S000000361 Medical Marijuana Seed to Sale Tracking System.pdf

STATE OF ARKANSAS

DEPARTMENT OF TRANSFORMATION AND SHARED SERVICES

OFFICE OF STATE PROCUREMENT

501 Woodlane St., Ste. 220

Little Rock, Arkansas 72201-1023

REQUEST FOR PROPOSAL

SOLICITATION DOCUMENT

SOLICITATION INFORMATION

Solicitation Number: S000000361 Solicitation Issued: September 9, 20204

Description: Medical Marijuana Seed to Sale Tracking System

Department: Department of Finance and Administration

SUBMISSION DEADLINE AND DELIVERY OF RESPONSE DOCUMENTS

Proposal Opening Date: October 3, 2024 Proposal Opening Time: 10:00 AM, Central Time

Proposal submissions for this Request for Proposal must be submitted through ARBuy, the State’s eProcurement system. It can be accessed at arbuy.arkansas.gov. Proposals received after the submission deadline may be rejected as untimely.

LIVE PROPOSAL OPENING INFORMATION

Teams Meeting Link:

Join the meeting now

Meeting ID: 281 386 174 021

Passcode: 9FvM9r

Call in (audio only): 501.244.3310 or find a local number

TSS OFFICE OF STATE PROCUREMENT CONTACT INFORMATION

TSS OSP Procurement Specialist:

Josh Williams Procurement Specialist’s Direct Phone Number:

501-371-5701

Email Address: Joshua.Williams@arkansas.gov TSS OSP’s Main Number: 501-324-9316

TSS OSP Website: transform.ar.gov/procurement/ https://arbuy.arkansas.gov/ https://teams.microsoft.com/l/meetup-join/19%3ameeting_OTBhNDAwYzgtYjRhMC00NmQxLWE2YjEtNzlmODc3YTk2MWM1%40thread.v2/0?context=%7b%22Tid%22%3a%225ec1d8f0-cb62-4000-b327-8e63b0547048%22%2c%22Oid%22%3a%22228b97a9-d833-4482-92cb-0966075cde71%22%7d https://dialin.teams.microsoft.com/6b6513dc-a034-48d2-8d06-7e711c4ecc0b?id=719036839 https://www.transform.ar.gov/procurement/

Rev 9/2024

SECTION 1 – GENERAL INFORMATION AND INSTRUCTIONS

1.1 INTRODUCTION

This Request for Proposal (RFP) is issued by the TSS Office of State Procurement (TSS OSP) for the Arkansas Department of Finance and Administration (DFA) and the Alcoholic Beverage Control (ABC) to obtain pricing and a contract(s) for a Medical Marijuana Seed to Sale Tracking Solution.

Contract(s) will be awarded to the Prospective Contractor determined to have submitted the proposal that is the most advantageous to the State. Direct all questions, comments, or concerns regarding this solicitation to the TSS OSP, not the Department.

1.2 TYPE OF CONTRACT

A. As a result of this RFP, TSS OSP intends to award a contract to a single Contractor.

B. The anticipated starting date for any resulting contract is November 2024, except that the actual contract start date may be adjusted unilaterally by the State for up to three (3) calendar months. By submitting a signed proposal in response to the RFP, the Prospective Contractor represents and warrants that it will honor its proposal as being held open as irrevocable for this period.

C. The initial term of a resulting contract will be for one (1) year. Upon mutual agreement by the Contractor and Department, the contract may be renewed by TSS OSP for up to six (6) additional one-year terms or portions thereof, not to exceed a total aggregate contract term of seven (7) consecutive years.

1.3 DEFINITION OF TERMS

A. Unless otherwise defined herein, all terms defined in Arkansas Procurement Law have the same meaning herein.

B. “Cloud” means a platform of hosted IT services.

C. “Cloud Service Provider” means the host of IT services.

D. “DR” means Disaster Recovery.

E. “DRP” means Disaster Recovery Plan.

F. “EULA” means End User License Agreement.

G. “Licensee” means any person or entity that holds a valid license by the State of Arkansas to own, operate, or subcontract production centers and retail dispensing locations, pursuant to Amendment No. 98 of the Constitution of the State of Arkansas and the laws of the State of Arkansas.

H. “MMJ” means Medical Marijuana.

I. “MMC” means Medical Marijuana Commission.

J. “Operator” means the cultivation, dispensary, processor, distributor, transporter, employee/users, or other State employee/users who are operating within the Seed to Sale System.

K. “OS” means Computer Operating System.

L. “Prospective Contractor” means a responsible offeror who submits a proposal in response to this Solicitation.

M. The terms “Request for Proposal,” “RFP,” and “Solicitation” are used synonymously in this document.

N. “Requirement” means a term, condition, provision, deliverable, Specification, or a combination thereof, that is obligated under the Solicitation, resulting contract, or both.

O. “Responsive Proposal” means a proposal submitted in response to this Solicitation that conforms in all material respects to this RFP.

P. “S2S” means MMJ Seed to Sale Tracking Solution.

Q. “SaaS” means Software as A Service-Software which is a hosted service which is accessible via the internet.

R. “Security Breach” means any compromise of the security, confidentiality, or integrity of an information system, including but not necessarily limited to any unauthorized access to information, destruction of information, modification of information, acquisition of information, or disclosure of information.

S. “Shall” and “must” mean the imperative and are used to identify Requirements.

T. “SLA” means Service Level Agreement.

U. “SLO” means Service Level Objective.

V. “Solution” means MMJ S2S Tracking Solution unless otherwise clarified in context.

W. “Specification” means any technical or purchase description or other description of the physical or functional characteristics, or of the nature, of a commodity or service. “Specification” may include a description of any Requirement for inspecting, testing, or preparing a commodity or service for delivery.

X. “State” means the State of Arkansas. When the term “State” is used herein to reference any obligation of the State under a contract that results from this Solicitation, that obligation is limited to the Department using such a contract.

Y. “System” means the MMJ S2S Tracking Solution unless otherwise clarified in context.

1.4 SOLICITATION SCHEDULE

For informational purposes, TSS OSP is providing a Solicitation Schedule; however, dates listed and noted with an asterisk (*) are anticipated dates only and are subject to change at the discretion of the State. All times are listed in Central Time.

TABLE A: TENTATIVE SOLICITATION SCHEDULE

ACTIVITY DATE

RFP Release to Prospective Contractors September 9, 2024

Deadline for Prospective Contractor Questions September 15, 2024

Answers to Questions Posted to ARBuy* September 18, 2024

Proposal Due Date October 3, 2024 @ 10am Central

Initial Proposal Evaluation* October 4, 2024

Interviews/Oral Presentations-Demonstrations* October 9-11, 2024

Final Proposal Evaluation* October 11, 2024

Discussions Kick Off Meeting* October 16, 2024

Finalize Discussions* October 23, 2024

Post Anticipation to Award* October 25, 2024

Award Contract* November 18, 2024

1.5 CLARIFICATION OF SOLICITATION

A. Submit questions requesting clarification of information contained in this Solicitation via the

Solicitation posting in ARBuy by the date and time listed in Table A.

1. For each question submitted, Prospective Contractor should reference the specific Solicitation item number to which the question refers, as applicable.

2. Prospective Contractors’ written questions will be consolidated and responded to by the State as deemed appropriate. The State’s consolidated written response is anticipated to be posted to the Solicitation posting in ARBuy by the close of business on the date provided in Table A. If

Prospective Contractor questions are unclear or non-substantive in nature, the State may request clarification of a question(s) or decline to answer.

B. The Prospective Contractor should notify the TSS OSP Procurement Specialist of any Requirements that precludes the Prospective Contractor from submitting a Responsive Proposal.

C. Prospective Contractors may contact the TSS OSP Procurement Specialist with non-substantive questions at any time prior to the proposal opening.

D. An oral statement by TSS OSP will not be part of any contract resulting from this Solicitation and may not reasonably be relied on by any Prospective Contractor as an aid to interpretation unless it is reduced to writing and expressly adopted by TSS OSP.

E. Only an addendum written and authorized by the State will modify the Solicitation.

1.6 RESPONSE DOCUMENTS

A. All proposal responses must be submitted through ARBuy, the State’s eProcurement system. The system can be accessed at arbuy.arkansas.gov.

1. Prospective Contractors must be registered in ARBuy to submit proposals responses.

B. Technical Proposal Packet

1. Prospective Contractors shall utilize the Technical Proposal Packet to submit their responses.

2. The following items are proposal Submission Requirements and must be submitted as part of a Prospective Contractor’s proposal response.

a. Signed Proposal Signature Page; signature may be ink or digital.

b. Technical Proposal response to the Information for Evaluation section included in the Technical Proposal Packet, which must be in the English language.

c. Completed Official Solicitation Price Sheet attached to the Solicitation in ARBuy.

i. Pricing must be proposed in U.S. dollars and cents.

ii. Quantities stated are estimates only and are not guaranteed. Prospective Contractor must submit unit price on the estimated quantity and unit of measure specified.

• The State may order more or less than the estimated quantity on term contracts, and the Contractor shall sell to the Department quantities ordered at no more than the submitted price.

iii. If pricing documents do not allow for accurate pricing, Prospective Contractor should notify the OSP Procurement Specialist at least seventy-two (72) hours before the proposal opening time.

iv. Prices must be firm offers and adjustments may be negotiated at the time of contract renewal.

• Include this bullet if price increase is an option: A request for a price increase must include supporting documentation demonstrating that the increase in contract price is based on an increased cost to the Contractor and that the proposed pricing is still competitive in the marketplace. The State has the right to approve or deny any request for a price adjustment.

v. Discount from list pricing is not acceptable unless requested elsewhere in the Solicitation.

vi. State or local sales taxes should not be included in the price. Trade discounts should be deducted from the unit price and the net price should be shown in the pricing response.

d. Recommended Options Form https://arbuy.arkansas.gov/

i. The Recommended Options form included in the Technical Proposal Packet allows Prospective Contractors to identify any recommended options or optional service ideas that may benefit the State that were not included in the Requirements and the proposed solution.

e. Copy of Prospective Contractor’s Equal Opportunity Policy

i. Pursuant to Arkansas Code Annotated § 19-11-104, OSP requires a Prospective Contractor bidding on a state contract to submit a copy of the Prospective Contractor’s Equal Opportunity (EO) Policy.

ii. Prospective Contractors not required by law to have an EO Policy must submit a written statement to that effect.

f. Proposed Subcontractors Form (see SRV-1, section 14)

3. The following items, which must be submitted prior to a contract award to the Prospective Contractor, may also be included with the Prospective Contractor’s proposal:

a. EO 98-04: Contract and Grant Disclosure Form (see SRV-1, section 11)

b. Voluntary Product Accessibility Template (VPAT), if applicable

4. Prospective Contractors should not include any other documents or ancillary information, such as a cover letter or promotional/marketing information.

C. Redacted copy of the Technical Proposal Packet

1. One (1) redacted (marked Redacted) copy of the Prospective Contractor’s proposal response (see Proprietary Information), if applicable.

D. Prospective Contractors should not alter language in Solicitation document(s) or Official Solicitation Price Sheet provided by the State.

E. Prospective Contractor’s proposals cannot be altered or amended after the proposal opening except as permitted by law or rule.

F. Prospective Contractors may submit multiple proposals.

https://www.transform.ar.gov/wp-content/uploads/Services-Contract-SRV-1-Fillable-Form-V.3.6.27.22.pdf https://www.transform.ar.gov/wp-content/uploads/Services-Contract-SRV-1-Fillable-Form-V.3.6.27.22.pdf https://www.section508.gov/sell/vpat/

SECTION 2 – REQUIREMENTS

2.1 BACKGROUND AND ENVIRONMENT

The Arkansas Medical Marijuana Amendment of 2016 (AMMA) tasked the Arkansas Department of Health (ADH) and the Arkansas Alcoholic Beverage Control (ABC) with regulating the safety, quality, manufacture, processing, packaging, disposal, labeling, advertising, and dispensing of usable marijuana to qualifying patients and designated caregivers. The agencies are tasked with licensing facilities, employees, caregivers, certifying patients, and creating rules and regulations for the medical marijuana program and industry. The ABC is specifically required to administer and enforce the rules promulgated and provisions of AMMA.

The ABC is also responsible for adopting standard procedures for conducting inspections and investigations of licensed medical marijuana facilities to ensure compliance with rule and law. The ABC implements programs to make medical marijuana available to qualifying patients and designated caregivers in a safe, efficient, and effective manner and prevent the diversion of medical marijuana to non-authorized individuals and entities.

2.2 CURRENT TECHNOLOGY ENVIRONMENT

The current Arkansas State Traceability and Enforcement System (ARSTEMS) program was developed by Bio-Track. The contract is currently managed by the Arkansas Department of Health. ARSTEMS communicates data to several other operating systems though a webservice.

ARSTEMS communicates data to the following operating systems:

Arkansas Department of Health Patient and Caregiver Registry System ADH per the AMMA is required to register and certify qualifying medical marijuana patients and caregivers. They issue the patients and caregivers Registry Identification Cards (RIC) through an application process. The ADH application system is linked to ARSTEMS. The ADH system communicates card status, expiration, individual card holder information, and allotment availability to

ARSTEMS.

Arkansas Crime Information Center (ACIC) ACIC is the state agency responsible for providing information technology services to law enforcement and other criminal justice agencies in Arkansas. ACIC interfaces with ARSTEMS and the ADH to validate patient, caregiver, and employee RICs. This interface is also utilized to verify medical marijuana delivery manifest between licensed facilities. The interface communicates among the system via a web service to validate the manifest.

Alcoholic Beverage Control Administration Tyler Technologies Licensing System Portal ABC Administration uses this system to license medical marijuana facilities and transporters. This system is also used to issue RICs to individuals allowed to access, work inside, own and operate the facilities.

This system integrates with ARSTEMS and ACIC. The interface communicates via a web service to load the license information into the Seed to Sale Solution (S2S) as well as the employees to create the manifest for marijuana deliveries.

Other Commercial Systems Licensees of medical marijuana facilities including laboratories may have other commercial inventory and sales management systems that must integrate into ARSTEMS. The State does not support these systems. The interface communicates via a web service with the laboratory solution.

2.3 OBJECTIVE AND GOALS

The ABC seeks to obtain a thorough and robust medical marijuana product tracking system which maintains product accountability throughout the entire manufacturing, production, and dispensing process. The State requires a seed-to-sale system to allow for efficient tax and inventory audits, to protect the public health, prevent diversion and inversion, and to facilitate the enforcement of the regulations. While being cognitive of the unique regulatory challenges and fluctuating federal legal status of marijuana, the seed-to-sale system will allow the State of Arkansas to enact a robust regulatory framework around a legal Arkansas Medical Marijuana Program.

2.4 PROSPECTIVE CONTRACTOR MINIMUM QUALIFICATIONS

A. The Prospective Contractor shall have a minimum of five (5) years of implementing Marijuana

Seed to Sale Tracking Solutions of similar size and scope to those described in this RFP.

B. The Prospective Contractor shall have successfully implemented the proposed S2S for a minimum of three (3) or more states and must currently be in use.

2.5 REGULATIONS AND COMPLIANCE

A. The Contractor shall provide any S2S changes and/or updates to implement Federal or State required changes during the contract period. Changes and/or updates must comply with State or Federal implementation deadlines at no additional cost to the State. Any required updates must be implemented in a timely fashion and should be implemented outside of normal S2S operating hours to minimize disruptions to S2S operations.

2.6 SYSTEM ACCESS

A. The Contractor shall provide user access to the S2S through a secure, web-based portal.

B. The S2S must provide a user-friendly administrative interface with automated workflows for common functions (referrals, applications, eligibilities, plans, performance-data collection, reports, etc.).

C. The S2S should stress consistency across all the different modules so that the process is easy to learn and understand.

D. The S2S must be browser and operating system agnostic for all user types and should function accurately on common modern browsers such as Microsoft Edge, Chrome, Firefox, and Safari.

E. The S2S must not require additional browser plug-ins, add-ons, or helper applications.

F. The S2S must have a Responsive User Interface (RUI) and be accessible and function normally from mobile devices such as tablets, smartphones, and chrome books. This must include, but is not limited to, iPhones, iPads, and Android based phones and tablets.

2.7 MEDICAL MARIJUANA SEED TO SALE TRACKING SOLUTION (S2S)

A. The S2S must provide in real time for the total amount of marijuana and manufactured marijuana product purchased by a qualifying patient or by a caregiver for a qualifying patient from the dispensary’s retail dispensing locations in the State in any fourteen-day period.

B. The S2S must make the State’s MMJ enforcement efforts as efficient as possible while not overburdening the licensees.

C. The S2S must be able to track the following information, including but not limited to:

1. The total amount of marijuana in possession of all dispensaries from either seed or immature plant state, including all plants that are derived from cuttings or cloning, until the marijuana, marijuana plants, or manufactured marijuana product is sold or destroyed.

2. The total amount of manufactured marijuana product inventory, including the equivalent physical weight of marijuana that is used to manufacture manufactured marijuana products in the State in real-time.

3. The total amount of marijuana purchased by a qualifying patient and primary caregiver from all retail dispensing locations in the State in real-time based on a 14-day rolling allotment of 2.5 ounces of usable marijuana.

4. The amount of unused organic material produced by each plant at harvest.

5. The transport of marijuana and manufactured marijuana products between production centers and retail dispensing locations, including tracking identification issued by the S2S, the identity of the person transporting the marijuana or manufactured marijuana products, and the means of transport including the make, model, and vehicle identification number of the vehicle used for transport.

D. The S2S must be accessible to all marijuana establishments to enter all transactions, current inventory, and other required information as determined by the ABC pertaining to cultivation, processing, transfer, retail, and testing of marijuana and marijuana products in all forms.

E. The S2S must track and trace and retain records of each sale of marijuana and marijuana products in all forms, marijuana transfers and transportation by licensees, including information on licensee, date, time, quantity, price, tax, and other required information as determined by ABC. The records must be stored on the Contractor’s system for three (3) years.

F. The S2S must provide real time verification that a transaction will not exceed the limit that a qualifying patient or a marijuana establishment is authorized to receive under the regulations governing medical and adult-use marijuana.

G. The S2S must provide a unique, non-repeating identification number for every plant and inventory item recorded in the S2S.

H. The S2S must allow for the entry of routes and trip tickets for transportation manifests.

I. The S2S must send notifications to ABC based on triggering events as determined by ABC.

J. The S2S must prevent sales of certain state identified products and/or stop sales and transactions from specific licensees.

K. The S2S must lock, suspend, or permanently revoke licenses to prevent user access to the system as well as halting all sales to or from the licensee or dispensary.

2.8 IRREGULAR ACTIVITY

A. The S2S must identify "irregular" cannabis supply chain activity based on ABC defined criteria and thresholds and provide system based notifications to designated users in the event irregular activity is identified.

B. The Contractor shall provide ABC guidance based on market information available in Arkansas and other jurisdictions to set effective irregular flags.

C. As market conditions change, the Contractor shall have ongoing discussions with ABC to revisit and modify the parameters of irregularity flags.

D. ABC will designate the criteria used to flag irregular activity and will refine these criteria over time.

E. The S2S must flag irregularities for ABC to investigate. The S2S must automatically flag irregularities based on identified criteria and allow ABC to review the specific cannabis supply chain activity information that is flagged as irregular.

F. The Contractor shall notify ABC of irregularities in cannabis supply chain activity (e.g., weight loss during harvest drying that falls outside expected limits, weight loss during distribution, etc.).

G. For each type of license, the S2S must provide ABC access to designate specific criteria to be used by the S2S to automatically detect and flag irregularities for ABC to investigate. The S2S must provide ABC access to revise and update these criteria based on its evolving knowledge and experience, as well as other feedback and broader changes in market conditions.

H. The S2S must provide ABC access to produce one or more report(s) identifying cannabis activity that is considered “irregular”, based upon ABC specified criteria.

I. The S2S must provide ABC access to view a record of all changes made to the configurable parameters and algorithm data elements used to flag irregularities to audit and refine any such changes made over time.

2.9 ONLINE REAL TIME DASHBOARD

A. The Contractor shall provide a customizable online dashboard that is capable of displaying real time information from all data points captured by the S2S.

B. The dashboard must be configurable to meet agency needs without assistance or ongoing support from the Contractor.

C. The dashboard must be customizable for each individual user.

D. The dashboard must restrict access to information by user role.

E. The dashboard must allow data to be exported in a Microsoft Excel format.

F. The S2S must include a pre-configured Daily and Weekly/’Red Flag dashboard which must include, at minimum, the following:

1. All plants more than 180 days old.

2. Unique Identify Number ‘UIN’.

3. Discrepancies between delivery manifest and received items.

4. Delivery rejections or manifest discrepancies

G. The S2S must include predefined real-time dashboards for the reports described in Section 2.10.E- G.

H. Predefined dashboards must be customizable to allow users to add or remove data points as required.

2.10 REPORTING AND AUDIT FUNCTIONALITY

A. The system must include a robust ad-hoc and pre-defined reporting functionality for DFA’s use.

B. The system must allow DFA to define new reports in the system and edit as needed without assistance or ongoing support from the Contractor.

C. The system must be able to export report data to a variety of formats including, but not limited to the following:

• Microsoft Excel

• .csv

• .txt

• .pdf

D. If the Contractor’s proposed solution requires the use of a third-party reporting tool such as Crystal Reports, the costs of any and all required licenses to operate the reporting tool with the System must be included in the licensing cost proposed in the Official Bid Price Sheet.

E. The system must produce a Medical Marijuana Sales Month Compared to Previous Month Sales Report that must, at minimum, include:

1. Sales ranking of cultivation facilities-wholesale

2. Sales data

3. Excise tax

4. Percentage month sales compared to previous month sales

F. The system must produce a Sales Ranking of Dispensaries-Retail Report that must, at minimum, include:

1. Difference - rank in zone

2. Sales ranking of dispensaries-retail

3. Sales in zone

4. Percentage of overall sales by zone

G. The system must produce a Census Report that must, at minimum, include:

1. 2020 (or newer) census population rank by county

2. Arkansas county name

3. 2020 (or newer) census population

4. Arkansas medical marijuana zone

5. percentage of Arkansas population

6. month sales per zone, percentage of overall retail sales by zone

7. Number of possible active patients based on month ASH annual report 82417

8. Approved’ patients applying percentage of Arkansas 2020 (or newer) census population data per zone

9. Average possible purchases to dollars per ‘Active’ patient for March 2014 by zone

H. The system must produce a Sales Ranking of Cultivation Facilities-Wholesale Report that must, at minimum, include:

1. Sales ranking

2. Inventory type

3. Quantity

4. Total usable weight in grams

5. Comparison of month to previous month

I. The system must produce a Bulk Flower Lot Sales report that must, at minimum, include:

1. Cultivator

2. Bulk Pounds Sold

3. Percentage of statewide sales

J. The system must produce a Month (Year) Inventory Adjustments by Licenses and Dispensary Retail Sales Transactions Report which must, at minimum, include:

1. Dispensaries

2. Number of inventory adjustments

3. Percentage of adjustments

4. Dispensary retail sales transactions

5. Percentage of retail sales transactions

2.11 AUDIT FUNCTIONALITY

A. The system must track all historical inquiries and data changes including, but not limited to, the following:

1. Date and time of inquiry/modification

2. Type of activity

3. Identification of the user

4. All fields inquired and/or modified

B. Authorized State Admin Users shall have the ability to login and view the audit details online.

2.12 DATA CONVERSION

A. The Contractor shall be responsible for migrating existing legacy data stored in the current

ARSTEMS which must include at minimum the following:

1. Patient sales data

2. Geographical/address/licensee data

3. Employee data

4. QA test results for usable marijuana

5. Harvest and lineage data

6. Wholesale and retail sales data

7. Usable weight conversion data

B. Data converted must, at minimum, include a three-year lookback for the data required above.

C. The converted data must be available for use at time of Go Live as if that information had been originally captured by the system.

2.13 REQUIRED INTERFACES

A. The S2S must interface in real-time the ADH Patient & Caregiver Registry (BioTrack product), referred to as “The Patient Portal”, to communicate card status, expiration, individual card holder information, and allotment availability.

B. The S2S must interface with the Arkansas Crime Information Center (ACIC)’s SYSTEM NAME to validate patient, caregiver, and employee RICs and verify medical marijuana delivery manifests between licensed facilities. The interface will need to communicate via a web service and/or a sequel server to validate the manifests.

C. The S2S must interface with the Alcoholic Beverage Control Administration’s Licensing System from Tyler Technologies to load license information for Marijuana Facilities and Transporters, as well as individuals authorized to access, work inside, and own and operate the facilities. The system must interface via web service to load the license information, as well as allow the employees to create the manifests for marijuana deliveries.

D. The S2S must be capable of interfacing with other third-party commercial inventory and sales management systems used by licensees of medical marijuana facilities and laboratories. The State does not support this system. Cost of these interfaces will be the responsibility of the individual facilities. The interface will need to communicate via web service with these third-party solutions.

2.14 IMPLEMENTATION AND TESTING

A. The Contractor shall provide a proposed Implementation & Testing Plan during the Discussions

Phase. The Implementation & Testing Plan must, at minimum, meet all requirements set forth in this section of the RFP.

B. The Implementation Plan start date must coincide with the date of contract award.

C. The Implementation Plan must be resource balanced. The plan must include but not be limited to the following:

1. Project Workplan

2. Organizational redesign in support of transformational business process reengineering and implementation of new functionality.

3. Implementation of a Communications Strategy and Plan.

4. Implementation of a Migration Plan to migrate existing legacy data stored in the current ARSTEMS into the proposed S2S.

5. Recommended implementation timeline, staff responsibilities, and estimated hours of effort.

6. Activities and tasks assigned to a primary owner of either Contractor resource or State resource.

7. Estimated start and end date along with estimated hours of effort must be included for each activity and tasks.

D. The Contractor shall coordinate with the State Project Manager and submit Project Status Reports to all state identified stakeholders, which must include, but not be limited to the following:

1. Description of tasks completed during the period allocated by the project team

2. Tasks in-progress

3. Tasks delayed and reasons for delay

4. Problems encountered with a plan for resolving them

5. Issues requiring management attention, particularly those which may affect the scope of services, the project budget, timeline, or deliverables.

2.15 TRAINING

A. The Contractor shall provide a proposed Training Plan for the delivered S2S during the Discussions

Phase. The Training Plan must, at a minimum, meet all requirements set forth in this section of the

RFP.

B. The Contractor shall provide all training sufficiently in advance to the “Go-Live” of the proposed S2S such that all Users required to be trained have had a sufficient amount of exposure to capably use the S2S.

C. The Contractor shall deliver training to S2S users after initial deployment and major releases that change functionality.

D. The Training Plan must address the training requirements of all defined user types/roles.

E. The Contractor shall provide a continuing education program for the duration of the contract.

F. The Contractor shall develop and provide a State of Arkansas specific user manual for the S2S.

G. The Contractor shall provide at a minimum the following training materials for the life of the contract:

1. Online access to a specific Arkansas user manual of the S2S.

2. Frequently asked questions (FAQ) list.

3. Helpline phone numbers and how to submit an electronic request for help.

4. Website URLs or location information for all other online and printed resources.

2.16 STAFFING

A. The Contractor shall provide a Staffing Plan during the Discussions Phase. The Staffing Plan must, at minimum, meet all requirements set forth in this section of the RFP.

B. PROJECT MANAGER

The Contractor shall include in the Staffing Plan a Project Manager. The Project Manager shall, at a minimum:

1. Have two (2) years of project management experience working with the implementation of projects of similar size and scope to this RFP.

2. Report to the State assigned Project Manager and manage the Contractor resources, produce project schedule/plan, status reports, attend meetings, and manage the S2S development life cycle.

3. Coordinate with DFA through a staff team to finalize a S2S, implement technology components, and manage needed changes to project scope.

C. DFA shall have the right to approve or reject proposed staff members prior to the finalization of the plan after Contract Award.

D. The Contractor shall include, in the Staffing Plan, a provision to address the vacancies of the Project Manager or other key personnel. In the event of the vacancy of a key person, the Contractor shall provide replacement candidates to DFA for review within fifteen (15) Calendar Days of the Contractor learning of the vacancy. DFA shall have the right to approve or reject proposed replacements if they do not meet the minimum requirements set forth in the RFP.

E. The Contractor shall replace Contractor Personnel upon request by DFA for justified reasons including but not limited to performance, behavior, and security.

F. The Contractor shall provide and maintain sufficient staffing resources to provide timely service for the life of the contract.

G. The Contractor shall not propose resources who are currently engaged full time on other contracts with the State. A single resource may not hold more than one full time position with the State.

H. BACKGROUND CHECKS

1. At commencement of contract award and prior to the hiring of staff, DFA shall conduct Federal and State Criminal Background Checks on all personnel involved in any aspect of the process described in this RFP.

2. The Contractor shall provide information necessary to conduct Criminal Background Checks on all personnel and subcontractors who perform or supervise work on this contract for purposes of auditing.

3. DFA shall have the right to refuse personnel based on results of the criminal background checks.

4. The Contractor shall remove any Contractor Personnel from working on the Contract where the State determines, at its sole discretion, that said Contractor Personnel has not adhered to the Security requirements specified herein.

2.17 SYSTEM UPTIME AND PERFORMANCE

A. The Contractor shall provide a proposed System Uptime and Performance Plan during the

Discussions Phase. The System Uptime and Performance Plan must, at minimum, meet the requirements set forth in this section of the RFP.

B. The S2S must be capable of supporting approximately 700 concurrent users.

C. The S2S must be available twenty-four (24) hours a day seven (7) days a week except for approved system maintenance outages.

D. DFA will provide network connectivity to the website from all DFA locations. Availability of bandwidth for Cultivation and Dispensary (non-state) locations shall not be provided by DFA.

E. Connectivity and acceptable bandwidth levels from Cultivation and Dispensary sites will be the responsibility of those entities.

F. The Contractor shall minimize the bandwidth needed by the application in each of the business processes as availability of total bandwidth varies between locations.

G. The Contractor shall utilize data circuits in testing that can simulate that of a T1 data circuit configuration to determine performance metrics that may be seen in some more remote locations.

H. Dedicated bandwidth will not be provided for the proposed S2S and the S2S must not negatively impact or interfere with services from other existing systems.

I. The Contractor shall provide a monthly System Uptime and Performance Report which must include, at minimum:

1. Data related to the requirements set forth in this section of the RFP

2. System uptime/availability for the previous month

3. System response times between user requests and the applications

4. Any narratives related to system downtime or performance degradation and an outline of the cause of the outage/degradation

J. The System Usage and Performance Report must be provided to DFA’s designee no later than two

(2) weeks from the end of the previous month.

2.18 HOSTING

A. The Contractor shall propose a Contractor hosted S2S.

B. All servers and data associated with the Arkansas instance of the Contractor Hosted S2S must reside in the continental United States.

C. The Contractor shall provision all environments including but not limited to separate development, testing, and production environments.

D. The State prefers the proposed S2S be hosted on a private cloud or a virtual private cloud. For the purposes of this RFP, a private cloud is either a single-tenant environment where the hardware, storage, and network are dedicated to the State, or a virtual private cloud, a multi-tenant environment with network isolation and private subnets. Contractors may propose other types of cloud in their proposal, but preferential scoring will be given for private or virtual private cloud.

E. The Contractor shall perform all work on the proposed S2S from within the continental United States of America. The S2S must not be accessed from outside of the U.S.

F. The Contractor shall provide configuration information, evidentiary documentation, or other information as is required in the event the State requires such information as to satisfy regulatory audit requirements in relation to the S2S.

G. The Contractor shall keep all hosting-related S2S current and up to date

2.19 USER ROLES

A. The Contractor shall setup initial account access for each organization, including the creation of an

Admin User who will then have access to set up individual users under the organization’s account and assign proper user roles and access levels.

B. The S2S must provide identity management capability for users which includes the option for Multifactor Authentication (MFA).

C. The S2S must authenticate and assign the appropriate level of access to users based on the appropriate user roles.

D. The S2S must include a user administration management functionality that allows DFA to provision access and assign user roles to State Users.

E. State Admin Users shall have the ability to suspend accounts across all entities and all user types.

F. System Administrators must be able to create custom user roles with security parameters that define access.

G. The S2S must support multiple access levels within the S2S.

H. Configuration parameters must be editable and extendable without system redeployment.

I. The S2S must allow for a mixture of private employees and state employees in the Seed to Sale system with different roles and responsibilities.

2.20 MAINTENANCE AND SUPPORT

A. The Contractor shall provide a proposed Maintenance & Support Plan during the Discussions Phase.

The Maintenance & Support Plan must, at minimum, meet the requirements set forth in this RFP and resulting contract.

B. The Contractor shall provide a manufacturer-authorized, standby, service staff whose priority is to respond immediately when calls are received from any of the state permitted cultivation facilities and dispensary facilities, as well as state administration and state law enforcement.

C. The Contractor shall be responsible for providing ongoing maintenance of the S2S for the life of the contract and provide a support number.

D. The Contractor shall provide the State support from 7am - 10pm Central seven (7) days a week at a minimal with access to a U.S. based, English speaking technical support personnel for all S2S related issues.

E. The Contractor must provide properly trained Customer and Technical Support staff in sufficient quantities to support DFA and S2S Industry Users.

F. The State may at its discretion choose to cancel or reduce Customer support at any time during the life of the contract.

G. The Contractor shall provide a Monthly Status Report which must include, at minimum:

1. All requests that are open at the end of the month, along with a status of each

2. All requests that were closed in the previous month narrating the outcome of the request

H. The Monthly Status Report must be provided to DFA’s designee no later than two (2) weeks from the end of the previous month.

I. All monthly reports will be reviewed by DFA along with the Contractor’s support team and management. Monthly meetings must be held with DFA to discuss monthly reports and pending service issues. Meetings may be called on an as needed basis by DFA.

2.21 DATA SECURITY

A. The Contractor shall provide a proposed Data Security Plan during the Discussions Phase. The Data

Security Plan must, at minimum, meet all requirements set forth in this section of the RFP.

B. The Contractor shall adhere to all applicable regulatory and statutory security requirements, including but not limited to the National Institute of Standards and Technology (NIST) SP 800-53 Rev

5. Framework (https://csrc.nist.gov/pubs/sp/800/53/a/r5/final), moderate baseline, or later revision.

(https://csrc.nist.gov/pubs/sp/800/53/b/upd1/final).

C. The Contractor shall establish and provide points of contact in relation to security matters. In the event of a known or suspected Security Breach, any unauthorized access to DFA information, or unauthorized disclosure of data must be reported to DFA Office of Information Services (DFA-OIS) within twenty-four (24) hours of discovery. In the event of known or suspected unauthorized access to the system or unauthorized disclosure of data, the Contractor shall provide DFA-OIS an incident report detailing specifics of the incident including, at a minimum:

1. Date and time of discovery

2. Scope of unauthorized access and/or disclosure of data

3. Initial mitigation actions taken

4. Any long-term mitigation action taken; and

5. Date of resolution of closure of incident

D. All data in transit and at rest must be encrypted with AES-256 minimum.

E. The S2S must provide a detailed report of all security violations or attempts to gain access to the S2S.

F. The S2S must include a complex or strong password requirement.

G. The S2S must be configurable to lock out a user after a State-assigned number of failed attempts to log in

H. The security controls employed within the S2S must meet or exceed requirements specified within this RFP and any other applicable regulatory requirements.

I. The S2S must provide for system and transactional logging. Logs must be available for export in standard formats for use in security investigations.

J. All data collected by the S2S must be available for a period of five (5) years. Data stored within this period must be available for recall by users for data and/or public disclosures requests. Following the retention period, data must be archived to a mutually agreed upon permanent storage medium prior to removing it from the S2S.

2.22 DISASTER RECOVERY

A. The Contractor shall provide a proposed Disaster Recovery and Business Continuity Plan (DRP) during the Discussion Phase. The Disaster Recovery Plan must, at minimum, meet all requirements set forth in this section of the RFP.

B. The Disaster Recovery Plan must meet NIST standards for disaster recovery and contingency planning.

C. The Contractor shall include the following in the final plan(s):

1. Plan Objectives

2. The situations and conditions covered by the Plan

3. Technical considerations https://csrc.nist.gov/pubs/sp/800/53/a/r5/final) https://csrc.nist.gov/pubs/sp/800/53/b/upd1/final

4. S2S failover plans

5. Roles and responsibilities of Contractor staff

6. How and when to notify the Contract Monitor

7. Recovery procedures

8. Recovery Point Objectives

9. Procedures for deactivating the Disaster Recovery Plan

D. The Contractor shall provide a complete Disaster Recovery solution equivalent to production setup.

E. Testing must include a complete failover of all test/production systems to Disaster Recovery (DR) systems.

F. DFA shall have the right to test the Disaster Recovery Plan by requesting that the Contractor completely fail over all test/production S2S to Disaster Recovery (DR) systems at two points prior to production implementation. DFA does not have to give advance notice for these requests.

G. Any changes made to the production environment must have a demonstrated way to be replicated in the Contractor DR environment and must have a way for testing to be verified.

H. Changes to the DRP must require the review and approval of DFA Office of Information Services (OIS) IT staff.

I. The Contractor’s DRP solution must be tested annually according to the rules and regulations of

DFA OIS.

2.23 INSURANCE

A. The Contractor shall maintain professional liability (errors and omissions) insurance, general liability, cyber liability, and data breach liability insurance in amounts reasonable and customary for the nature and scope of the services outlined in this RFP. The Contractor shall provide evidence of such insurance upon the State’s request.

B. The Contractor shall accept liability for any mistakes, errors, or omissions it makes in providing services to the State.

2.24 DATA OWNERSHIP AND END OF CONTRACT TRANSITION

A. The State shall retain sole ownership, right, title, and interest to all data collected and stored by the

Contractor under a resulting contract, excluding intellectual property and exclusions governed by applicable State and Federal laws.

B. At the end of the contract and after confirmed transfer of 100% of the State-owned data, deliverables, and products the Contractor has created, developed, produced, and managed while performing the services outlined in this RFP back to the State or their designee, the Contractor shall destroy all copies of the State-owned data the Contractor possesses.

C. The Contractor shall ensure all data received as part of the Contract is used solely for the purpose of this contract and not shared, reused, or disseminated to any other party or entity without the express written consent of the DFA designated representative or as otherwise required under applicable State and Federal laws.

D. Upon termination or expiration, should any subsequent contract for this or similar services be awarded to a provider other than the Contractor, the Contractor shall, to the greatest extent possible and reasonable, cooperate with the DFA in initiating a smooth and orderly transition to the next contractor.

2.25 PERFORMANCE STANDARDS

A. State law requires that qualifying contracts for services include Performance Standards for measuring the overall quality of services that a Contractor shall provide.

B. The State may be open to negotiations of Performance Standards prior to contract award, prior to the commencement of services, or at times throughout the contract duration.

C. Performance Standards shall not be amended unless they are agreed to in writing and signed by the parties.

D. Failure to meet the minimum Performance Standards as specified will result in the assessment of damages.

E. In the event a Performance Standard is not met, the Contractor will have the opportunity to defend or respond to the insufficiency. The State has the right to waive damages if it determines there were extenuating factors beyond the control of the Contractor that hindered the performance of services. In these instances, the State has final determination of the performance acceptability.

F. Should any compensation be owed to the Department due to the assessment of damages, Contractor shall follow the direction of the Department regarding the required compensation process.

SECTION 3 – SELECTION

3.1 SELECTION PROCESS

A. TSS OSP will review each Technical Proposal Packet to verify Submission Requirements have been met. Technical Proposal Packets that do not meet Submission Requirements will be rejected and will not be evaluated.

1. The State may conduct cost checks based on the cost submitted by each Prospective Contractor on the completed Pricing Response.

a. Prospective Contractors submitting Responsive Proposals with a proposed cost that falls twenty-five percent (25%) or more from the average submitted cost may be asked to justify their submitted cost.

b. Should TSS OSP request clarification and/or additional information regarding cost, Prospective Contractors shall provide clarification and/or additional information as specified by the request.

B. A Department-appointed Evaluation Committee will evaluate and score qualifying Technical Proposals. Evaluation will be based on Prospective Contractor’s response to the Information for Evaluation section included in the Technical Proposal Packet.

1. Members of the Evaluation Committee (Evaluators) will individually review and evaluate proposals and complete an Individual Score Worksheet for each proposal. Individual scoring for each Evaluation Criteria will be based on the scoring description in Table B: Scoring Table.

TABLE B: SCORING TABLE

SCORE DESCRIPTION

The response provides metrics clearly establishing that the Prospective Contractor is reliable and capable of fully performing the required services.

The response provides metrics suggesting that the Prospective Contractor’s level of performance may be acceptable, but it does not clearly establish that the Prospective Contractor is reliable and capable of fully performing the required services.

The response provides metrics clearly establishing that the Prospective Contractor is unreliable and incapable of fully performing the required services.

2. After initial individual evaluations are complete, the Evaluators will meet to discuss their individual scores. At the initial consensus meeting, each Evaluator will be afforded an opportunity to discuss his or her score for each evaluation criteria.

3. After Evaluators have had an opportunity to discuss their individual scores with the committee, the Evaluators will be given the opportunity to change their initial individual scores, if they feel that is appropriate.

4. The final individual scores of the Evaluators will be recorded on the Consensus Score Sheets and averaged to determine the group or consensus score and rank…