solution. At time of award, DFA may choose to pursue with the top ranked Contractor the proposed hosting method deemed to be most advantageous to the State. Contractors are not required to provide a proposal for Optional State Hosting in order to respond to this RFP. Proposals for Optional State Hosting should include at minimum:

1. The number of required web servers and recommended minimum specifications

2. The number of required application servers and recommended minimum specifications

3. The number of required SQL database servers and recommended minimum specifications

4. Recommended load balancing (if any)

2.31 DATA OWNERSHIP AND END OF CONTRACT TRANSITION

A. The State shall retain sole ownership, right, title, and interest to all data collected and stored by the

Contractor under any resulting contract, excluding intellectual property and exclusions governed by applicable State and Federal laws.

B. Data use by the Contractor shall be limited to its sole use in the provision of the services anticipated by this RFP. Any other use of State data collected by the Contractor shall require the express written approval of DFA.

C. At the end of any resulting contract and after confirmed transfer of 100% of the State-owned data, deliverables, and products the Contractor has created, developed, produced, and managed while performing the services outlined in this RFP back to the State or their designee, the Contractor shall destroy all copies of the State-owned data the Contractor possesses.

D. The Contractor shall ensure all data received as part of any resulting contract is used solely for the purpose of any resulting contract and not shared, reused, or disseminated to any other party or entity without the express written consent of the DFA designated representative or as otherwise required under applicable State and Federal laws.

E. Upon termination or expiration, should any subsequent contract for this or similar services be awarded to a provider other than the Contractor, the Contractor shall, to the greatest extent possible and reasonable, cooperate with the DFA in initiating a smooth and orderly transition to the next Contractor.

2.32 PERFORMANCE STANDARDS

A. State law requires that qualifying contracts for services include Performance Standards for measuring the overall quality of services that a Contractor shall provide.

B. The State may be open to negotiations of Performance Standards prior to contract award, prior to the commencement of services, or at times throughout the contract duration.

C. Performance Standards must not be amended unless they are agreed to in writing and signed by the parties.

D. Failure to meet the minimum Performance Standards as specified will result in the assessment of damages.

E. In the event a Performance Standard is not met, the Contractor will have the opportunity to defend or respond to the insufficiency. The State has the right to waive damages if it determines there were extenuating factors beyond the control of the Contractor that hindered the performance of services. In these instances, the State has final determination of the performance acceptability.

F. Should any compensation be owed to the Department due to the assessment of damages, the Contractor shall follow the direction of the Department regarding the required compensation process.

SECTION 3 – SELECTION PROCESS

3.1 SELECTION PROCESS

A. TSS OSP will review each Technical Proposal Packet to verify Submission Requirements have been met. Technical Proposal Packets that do not meet Submission Requirements will be rejected and will not be evaluated.

1. The State may conduct cost checks based on the cost submitted by each Prospective Contractor on the completed pricing response.

a. Prospective Contractors submitting Responsive Proposals with a proposed cost that falls twenty-five percent (25%) or more from the average…