S000000527 Cyber Liability Insurance IFB ~1.pdf

Rev 09/2025

STATE OF ARKANSAS

DEPARTMENT OF SHARED ADMINISTRATIVE SERVICES

OFFICE OF STATE PROCUREMENT

501 Woodlane St., Ste. 220

Little Rock, Arkansas 72201-1023

INVITATION FOR BID

SOLICITATION DOCUMENT

SOLICITATION INFORMATION

Solicitation Number: S000000527 Solicitation Issued: March 31, 2026

Description: State Business Cyber Liability Insurance

Department: Arkansas Insurance Department

BID DUE DATE AND DELIVERY OF BIDS

Bid Response Due Date: April 28. 2026 Time: 2:00 p.m., Central Time

Bid responses for this Invitation for Bid must be submitted through ARBuy, the State’s eProcurement system, by the Bid Response Due Date and Time. Bids received after the Bid Response Due Date and Time will be rejected as untimely. ARBuy can be accessed at arbuy.arkansas.gov.

LIVE BID OPENING INFORMATION

Teams Meeting Link: https://teams.microsoft.com/meet/26688545146137?p=tJkp0cwtiPn9BBaqOU

Meeting ID: 266 885 451 461 37

Passcode: W5MX3877

Call in (audio only): 501.244.3310 or find a local number

Phone conference ID: +1 501-244-3310,,496774718# United States, Little Rock

SAS OFFICE OF STATE PROCUREMENT CONTACT INFORMATION

SAS OSP Procurement Specialist:

Tara Hernandez Procurement Specialist’s Direct Phone Number:

501-534-5042

Email Address: tara.hernandez@arkansas.gov SAS OSP’s Main Number: 501-324-9316

SAS OSP Website: sas.arkansas.gov/procurement/ file://///tss-file-p1/INDOSPADMIN$/%23_GENERAL_%20PROCUREMENT_%20TEAM_%23/BUYERS/Brandi%20Schroeder/Bid%20Folder%20Documents/%23New%20Drafts/IFB/1%20OSP%20Use/arbuy.arkansas.gov/ https://teams.microsoft.com/meet/26688545146137?p=tJkp0cwtiPn9BBaqOU https://dialin.teams.microsoft.com/6b6513dc-a034-48d2-8d06-7e711c4ecc0b?id=719036839 tel:+15012443310,,496774718 mailto:tara.hernandez@arkansas.gov

SECTION 1 – INFORMATION AND INSTRUCTIONS

1.1 INTRODUCTION

This Invitation for Bid (IFB) is issued by the SAS Office of State Procurement (SAS OSP) for the Arkansas Insurance Department (“AID” or “Department”) to obtain pricing and a contract for State Business Cyber Liability Insurance.

Direct all correspondence regarding this Solicitation to SAS OSP and not to the Arkansas Insurance Department.

1.2 OBJECTIVE AND GOALS

The Department seeks to obtain a master cyber liability insurance contract to cover two separate and distinct trust fund programs insuring 166 state agencies and 19 public school districts and educational cooperatives.

1.3 TYPE OF CONTRACT

A. As a result of this IFB, SAS OSP intends to award a contract to a single Contractor (see Contractor

Selection).

B. The anticipated starting date for any resulting contract is July 1, 2026, except that the actual contract start date may be adjusted unilaterally by the State for up to three (3) calendar months. By submitting a signed bid in response to the IFB, the Prospective Contractor represents and warrants that it will honor its bid as being held open as irrevocable for this period.

C. The initial term of a resulting contract will be for one (1) year. Upon mutual agreement by the Contractor and Department, the contract may be renewed by SAS OSP for up to six (6) additional one-year terms or portions thereof, not to exceed a total aggregate contract term of seven (7) consecutive years.

1.4 DEFINITION OF TERMS

A. Unless otherwise defined herein, all terms defined in Arkansas Procurement Law have the same meaning herein.

B. “Arkansas Administrative State-Wide Information System (AASIS)” means the State’s SAP based Enterprise Resource Planning system.

C. The terms “Invitation for Bid,” “IFB,” and “Solicitation” are used synonymously in this document.

D. “Prospective Contractor” means a responsive and responsible bidder who submits a bid that meets the Requirements and criteria set forth in this Solicitation.

E. “Requirement” means a term, condition, provision, deliverable, Specification, or a combination thereof, that is obligated under the Solicitation, resulting contract, or both.

F. “Shall” and “must” mean the imperative and are used to identify Requirements and Specifications.

G. “Specification” means any technical or purchase description or other description of the physical or functional characteristics, or of the nature, of a commodity or service. “Specification” may include a description of any Requirement for inspecting, testing, or preparing a commodity or service for delivery.

H. “State” means the State of Arkansas. When the term “State” is used herein to reference any obligation of the State under a contract that results from this Solicitation, that obligation is limited to the Department using such a contract.

1.5 CONTRACTOR SELECTION

A. Award is expected to be made to the responsive and responsible Prospective Contractor determined to have submitted the lowest bid that meets the Requirements and criteria set forth in the IFB, based on the Combined Total Annual Premium of the Official Bid Price Sheet submitted by the Prospective Contractor.

B. If the State so chooses, negotiations may be conducted with the lowest-bidding, responsive and responsible Prospective Contractor if:

1. All bids received from responsive and responsible bidders exceed available funding; or

2. It appears that additional savings to the state may result from negotiation.

C. If negotiations fail to result in a contract, the State may negotiate with the next lowest-bidding, responsive and responsible Prospective Contractor.

D. The negotiation process may be repeated until an acceptable lower bid price is negotiated, or until such time the State determines negotiations are no longer in the best interest of the state.

E. Negotiations are conducted at the sole discretion of the State.

F. Once the anticipated awardee has been determined, the anticipated award will be posted to ARBuy, generally for a period of fourteen (14) days prior to the issuance of a contract. The postings are anticipated awards only, subject to protest.

1. A contract is not effective prior to final award being made by the State; some contracts may be subject to Legislative review prior to final award.

1.6 CLARIFICATION OF SOLICITATION

A. Submit questions regarding this Solicitation via the Solicitation posting in ARBuy by midnight, Central

Time on or before April 7, 2026.

1. For each question submitted, Prospective Contractor should reference the specific Solicitation item number to which the question refers, as applicable.

2. Prospective Contractors’ written questions will be consolidated and answered by the State as deemed appropriate. The State’s consolidated written response is anticipated to be posted to the Solicitation posting in ARBuy by the close of business on date. If Prospective Contractor questions are unclear or non-substantive in nature, the State may request clarification of a question(s) or decline to answer.

B. The Prospective Contractor should notify the SAS OSP Procurement Specialist of any term, condition, etc., that precludes the Prospective Contractor from submitting a Responsive Bid.

C. Prospective Contractors should note that it is the responsibility of the Prospective Contractor to seek resolution of all such issues, including those relating to the terms and conditions of the contract, prior to the submission of a bid.

D. Prospective Contractors may contact the SAS OSP Procurement Specialist with non-substantive questions at any time prior to the bid opening.

E. An oral statement by SAS OSP will not be part of any contract resulting from this Solicitation and may not reasonably be relied on by any Prospective Contractor as an aid to interpretation unless it is reduced to writing and expressly adopted by SAS OSP.

F. The State reserves the right to make whatever investigation is necessary to determine that the apparent successful Contractor is compliant with the specifications of this IFB.

1.7 RESPONSE DOCUMENTS

A. All bids must be submitted through ARBuy, the State’s eProcurement system. The system can be accessed at arbuy.arkansas.gov.

1. Prospective Contractors must be registered in ARBuy to submit bids.

B. Bid Response Packet

1. Prospective Contractors shall utilize the Bid Response Packet attached to the Solicitation in ARBuy to submit their bids.

https://arbuy.arkansas.gov/

2. The following are bid submission Requirements and must be submitted as part of a Prospective Contractor’s bid.

a. Signed Bid Signature Page; signature may be ink or digital.

b. Completed Bid Response Packet, which must be in English.

c. Completed Official Bid Price Sheet attached to Solicitation posting.

i. Pricing must be proposed in U.S. dollars and cents.

ii. Quantities stated are estimates only and are not guaranteed. Prospective Contractor must bid unit price on the estimated quantity and unit of measure specified.

• The State may order more or less than the estimated quantity on term contracts, and the Contractor shall sell to the Department quantities ordered at no more than the bid price.

iii. If pricing documents do not allow for accurate pricing, Prospective Contractor should notify the SAS OSP Procurement Specialist during the Clarification of Solicitation period (see IFB Section 1.7).

iv. Prices must be firm offers and adjustments may be negotiated at the time of contract renewal.

• A request for a price increase must include supporting documentation demonstrating that the increase in contract price is based on an increased cost to the Contractor and that the proposed pricing is still competitive in the marketplace. The State has the right to approve or deny any request for a price adjustment.

v. Discount from list bids pricing is not acceptable unless requested elsewhere in the Solicitation.

vi. State and local sales taxes should not be included in the bid price. Trade discounts should be deducted from the unit price and the net price should be shown in the bid.

d. Copy of Prospective Contractor’s Equal Opportunity Policy

i. Pursuant to Arkansas Code Annotated § 19-60-104, OSP requires a Prospective Contractor bidding on a state contract to submit a copy of the Prospective Contractor’s Equal Opportunity (EO) Policy. Prospective Contractors not required by law to have an EO Policy must submit a written statement to that effect.

e. Proposed Subcontractors Form (see Standard Commodities Contract, section 14)

3. The following items, which must be submitted prior to a contract award to the Prospective Contractor, may also be included with the Prospective Contractor’s bid response:

a. EO 98-04 Contract & Grant Disclosure Form (see Standard Commodities Contract, section 11)

4. Prospective Contractors should not include any other documents or ancillary information, such as a cover letter or promotional marketing information.

a. Prospective Contractors should not alter any language in Solicitation document(s) or Official Bid Price Sheet provided by the State.

b. Prospective Contractors’ bids cannot be altered or amended after the bid opening except as permitted by law or rule.

c. As requested, Prospective Contractors shall provide clarification regarding Prospective Contractor’s bid response.

https://sas.arkansas.gov/procurement/forms-and-reporting/#:~:text=Standard%20Commodities%20Contract%20Template https://sas.arkansas.gov/procurement/forms-and-reporting/#:~:text=Standard%20Commodities%20Contract%20Template

C. Prospective Contractors may submit multiple bids.

SECTION 2 – SPECIFICATIONS AND REQUIREMENTS

2.1 BACKGROUND

A. As of July 1, 2025, there were approximately 166 insured entities on the Arkansas Multi-Agency

Insurance Trust (AMAIT) policy and 19 insured entities on the Arkansas Public School Insurance Trust (APSIT) policy. The AMAIT policies insure state boards, commissions, departments, offices, and public funded institutions of higher education located in the State of Arkansas. The APSIT policies insure public school districts, open enrollment public charter schools, and educational cooperatives located throughout the State of Arkansas. Participation by State agencies in any resulting contract will be mandatory, however, public school district’s participation is voluntary.

2.2 PROSPECTIVE CONTRACTOR MINIMUM QUALIFICATIONS

A. The Prospective Contractor shall be licensed to do business in the State of Arkansas.

B. The Prospective Contractor shall have authority to effectuate the binding of coverage.

C. The Prospective Contractor shall have a dedicated commercial line Account Manager in position to provide account management for the AMAIT Plan from the start of the contract.

1. The Account Manager shall have at least three (3) years of experience in Commercial Cyber Liability Insurance.

2. The Account Manager shall have at least one (1) year of experience in drafting and reviewing manuscript endorsements and editing other policy form language.

3. The Prospective Contractor shall submit the Account Manager’s resume prior to award.

D. The Prospective Contractor shall have an office location within 250 miles of Little Rock, Arkansas, where the dedicated commercial lines Account Manager is located to provide account management for the AMAIT and APSIT account prior to response submission.

E. The Prospective Contractor shall provide evidence of insurance agents’ and brokers’ errors and omissions insurance with a minimum limit of $10,000,000.00 per occurrence.

1. The Prospective Contractor shall provide evidence of this coverage on an ACORD Certificate of Liability Insurance form prior to award.

2.3 GENERAL REQUIREMENTS

A. The Contractor shall ensure that the Insurance Company(s) provides the insurance coverage on a composite rate basis for all AMAIT and APSIT Participating Governmental Entities.

B. The Contractor shall ensure that the Insurance Company(s) does not make any rate or composite rate by endorsement during the policy year.

C. The Contractor shall ensure that the Insurance Company(s) provides insurance coverage on a group master policy(s) in which additional Participating Governmental Entities can be added to the policy at the current composite rate on a pro-rated basis.

1. Additions of Participating Governmental Entities to the policy will be subject to insurance company underwriting approval.

D. The Named Insured must be “State of Arkansas Multi Agency Insurance Trust and Participating Entities” and “State of Arkansas Public School Insurance Trust and Participating Entities.”

E. The Contractor shall ensure the Insurance Company(s) writes and issues the policy(s) and all endorsement forms by October 1 of each year throughout the term(s) of the contract.

F. The Contractor shall submit all annual rate adjustments or non-renewals to RMD in writing no less than 60 days before the policy renewal date, in a format and manner approved by RMD.

1. Rate adjustments and non-renewals must only be made with prior approval from RMD.

2. RMD will review and shall have the right to approve or disapprove all rate adjustments with consideration of the following:

a. Original bid rate as the base.

b. Present market condition.

c. Losses to date.

d. Underwriting of new entities.

e. Other factors are at the sole discretion of the State.

G. The Contractor nor the Insurance Company (s) shall establish any loss fund reserve with any other financial institution or company for the AMAIT or APSIT Cyber Liability Insurance Plan annual aggregate retention or any other loss category deductible or any other entity deductible.

1. Arkansas law states that no money will be appropriated from the trust fund for any purpose except to pay for those expenses as described in the law.

2. A loss reserve fund is not a defined expense.

2.4 INSURANCE COMPANY REQUIREMENTS

A. The Contractor shall ensure the Insurance Company(s) be approved or authorized to do business in the State of Arkansas.

B. The Contractor shall ensure the Insurance Company(s) have Pre-Approved Provider Cyber Response Panel vendors assigned to the AMAIT and APSIT account.

1. The Contractor shall provide the name(s) of and contact information for the Pre-Approved Provider Cyber Response Panel vendors assigned to the AMAIT and APSIT account prior to award.

C. The Contractor shall ensure the Insurance Company(s) have a dedicated Claims Breach Manager, Claims Breach Counsel, Claims Breach Coach, or equivalent in position and assigned to the AMAIT and APSIT account to provide all claim management for the AMAIT account.

1. The Contractor shall provide the name and contact information of the Prospective Insurance Company Claims Breach Manager, Claims Breach Counsel, Claims Breach Coach, or equivalent prior to award.

D. The Contractor shall ensure the Insurance Company(s) have an A.M. Best Company rating of A (Excellent), Class Financial Size Category (FSC) XII or better.

1. The Contractor shall provide the A.M. Best Company prior to award.

E. The Contractor shall ensure the Insurance Company is a domestic insurance company.

2.5 PANEL OF IMMEDIATE RESPONDERS

A. The Contactor shall ensure the Insurance Company provides a group of cyber response contractors needed for immediate response after a claim. The cyber response contractors will include, but are not limited to:

1. Breech counsel.

2. Ransom negotiation.

3. End point monitoring.

4. Triage.

B. The Contractor or Insurance Company shall make all payments to the vendor(s) and may invoice AID for reimbursement.

2.6 RESULTING CONTRACT

A. The insurance policy(s) must become a part of the contract between AID on behalf of the AMAIT and

APSIT insurance plans and the successful Contractor.

B. Where a conflict between the specifications and requirements of this IFB and the insurance policy(s) exists, all specifications and requirements herein must govern.

C. All conflict settlements will be in the best interest of AMAIT and/or APSIT and will be determined by

RMD.

2.7 ANNUAL PREMIUM PAYABLE/BILLING

A. All renewal premiums will be paid annually each year on or after July 1.

B. The Contractor shall invoice for all coverage of insurance on one (1) billing invoice on or after July 1.

C. The Contractor shall not invoice any additional or return premium due, except when a new Participating Governmental Entity is added or deleted, subject to insurance company underwriting approval, during the policy year by endorsement.

D. Any additional or return premium due invoice for a new or deleted Participating Governmental Entity must be accompanied by the applicable insurance policy change endorsement and must be calculated on a pro-rated basis for each entity added or deleted.

2.8 AUDITS

A. The Contractor shall ensure that the Insurance Company(s) does not conduct any mid-term or end of the policy year audits of the AMAIT or APSIT schedules after policy issue for the purpose of additional premium or return premium calculation(s) except as described in IFB section 2.4 C.

B. Additional premiums for any other reason will not be accepted or paid by the State.

2.9 CLAIMS

A. The Contractor shall provide a staff of employees physically located at a claims intake office located in Arkansas.

B. The Contractor shall provide a 24-hour claims reporting phone number for all claims intake.

1. Must not be a call answering service.

2. Must be answered by a live, trained, English-speaking claims intake staff member.

C. The Contractor shall verify all loss notice information required for each claim reported to RMD.

D. The Contractor shall report all claims to the Insurance Company claim intake department and adjuster(s) in accordance with the insurance policy provisions on the same day of notice.

E. The Contractor shall prepare and email the ACORD Loss Notice for each claim to the specified Control Group in a format and manner approved by RMD.

F. The Contractor shall code all ACORD Loss Notice information, including, but not limited to the following:

1. Insurance company claim intake department claim number.

2. Participating Governmental Entity name and AASIS Code number or Local Educational Agency (LEA) number with applicable contact information.

a. The AASIS Code and LEA numbers are numbers used by the State to identify differing State and school entities. They will be provided upon award.

3. Cause of loss description categories established by RMD.

4. Brief description of loss as indicated on ACORD Loss Notice.

5. Date of loss.

6. Insurance company(s) name and policy number.

G. The Contractor shall prepare the Company Monthly Loss History Report – January 2026 in accordance with RMD requirements and shall submit the Report to RMD by the 15th of each month, in a format and method approved by RMD.

1. Company Monthly Loss History Reports (Attachment A) must include all claims and claim information, including:

a. Formatting as outlined by RMD, including all required column headings.

b. Insurance company claim number.

c. Changes highlighted, including: new claims, change in claim status, and financial change for easy review by RMD.

d. Cause of loss descriptions approved by RMD.

e. Date of losses.

f. Participating Governmental Entity names and AASIS Code numbers.

g. Claim statuses.

h. Report tabs by policy year for all policy years.

i. Additional information requested by RMD.

H. The Contractor shall provide a dedicated staff member to process all Company Monthly Loss History Reports.

I. The Contractor shall communicate with a dedicated staff member to process all Company Monthly Loss History Reports.

2.10 POLICY FORMS

A. The Contractor shall ensure the accuracy of all policy forms as directed by RMD.

B. The Contractor shall review policies for accuracy and correctness in advance of policy issue and delivery to minimize the need for corrections by endorsement.

C. The Contractor shall deliver one (1) electronic and one (1) paper copy of each policy and all endorsements to RMD by October 1 of each year, in a format and manner approved by RMD.

D. The Contractor shall negotiate all additional policy form changes with the insurance company as requested and approved by RMD.

E. The Contractor shall provide consultation and review with RMD on policy interpretation and analysis of insurance forms as needed by RMD.

2.11 POLICY RENEWALS

A. The Contractor shall submit annual strategies for identifying anticipated market considerations and propose strategies for policy renewals to the RMD Director or the Director’s designee, in a method and format approved by RMD, by April 1 of each year.

B. The Contractor shall submit a compilation of underwriting specifications for renewal negotiations to RMD by April 1 of each year, in a method and format approved by RMD.

C. The Contractor shall provide coverage and price negotiations with insurers to secure the best terms and provisions for all coverage as requested by RMD.

2.12 REPORTING

A. RMD will maintain the annual actual expenditures reported to the Contractor on the AMAIT Annual

Actual Expenditures Report and the APSIT Annual Actual Expenditures Report based upon the most current data available as of April 1 for the previous fiscal year each year. (See Attachments B and C)

B. The Contractor shall submit written evidence of coverage to RMD by June 10 of each year throughout the term(s) of the contract in a format and manner approved by RMD.

C. The Contractor shall provide an annual evaluation of the commitment and financial stability of the insurance company to ensure compliance with the IFB specifications.

D. The Contractor shall submit an annual report by May 1 of each year, in a format approved by RMD, that must include the following:

1. Schedule of coverage for the confirmation binder.

2. Renewal quotation confirmation offers.

3. Premium and rate worksheet.

4. Insurance company claims loss history report for the prior policy years.

5. Recommendations for coverage changes for the next policy year.

E. The Contractor shall prepare and submit an incident and event notification protocol detailing all specific procedures and responsibilities for Participating Governmental Entities to provide notification upon discovery or claim, in a format and manner approved by RMD.

F. The Contractor shall prepare and submit a Cyber Liability Insurance policy limit summary chart document to RMD, in a format and manner approved by RMD, as requested by RMD.

2.13 UNDERWRITING INFORMATION

A. The basis of premium must be the total annual actual expenditures reported in the amount of

$22,770,189,352. (See Attachments B and C)

B. Proposed policy terms and conditions must meet or exceed the 2025 expiring terms and conditions.

1. See Attachment D for a copy of the 2025 Current AMAIT Cyber Liability Insurance Policy Coverage Forms and Endorsements, and Attachment E for a copy of the 2025 APSIT Cyber Liability Insurance Policy Coverage Forms and Endorsements.

C. Five (5) year loss history information is provided on the:

1. AMAIT Loss History All Claims by Policy Year Report - January 2026 (See attachment F)

2. AMAIT Annual Loss Experience Report – January 2026. (See attachment G)

D. The APSIT program has experienced no losses since inception on 1 July 2025

E. AMAIT Policy/Premium Overview Information as of July 1, 2025:

100% Primary Layer $10 Million Starr Indemnity and Liability Company

Participating Governmental Entities Insured

Premium for 2025/2026 Policy Year, including surplus lines tax

$928,000

Total Annual Actual Expenditures reported on July 1, 2025

$21,255,896,497

F. APSIT Policy/Premium Overview Information as of July 1, 2025:

100% Primary Layer $5 Million Starr Surplus Lines Insurance Company

Participating Governmental Entities Insured

Premium for 2025/2026 Policy Year, including surplus lines tax

$93,905.76

Total Annual Actual Expenditures reported on July 1, 2025

$468,087,852.91

G. The AMAIT aggregate retention is $2,500,000.

H. The APSIT aggregate retention is $1,000,000.

I. The Contractor shall ensure that the Insurance Company(s) provides all claim management for all cyber incidents and events, including claims incurred and reported within the Insured’s aggregate retention and per occurrence deductible.

J. The Contractor and Insurance Company(s) shall provide all claim management for all cyber incidents and events, including claims incurred and reported within the Insured’s aggregate retention and per occurrence deductible.

K. The Contractor and Insurance Company(s) shall pay in advance for all claim and breach costs, emergency mitigation costs, claim management costs, and adjustment expense costs for all cyber incidents, cyber events, and incurred claims for all coverage included within the Insured’s aggregate retention and per occurrence deductible.

L. All payments made by the Contractor and Insurance Company(s) for breach costs to the Pre- Approved Provider Cyber Response Panel contractors within the Insured’s aggregate retention and per occurrence deductible including but not limited to privacy event counsel, computer forensics, data breach response, public relations, notification expenses, credit monitoring expenses, forensic accounting and claims preparation costs must apply to the Insured’s aggregate retention and per occurrence deductible regardless of the rates, scope of work, and number of hours.

M. The AMAIT will reimburse the Contractor and the Insurance Company(s) for all claim and breach costs, emergency mitigation costs, claim management costs, and adjustment expense costs for all cyber incidents, cyber events, and incurred claims for all coverage included within the Insured’s aggregate retention and per occurrence deductible.

N. The Contractor and Insurance Company(s) shall provide the AMAIT with a monthly invoice for reimbursement for all claim and breach costs, emergency mitigation costs, claim management costs, and adjustment expense costs for all cyber incidents and events and incurred claims for all coverage included within the insured’s aggregate retention and per occurrence deductible in a format acceptable for the auditing requirements of the State of Arkansas.

O. The Contractor and Insurance Company(s) shall supply detailed supplemental information for each monthly invoice for all claim and breach response expense costs within the insured’s aggregate retention and per occurrence deductible for reimbursement, which includes the specific claim information for each claim including but not limited to:

1. Specific claim number.

2. Date of loss.

3. Participating Government Entity name and AASIS or LEA Code.

4. Pre-Approved Provider Cyber Response Panel Vendors payee.

5. All claim payment amounts.

6. Breach cost amounts.

7. Payment dates.

8. All other information determined by RMD.

P. The Contractor shall ensure that the Insurance Company(s) provide legal counsel as part of breach and defense costs and the AMAIT will not retain separate legal counsel.

Q. Breach costs must include coverage for statutory and non-statutory requirements to provide notification and credit monitoring.

R. The Prospective Contractor shall provide a copy of the Insurance Company(s) declaration page and all coverage forms and endorsements prior to award as specified in 2.13.B.1.

2.14 UNDERWRITING COVERAGE REQUIREMENTS

A. The Named Insured on the AMAIT insurance policy(s) must be “State of Arkansas Multi Agency

Insurance Trust and Participating Entities” and on the APSIT insurance policy(s) must be “State of Arkansas Public School Insurance Trust and Participating Entities.”

B. Mailing Address:

Arkansas Multi Agency Insurance Trust

OR

Arkansas Public School Insurance Trust Arkansas Insurance Department C/O Risk Management Division 1 Commerce Way Suite 504 Little Rock, AR 72202

C. The policy period must be from July 1 to July 1.

D. Effective date and time must be July 1, 2026, 12:01 a.m. Central Time at the address of the Named Insured.

E. The AMAIT Participating Governmental Entities retroactive date and time must be July 1, 2019, 12:01 a.m. Central Time at the address of the Named Insured except as follows:

1. The ASU Participating Governmental Entities (120, 125A, 125C, 128, 129, and 177) retroactive date and time must be September 29, 2017, 12:01 a.m. Central Time at the address of the Named Insured.

2. The Northwest Arkansas Community College (198) retroactive date and time must be December 1, 2017, 12:01 a.m. Central Time at the address of the Named Insured.

3. The University of Arkansas Governmental Entities (135A, 135B, 135 C/D, 135E, 135F, 135G, 145, 150, 155, 160, 167, 168, 190, 190, 192, 195, 677, 689, and 693) retroactive date and time must be July 1, 2022, 12:01 a.m. Central Time at the address of the Named Insured.

See Attachment D for additional detail.

F. The Contractor shall ensure that the Insurance Company(s) per occurrence limit be $3,000,000 for the ASU Participating Governmental Entities (120, 125A, 125C, 128, 129, and 177) for claims occurring after the retroactive date and time of September 29, 2017, 12:01 a.m. Central Time and occurring before August 14, 2018, 12:01 a.m. Central Time.

See Attachment D for additional detail.

G. The Contractor shall ensure that the Insurance Company(s) per occurrence limit be $8,000,000 for the Northwest Arkansas Community College (198) for claims occurring after the retroactive date and time of December 1, 2017, 12:01 a.m. Central Time and occurring before August 14, 2018, 12:01 a.m. Central Time.

See Attachment D for additional detail.

H. The legal entity business description type must be Governmental.

I. The AMAIT insurance policy(s) per occurrence limit of insurance must be at least $10,000,000.

J. The APSIT insurance policy(s) per occurrence limit of insurance must be at least $1,000,000 per entity.

K. The Contractor shall ensure that the Insurance Company(s) do not issue the policy(s) with a “cut through” endorsement to another insurance company.

L. The AMAIT/APSIT will have the right, following the effective date of cancellation or non-renewal, to a period of 60 days in which to give written notice, at no additional cost to the insurance company, of any claim first made, cyber extortion demand or ransomware demand first made, or any loss discovered, prior to the end of the policy period, provided that any actual or alleged acts, facts or circumstances underlying the claim, cyber extortion demand or ransomware demand or any loss occurred prior to the end of the policy period, and are otherwise covered by the policy, and reported to insurance company during the Automatic Extended Reporting Period.

M. RMD on behalf of the AMAIT/APSIT will have the right, within 30 days of the effective date of cancellation or non-renewal, to provide written notice and to purchase an Additional Extended Reporting Period for claims first made against the Named Insured and notified to the insurance company during the Additional Extended Reporting Period, with regard to any acts, facts, and circumstances occurring or committed after the retroactive date and before the end of the policy period, at no more than the following cost schedule:

1. 12 months at 100% of expiring total annual premium.

2. The AMAIT/APSIT will have sixty (60) days to process payment for the additional premium upon receipt of invoice.

N. The Contractor shall ensure that the Insurance Company(s) renew the policy(s) unless a written notice of non-renewal is mailed to the Named Insured at least ninety (90) days prior to the expiration date or anniversary date of the policy, except in the case of non-payment of premium.

O. The Contractor shall ensure that the Insurance Company does not cancel the policy(s) unless a written notice of cancellation is mailed to the Named Insured at least 90 days before the cancellation is to take effect.

1. The written notice of cancellation must include the reason(s) for cancellation and must comply with applicable State of Arkansas law.

P. The Contractor shall ensure that the Insurance Company(s) may cancel the policy(s) after the policy has been in effect for 60 days, if the cancellation is for non-payment of premium, by giving the Named Insured a written notice of cancellation at least ten (10) days before the cancellation is to take effect.

Q. The Contractor and Insurance Company(s) shall not submit a bid quote on the Official Bid Price Sheet for coverage as part of a multiple insured public entity grouped/shared policy limit plan with any other insured(s).

R. The AMAIT insurance policy(s) must contain a State of Arkansas AMAIT Cyber Claim Protocol Endorsement(s) that must include all the requirements specified in IFB Items 2.11.I. through 2.11.R.

S. The APSIT insurance policy(s) must contain an endorsement mirroring the State of Arkansas AMAIT Cyber Claim Protocol Endorsement(s) referenced in Item 2.8.R above and must include all the requirements specified in IFB Items 2.11.I. through 2.11.R

T. The insurance policy(s) must contain an endorsement to provide coverage for statutory and non-statutory requirements for notification and for credit monitoring specified in IFB Item 2.9.Q.

2.15 INSURANCE POLICY COVERAGE REQUIREMENTS

A. Cyber Liability Insurance Coverage Defined

1. For the purpose of and as specified in this IFB, the insurance coverage will be referred to as Cyber Liability Insurance.

a. The Cyber Liability Insurance must meet or exceed the following defined descriptions in section 2.13.

2. First party coverage including, but not limited to:

a. Breach costs:

i. The Contractor shall ensure that the Insurance Company(s) pay on behalf of the insured any breach costs up to the limit of liability and excess of the retention, as stated in the policy schedule, arising out of an actual or suspected network security breach, privacy breach or a confidentiality breach which first occurred on or after the retroactive date and was discovered during the policy period including, but not limited to:

• Privacy event counsel costs.

• Computer forensic services costs.

• Data breach response costs.

• Public relations costs.

• Notification expense costs.

• Credit monitoring expense costs.

• Forensic accounting and claim preparation costs.

b. Data or programs damage costs:

i. The Contractor shall ensure that the Insurance Company(s) pays the insured for any first party costs up to the limit of liability and excess of the retention, as stated in the policy schedule, incurred as a direct result of damage to the insured’s data or insured’s programs caused by computer attack or operational error which first occurred on or after the retroactive date and was discovered during the policy period.

c. Insured’s network failure – income loss and extra expense cost:

i. The Contractor shall ensure that the Insurance Company(s) pays the insured for any income loss and extra expense up to the limit of liability as stated in the policy schedule, incurred by the insured due to the suspension or deterioration of the insured’s business during the period of restoration directly as a result of the total or partial interruption, degradation in service or failure of the insured’s network, provided that the duration of such interruption, degradation or failure exceeds the time retention and was directly caused by computer attack or operational error which first occurred on or after the retroactive date and was discovered during the policy period.

d. Outsource service provider or cloud service provider failure – income loss and extra expense cost:

i. The Contractor shall ensure the Insurance Company(s) pays the insured for any income loss and extra expense, up to the limit of liability, as stated in the policy schedule, incurred by the insured due to the suspension or deterioration of the insured’s business during the period of restoration directly as a result of the total or partial interruption, degradation in service or failure of a network operated by an outsource service provider or cloud service provider for the insured, provided that the duration of such interruption, degradation or failure exceeds the time retention and was directly caused by computer attack or operational error which first occurred on or after the retroactive date and was discovered during the policy period.

e. Cyber extortion and ransomware costs:

i. The Contractor shall reimburse the insured for any cyber extortion/ransomware payments and any cyber extortion/ransomware expenses up to the limit of liability and excess of the retention, as stated in the policy schedule, incurred directly as a result of a cyber extortion demand or ransomware demand first made during the policy period.

f. Customer attrition costs:

i. The Contractor shall ensure that the Insurance Company(s) pays the insured for any customer attrition loss and extra expense up to the limit of liability and excess of the retention, as stated in the policy schedule, incurred by the insured during the customer attrition period of restoration directly as a result of the reputational damage caused by an allegation made in the public domain or the release of information in the public domain to the effect that the insured committed or failed to prevent a network security breach, privacy breach or a confidentiality breach, provided that such network security breach, privacy breach or confidentiality breach first occurred on or after the retroactive date and was discovered during the policy period.

3. Third party liability coverage including, but not limited to:

a. Network security, privacy and confidentiality liability:

i. The Contractor shall ensure that the Insurance Company(s) pays on behalf of the insured for any damages and defense costs up to the limit of liability and excess of the retention, as stated in the policy schedule, arising out of a claim first made against the insured during the policy period alleging that the insured committed or failed to prevent a network security breach, privacy breach or a confidentiality breach which first occurred on or after the retroactive date.

b. Network security and privacy regulatory penalties and investigation cost liability:

i. The Contractor shall ensure that the Insurance Company(s) pays on behalf of the insured any regulatory penalties and regulatory investigation costs up to the limit of liability and excess of the retention, as stated in the policy schedule, arising out of a regulatory claim first made against the insured during the policy period alleging that the insured committed or failed to prevent a network security breach, privacy breach or a confidentiality breach which first occurred on or after the retroactive date.

c. Multimedia liability:

i. The Contractor shall ensure that the Insurance Company(s) pays on behalf of the insured any damages and defense costs up to the limit of liability and excess of the retention, as stated in the policy schedule, arising out of a claim first made against the insured during the policy period alleging that the insured committed, either directly or indirectly, or failed to prevent a multimedia wrongful act which first occurred on or after the retroactive date.

d. Technology errors and omissions liability:

i. The Contractor shall ensure that the Insurance Company(s) pays on behalf of the insured any damages and defense costs up to the limit of liability and excess of the retention, as stated in the policy schedule, arising out of a claim first made against the insured during the policy period alleging that the insured committed a technology error and omission which first occurred on or after the retroactive date.

4. Payment Card Industry Data Security Standard (PCI DSS) fines, penalties and assessments and PCI DSS claim expense coverage including, but not limited to:

a. PCI DSS fines, penalties and assessments and PCI DSS claim expense coverage:

i. The Contractor shall ensure that the Insurance Company(s) pays on behalf of the insured any PCI DSS fines, penalties and assessments and PCI DSS claim expenses up to the limit of liability and excess of the retention, as stated in the policy schedule, arising out of a PCI DSS claim first made against the insured during the policy period alleging that the insured committed or failed to prevent a network security breach, privacy breach or a confidentiality breach which first occurred on or after the retroactive date.

5. Cyber terrorism coverage including, but not limited to:

a. Cyber terrorism coverage:

i. The Contractor shall ensure that the Insurance Company(s) reimburses the insured or pay on behalf in the event of a cyber terrorism event if a loss or a claim is covered under one or more of the coverage agreements listed above

B. Cyber Liability Insurance Policy Coverage Forms

1. The insurance policy(s) must meet or exceed the 2025 Current Cyber Liability Insurance Policy(s) Coverage Forms and Endorsements. (See Attachment D for AMAIT and Attachment E for APSIT)

2. Coverage insured as defined in 2.13.B.1.. must include the following:

a. First party coverage, including:

i. Breach costs.

ii. Costs for damage to data or programs.

iii. Insured’s network failure – income loss and extra expense.

iv. Outsource service provider/cloud service provider failure – income loss and extra expense.

v. Cyber extortion and ransomware.

vi. Customer attrition – reputational damage.

vii. Hardware.

b. Third party insuring agreements, including:

i. Network security, privacy, and confidentiality liability.

ii. Network security privacy liability (regulatory fines, penalties, and investigation costs).

iii. Multimedia liability.

iv. Technology errors and omissions.

c. PCI DSS fines, penalties, and assessments.

d. Cyber terrorism.

SECTION 3 – SOLICITATION TERMS AND CONDITIONS

3.1 ACCEPTANCE OF REQUIREMENTS

A. A Prospective Contractor’s past performance with the State may be used to determine if the

Prospective Contractor is responsible (19-CAR § 1-401).

1. Bids submitted by Prospective Contractors determined to be non-responsible will be rejected.

B. A single Prospective Contractor must be identified as the prime contractor.

3. The prime Contractor shall be responsible for the resulting contract and jointly and severally liable with any of its subcontractors, affiliates, or agents to the State for the performance thereof.

C. By submitting a bid, the Prospective Contractor represents and warrants:

1. That the prices in the bid have been arrived at independently, without any collusion with another competing Prospective Contractor.

a. Collusion violates Arkansas Procurement Law and can lead to suspension, debarment, and can be referred to the Attorney General’s officer for investigation and appropriate legal action (Arkansas Code Annotated § 19-61-403 and 19-61-702).

2. That the Prospective Contractor has not retained a person to solicit or secure the resulting contract upon an agreement or understanding for a commission, percentage, brokerage, or contingent fee, except for retention of bona fide employees or bona fide established commercial selling agencies maintained by the Prospective Contractor for the purpose of securing business.

3. Qualifications, services, and commodities must meet or exceed the required Specifications as set forth in the Solicitation.

3.2 GENERAL TERMS AND CONDITIONS

A. The Contractor must be registered as a vendor to receive payment and may register online by visiting ark.org/vendor/index and clicking the Start Here button.

B. All payments to the Contractor under a resulting contract shall be made exclusively through ACH (Automated Clearing House) direct deposit.

1. The Contractor shall provide the necessary banking information, including account number, routing number, and any other details required to facilitate ACH direct deposits.

2. The Contractor shall be responsible for ensuring that the provided banking information is accurate and up to date. Any delays or errors in payment caused by incorrect or outdated information provided by the Contractor shall not be the responsibility of the Department.

3. The Department will process payments according to the agreed payment schedule, and all payments made via ACH direct deposit shall be considered as duly received upon successful transmission to the Contractor’s designated bank account.

C. Pursuant to Arkansas State Procurement Law, the Contractor shall certify that, unless they offer to provide the goods or services for at least twenty percent (20%) less than the lowest certifying Prospective Contractor:

1. They are not engaged in and shall not, during the aggregate term of the resulting contract, engage in a boycott of Israel (Arkansas Code Annotated § 25-1-503),

2. They are not engaged in and shall not, during the aggregate term of the resulting contract, engage in a boycott of an Energy, Fossil Fuel, Firearms, or Ammunition Industry (Arkansas Code Annotated § 25-1-1102).

D. Pursuant to Arkansas Procurement Law, the Contractor shall certify that the Contractor does not knowingly employ or contract with illegal immigrants and that the Contractor shall not knowingly https://www.ark.org/vendor/index.html?_ga=2.231672543.1782009942.1693919943-292160598.1646079585 employ or contract with illegal immigrants during the aggregate term of any contract with the State or any of its departments, institutions, or political subdivisions (Arkansas Code Annotated § 19-60-105).

E. The Prospective Contractor shall certify that they are not a company owned in whole or with a majority ownership by the government of the People's Republic of China (a “Scrutinized Company”) and that they do not and shall not during the aggregate term of the resulting contract employ a Scrutinized Company as a contractor (Arkansas Code Annotated § 25-1-1203).

F. The Contractor shall invoice the State as required by the Department and should not invoice the State in advance of delivery and acceptance of any commodities or services (Arkansas Code Annotated § 19-4-1206).

1. The Contractor should invoice the agency by an itemized list of charges. The Department’s purchase order number and/or the contract number should be referenced on each invoice.

2. Payment will be made in accordance with applicable State of Arkansas accounting procedures upon acceptance of commodities and services by the Department.

3. Payment will be made only after the Contractor has successfully satisfied the Department as to the reliability and effectiveness of the commodities or services purchased as a whole.

G. The Contractor should be able to accept the State’s authorized VISA Procurement Card (p-card) as a method of payment. Price changes or additional fee(s) must not be levied against the State when accepting the p-card as a form of payment.

H. This IFB incorporates all terms of the Standard Commodities Contract Template (found here).

1. The contract template is attached to the Solicitation in ARBuy as a sample for your information only.

I. A Prospective Contractor’s bid may be rejected if a Prospective Contractor takes exception to any terms, conditions, or Requirements in this IFB.

J. The Prospective Contractor agrees and shall adhere to all terms, conditions, and Requirements if selected as the Contractor.

1. Items may only be modified if the legal requirement is satisfied and approved by the State during negotiations.

K. Pursuant to Arkansas State Procurement Law, the Contractor shall in all other respects comply with the laws, rules, and executive orders of the state that apply to the Contractor’s performance under a resulting contract.

1. Tests may be performed on samples or demonstrators submitted with the bid or on samples taken from the regular shipment.

a. If products tested fail to meet or exceed all Requirements and Specifications, the cost of the sample used and the reasonable cost of the testing must be borne by the Prospective Contractor.

C. Unless otherwise specified in the Solicitation, a catalog brand name or manufacturer reference used in the Solicitation is descriptive only, not restrictive, and used to indicate the type and quality desired.

1. Bids on brands of like nature and quality will be considered.

2. The State shall have the right to determine whether a substitute offered is equivalent to and meets the standards of the item specified, and the State may require the Prospective Contractor to supply additional descriptive material.

3. Prospective Contractors not bidding an alternate to the referenced brand name or manufacturer shall furnish the product according to brand names, numbers, etc., as specified in the Solicitation.

https://sas.arkansas.gov/procurement/forms-and-reporting/#:~:text=Standard%20Commodities%20Contract%20Template

3.3 PROPRIETARY INFORMATION

A. The release of public records is governed by the Arkansas Freedom of Information Act…