S00R3600017 - Three-In-One Credit Svcs - IFB .pdf

Three-In-One Credit Services

Solicitation #: S00R3600017 IFB Document

Version 2.0

IFB for Department of Housing and Community Development (DHCD) Page 1 of 71

STATE OF MARYLAND

DEPARTMENT OF HOUSING AND COMMUNITY DEVELOPMENT

(DHCD)

INVITATION FOR BIDS (IFB)

THREE-IN-ONE CREDIT SERVICES

IFB NUMBER: S00R3600017

ISSUE DATE: JANUARY 31, 2023

NOTICE

A Prospective Bidder that has received this document from a source other than eMarylandMarketplace (eMMA) https://procurement.maryland.gov should register on eMMA.

See Section 4.2.

MINORITY BUSINESS ENTERPRISES ARE ENCOURAGED TO RESPOND TO THIS SOLICITATION.

IFB for Department of Housing and Community Development (DHCD) Page 2 of 71

NO BID NOTICE/VENDOR FEEDBACK FORM

To help us improve the quality of State solicitations, and to make our procurement process more responsive and business friendly, please provide comments and suggestions regarding this solicitation.

Please return your comments with your response. If you have chosen not to respond to this solicitation, please email this completed form to the attention of the Procurement Officer (see Key Information

Summary Sheet below for contact information).

Title: THREE-IN-ONE CREDIT SERVICES

Solicitation No: S00R3600017

1. If you have chosen not to respond to this solicitation, please indicate the reason(s) below:

● Other commitments preclude our participation at this time

● The subject of the solicitation is not something we ordinarily provide

● We are inexperienced in the work/commodities required

● Specifications are unclear, too restrictive, etc. (Explain in REMARKS section)

● The scope of work is beyond our present capacity

● Doing business with the State is simply too complicated. (Explain in REMARKS section)

● We cannot be competitive. (Explain in REMARKS section)

● Time allotted for completion of the Bid is insufficient

● Start-up time is insufficient

● Bonding/Insurance requirements are restrictive (Explain in REMARKS section)

● Bid requirements (other than specifications) are unreasonable or too risky (Explain in

REMARKS section)

● MBE or VSBE requirements (Explain in REMARKS section)

● Prior State of Maryland contract experience was unprofitable or otherwise unsatisfactory.

(Explain in REMARKS section)

● Payment schedule too slow

● Other: __________________________________________________________________

2. If you have submitted a response to this solicitation, but wish to offer suggestions or express concerns, please use the REMARKS section below. (Attach additional pages as needed.)

REMARKS:

Vendor Name: ________________________________ Date: _______________________

Contact Person: _________________________________ Phone (____) _____ - _________________

Address: ______________________________________________________________________

E-mail Address: ________________________________________________________________

IFB for Department of Housing and Community Development (DHCD) Page 3 of 71

STATE OF MARYLAND

DEPARTMENT OF HOUSING AND COMMUNITY DEVELOPMENT (DHCD)

KEY INFORMATION SUMMARY SHEET

Invitation for Bids THREE-IN-ONE CREDIT SERVICES

Solicitation Number: S00R3600017

IFB Issue Date: January 31, 2023

IFB Issuing Office: Department of Housing and Community Development (DHCD or the

"Department")

Procurement Officer: Joy Niles

7800 Harkins Road, Lanham, MD 20706 e-mail:

Office Phone:

joy.niles@maryland.gov

301.429.7585

Bids are to be sent to: Proposals will be accepted through the State's eMaryland Marketplace

Advantage (eMMA) e-Procurement system. Instructions on how to submit proposals electronically can be found at: Click here

Pre-Bid Conference: February 15, 2023, at 10:00 a.m. Local Time

Google Meet Virtual Teleconference, by invitation from Procurement Officer Only.

See Attachment A for instructions.

Questions Due Date and Time February 21, 2023, at 2:00p.m. Local Time

Bid Due (Closing) Date and

Time:

March 30, 2023, at 2:00p.m. Local Time

Bidders are reminded that a completed Feedback Form is requested if a no-bid decision is made (see page iv).

SBR Designation: Not Applicable

MBE Subcontracting Goal: Not Applicable

VSBE Subcontracting Goal: Not Applicable

Contract Type: Indefinite Quantity with Firm Fixed Price

Contract Duration: Two (2) year base period

Federal Funding: No https://procurement.maryland.gov/wp-content/uploads/sites/12/2019/08/5-eMMA-QRG-Responding-to-Solicitations-Double-Envelope-v2.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2019/08/5-eMMA-QRG-Responding-to-Solicitations-Double-Envelope-v2.pdf

IFB for Department of Housing and Community Development (DHCD) Page 4 of 71

TABLE OF CONTENTS – IFB

1 Minimum Qualifications 7

2 Contractor Requirements: Scope of Work 8

2.1 Summary Statement 8

2.2 Background and Purpose 8

2.3 Responsibilities and Tasks 9

3 Contractor Requirements: General 10

3.1 Contract Initiation Requirements 10

3.2 End of Contract Transition 10

3.3 Invoicing 10

3.4 Liquidated Damages 12

3.5 Disaster Recovery and Data 12

3.6 Insurance Requirements 12

3.7 Security Requirements 13

3.8 Problem Escalation Procedure 17

3.9 SOC 2 Type 2 Audit Report 17

3.10 Minority Business Enterprise (MBE) Reports 17

3.11 Veteran Small Business Enterprise (VSBE) Reports 17

3.12 Work Orders 18

3.13 Additional Clauses 18

4 Procurement Instructions 19

4.1 Pre-Bid Conference 19

4.2 eMaryland Marketplace Advantage (eMMA) 19

4.3 Questions 19

4.4 Procurement Method 20

4.5 Bid Due (Closing) Date and Time 20

4.6 Multiple or Alternate Bids 20

4.7 Receipt, Opening and Recording of Bids 20

4.8 Confidentiality of Bids / Public Information Act Notice 20

4.9 Award Basis 21

4.10 Tie Bids 21

4.11 Duration of Bids 21

IFB for Department of Housing and Community Development (DHCD) Page 5 of 71

4.12 Revisions to the IFB 21

4.13 Cancellations 22

4.14 Incurred Expenses 22

4.15 Protest/Disputes 22

4.16 Bidder Responsibilities 22

4.17 Acceptance of Terms and Conditions 23

4.18 Bid/Proposal Affidavit 23

4.19 Contract Affidavit 23

4.20 Compliance with Laws/Arrearages 23

4.21 Verification of Registration and Tax Payment 23

4.22 False Statements 23

4.23 Payments by Electronic Funds Transfer 24

4.24 Prompt Payment Policy 24

4.25 Electronic Procurements Authorized 24

4.26 MBE Participation Goal 25

4.27 VSBE Goal 25

4.28 Living Wage Requirements 26

4.29 Federal Funding Acknowledgement 26

4.30 Conflict of Interest Affidavit and Disclosure 26

4.31 Non-Disclosure Agreement 26

4.32 HIPAA - Business Associate Agreement 26

4.33 Nonvisual Access 26

4.34 Mercury and Products That Contain Mercury 26

4.35 Location of the Performance of Services Disclosure 27

4.36 Department of Human Services (DHS) Hiring Agreement 27

4.37 Small Business Reserve (SBR) Procurement 27

4.38 Bonds 28

4.39 Bid Bond 28

4.40 Performance Bond 28

4.41 Payment Bond 28

4.42 Acceptable security 28

4.43 Surety Bond Assistance Program 28

4.44 Maryland Healthy Working Families Act Requirements 28

IFB for Department of Housing and Community Development (DHCD) Page 6 of 71

5 Bid Format 29

5.1 One Part Submission 29

5.2 Labeling 29

5.3 Bid Price Form 29

5.4 Required Bid Submission 29

5.5 Delivery 31

5.6 Documents Required upon Notice of Recommendation for Contract Award 31

6 Bid Evaluation and Award 33

6.1 Bid Evaluation Criteria 33

6.2 Reciprocal Preference 33

6.3 Award Determination 33

6.4 Documents Required upon Notice of Recommendation for Contract Award 33

7 IFB ATTACHMENTS AND APPENDICES 34

IFB for Department of Housing and Community Development (DHCD) Page 7 of 71

1 Minimum Qualifications

1.1 Bidder Minimum Qualifications

As part of the determination to be considered responsive, the Bidder must document in its Bid that it satisfies the following Minimum Qualifications:

1.1.1 Experience:

The Bidder shall have at least three (3) years of experience providing credit reports on individual borrowers in the form of a credit report inclusive of all three credit reporting agencies (Equifax, Experian and Transunion) and including each of the items identified in

Section 2.3.1.

1.1.2 Experience Affidavit:

As proof of meeting this requirement, the Bidder shall provide with its Bid an Experience

Affidavit (Attachment P) that attests to the Bidder’s required 3 years of experience in providing such credit reports.

IFB for Department of Housing and Community Development (DHCD) Page 8 of 71

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.1.1 The State of Maryland (“State”), acting through the Maryland Department of Housing and

Community Development (“DHCD” or the "Department") is issuing this Invitation for Bids

(“IFB”), to seek qualified Contractors to assist DHCD with the analysis of single-family borrower(s) applications for homeownership loans. DHCD is seeking bids for Three-in-One credit reporting services.

2.1.2 It is the State’s intention to obtain goods and services, as specified in this IFB, from a contract between the selected bidder and the State (the “Contract”).

2.1.3 The Department intends to make a single award for the work under this IFB. See IFB Section 4.9

Award Basis for more Contract award information.

2.1.4 A bidder, either directly or through its subcontractor(s), must be able to provide all goods and services and meet all of the requirements requested in this solicitation and the successful bidder

(the Contractor) shall remain responsible for Contract performance regardless of subcontractor participation in the work.

2.1.5 Maryland State and local entities as defined in Finance and Procurement §13-110(a) and nonprofit entities within the State of Maryland may purchase from the Contractor goods or services covered by the Contract at the same prices chargeable to the State. All such purchases by non-executive branch entities, non-State governments, government agencies or nonprofit entities:

• Shall constitute Contracts between the Contractor and that entity;

• Shall not constitute purchases by the State or State agencies under the Contract;

• Shall not be binding or enforceable against the State; and

• May be subject to other terms and conditions agreed to by the Contractor and the purchaser.

2.1.6 All Contract prices, terms, and conditions must be provided to any Maryland local government or nonprofit entity requesting services under the Contract. The Contractor bears the risk of determining whether or not a government, agency or organization with which the Contractor is dealing is a State entity.

2.2 Background and Purpose

The State is issuing this solicitation for the purposes of inviting qualified firms to provide credit reporting services for reports inclusive of all three credit reporting agencies – Equifax, Experian, and TransUnion.

Credit reports will be provided on individual single-family borrowers who have applied to DHCD for a homeownership loan, to assist DHCD in deciding whether to approve the application for loan.

The Bid Form is for estimate purposes only and is not a guarantee of minimum or maximum level of anticipated services; the Department will pay only for credit reports specifically ordered and satisfactorily completed. Please be advised, payments made are based on a per credit report flat fee basis (see

Attachment B-1: Bid Form) and this must be taken into account when submitting bid forms.

IFB for Department of Housing and Community Development (DHCD) Page 9 of 71

2.3 Responsibilities and Tasks

Provide, for each individual borrower, one consolidated report that combines information from all three credit reporting agencies (Equifax, Experian, and TransUnion).

2.3.1 Report Specifications

Each report shall include, at a minimum, the following information:

A) Aggregate report of all applicants that separates them by risk.

B) Flagging on any report that may have been subject to identity theft.

C) Indication of whether or not applicants are self-employed.

D) FICO Score as expressly developed by the Fair Isaac Corporation (typically three per borrower).

E) Credit information provided in the form of a Residential Mortgage Credit Report (“RMCR”).

F) The report must be a tri-merge report of all three credit reporting agencies on individual and joint borrowers.

G) The report must provide source of trade information by credit line.

H) The report must show all public record filings.

I) The report and retrieval of RMCR must be over the internet.

J) The Contractor shall load report results to a point-of-sale software such as Calyx Ponte, Encompass, Empower, etc.

IFB for Department of Housing and Community Development (DHCD) Page 10 of 71

3 Contractor Requirements: General

3.1 Contract Initiation Requirements

THIS SECTION IS INAPPLICABLE TO THIS IFB.

3.2 End of Contract Transition

THIS SECTION IS INAPPLICABLE TO THIS IFB.

3.3 Invoicing

3.3.1 General

a) The Contractor shall send the original of each invoice to the Contract Monitor, Jack A.

Daniels at e-mail address: jack.daniels2@maryland.gov .

All invoices for services shall be verified by the Contractor as accurate at the time of submission.

An invoice not satisfying the requirements of a Proper Invoice (as defined in COMAR 21.06.09) cannot be processed for payment. To be considered a Proper Invoice, invoices must include the following information, without error:

1) Contractor name and address;

2) Remittance address;

3) Federal taxpayer identification (FEIN) number or social security number, as appropriate;

4) Invoice period (i.e. time period during which services covered by invoice were performed);

5) Invoice date;

6) Invoice number;

7) State assigned Contract number;

8) State assigned (Blanket) Purchase Order number(s);

9) Goods or services provided;

10) Amount due; and

11) Any additional documentation required by regulation or the Contract.

Invoices that contain both fixed price and time and material items shall clearly identify each item as either fixed price or time and material billing.

The Department reserves the right to reduce or withhold Contract payment in the event the Contractor does not provide the Department with all required deliverables within the time frame specified in the Contract or otherwise breaches the terms and conditions of the Contract until such time as the Contractor brings itself into full compliance with the Contract.

Any action on the part of the Department, or dispute of action by the Contractor, shall be in accordance with the provisions of Md. Code Ann., State Finance and Procurement Article §§ 15-215 through 15-223 and with COMAR 21.10.04.

mailto:jack.daniels2@maryland.gov

IFB for Department of Housing and Community Development (DHCD) Page 11 of 71

The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of Columbia sales taxes and transportation taxes. The Contractor, however, is not exempt from such sales and use taxes and may be liable for the same.

Invoices for final payment shall be clearly marked as “FINAL” and submitted when all work requirements have been completed and no further charges are to be incurred under the Contract. In no event shall any invoice be submitted later than sixty (60) calendar days from the Contract termination date.

3.3.2 Invoice Submission Schedule

The Contractor shall submit invoices in accordance with the following schedule:

a) For items of work for which there is one-time pricing (see Attachment B –Bid Form), those items shall be billed in the month following the acceptance of the work by the Department.

b) For items of work for which there is annual pricing (see Attachment B–Bid Form), those items shall be billed in equal monthly installments for the applicable Contract year in the month following the performance of the services.

3.3.3 Deliverable Invoicing

a) Deliverable invoices shall be accompanied by notice(s) of acceptance issued by the State for all invoices submitted for payment. Payment of invoices will be withheld if a signed DPAF is not submitted (see online example at http://doit.maryland.gov/contracts/Documents/_procurementForms/DeliverableProductAcce ptanceForm-DPAFsample.pdf).

Payment for deliverables will only be made upon completion and acceptance of the deliverables as defined in Section 2.

3.3.4 Time and Materials Invoicing

THIS SECTION IS INAPPLICABLE TO THIS IFB

3.3.5 For the purposes of the Contract an amount will not be deemed due and payable if:

a) The amount invoiced is inconsistent with the Contract;

b) The proper invoice has not been received by the party or office specified in the Contract;

c) The invoice or performance is in dispute or the Contractor has failed to otherwise comply with the provisions of the Contract;

d) The item or services have not been accepted;

e) The quantity of items delivered is less than the quantity ordered;

f) The items or services do not meet the quality requirements of the Contract;

g) If the Contract provides for progress payments, the proper invoice for the progress payment has not been submitted pursuant to the schedule;

h) If the Contract provides for withholding a retainage and the invoice is for the retainage, all stipulated conditions for release of the retainage have not been met; or

i) The Contractor has not submitted satisfactory documentation or other evidence reasonably required by the Procurement Officer or by the Contract concerning performance under the

Contract and compliance with its provisions.

IFB for Department of Housing and Community Development (DHCD) Page 12 of 71

3.3.6 Travel Reimbursement

Travel will not be reimbursed under this IFB.

3.3.7 Retainage

THIS SECTION IS INAPPLICABLE TO THIS IFB.

3.4 Liquidated Damages

3.4.1 MBE Liquidated Damages

THIS SECTION IS INAPPLICABLE TO THIS IFB.

3.4.2 Liquidated Damages other than MBE

THIS SECTION IS INAPPLICABLE TO THIS IFB.

3.5 Disaster Recovery and Data

THIS SECTION IS INAPPLICABLE TO THIS IFB

3.6 Insurance Requirements

The Contractor shall maintain, at a minimum, the insurance coverages outlined below, or any minimum requirements established by law if higher, for the duration of the Contract, including option periods, if exercised:

3.6.1 The following type(s) of insurance and minimum amount(s) of coverage are required:

a) Commercial General Liability - of $1,000,000 combined single limit per occurrence for bodily injury, property damage, and personal and advertising injury and $2,000,000 annual aggregate.

The minimum limits required herein may be satisfied through any combination of primary and umbrella/excess liability policies.

b) Errors and Omissions/Professional Liability - $1,000,000 per combined single limit per claim and $3,000,000 annual aggregate.

c) Worker’s Compensation - The Contractor shall maintain such insurance as necessary or as required under Workers’ Compensation Acts, the Longshore and Harbor Workers’

Compensation Act, and the Federal Employers’ Liability Act, to not be less than. one million dollars ($1,000,000) per occurrence (unless a state’s law requires a greater amount of coverage). Coverage must be valid in all states where work is performed.

3.6.2 The State shall be listed as an additional insured on the faces of the certificates associated with the coverages listed above, including umbrella policies, excluding Workers’ Compensation Insurance and professional liability.

3.6.3 All insurance policies shall be endorsed to include a clause requiring the insurance carrier provide the Procurement Officer, by certified mail, not less than thirty (30) calendar days’ advance notice of any non-renewal, cancellation, or expiration. The Contractor shall notify the Procurement

Officer in writing, if policies are cancelled or not renewed within five (5) business days of learning of such cancellation or nonrenewal. The Contractor shall provide evidence of replacement insurance coverage to the Procurement Officer at least fifteen (15) calendar days prior to the expiration of the insurance policy then in effect.

IFB for Department of Housing and Community Development (DHCD) Page 13 of 71

3.6.4 Any insurance furnished as a condition of the Contract shall be issued by a company authorized to do business in the State.

3.6.5 The recommended awardee must provide current certificate(s) of insurance with the prescribed coverages, limits and requirements set forth in this section within five (5) Business Days from notice of recommended award. During the period of performance for multi-year contracts, the

Contractor shall provide certificates of insurance annually, or as otherwise directed by the Contract

Monitor.

3.6.6 The Contractor shall require any subcontractors to obtain and maintain comparable levels of coverage and shall provide the Contract Monitor with the same documentation as is required of the Contractor.

3.7 Security Requirements

The following requirements are applicable to the Contract:

3.7.1 Employee Identification

a) Contractor Personnel shall display his or her company ID badge in a visible location at all times while on State premises. Upon request of authorized State personnel, each Contractor

Personnel shall provide additional photo identification.

b) Contractor Personnel shall cooperate with State site requirements, including but not limited to, being prepared to be escorted at all times, and providing information for State badge issuance.

c) Contractor shall remove any Contractor Personnel from working on the Contract where the

State determines, in its sole discretion, that Contractor Personnel has not adhered to the

Security requirements specified herein.

d) The State reserves the right to request that the Contractor submit proof of employment authorization of non-United States citizens, prior to commencement of work under the

Contract.

3.7.2 Security Clearance / Criminal Background Check

THIS SECTION IS INAPPLICABLE TO THIS IFB.

3.7.3 On-Site Security Requirement(s)

THIS SECTION IS INAPPLICABLE TO THIS IFB.

3.7.4 Information Technology

The Contractor shall:

1) Implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security such as those listed below (see Section 3.7.5);

2) Ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of the Contract;

and

IFB for Department of Housing and Community Development (DHCD) Page 14 of 71

3) The Contractor, and Contractor Personnel, shall (i) abide by all applicable federal, State and local laws, rules and regulations concerning security of Information Systems and Information Technology and (ii) comply with and adhere to the State IT Security

Policy and Standards as each may be amended or revised from time to time. Updated and revised versions of the State IT Policy and Standards are available online at:

www.doit.maryland.gov – keyword: Security Policy.

3.7.5 Data Protection and Controls

A. Contractor shall ensure a secure environment for all State data and any hardware and software

(including but not limited to servers, network and data components) provided or used in connection with the performance of the Contract and shall apply or cause application of appropriate controls so as to maintain such a secure environment (“Security Best Practices”).

Such Security Best Practices shall comply with an accepted industry standard, such as the NIST cybersecurity framework.

B. To ensure appropriate data protection safeguards are in place, the Contractor shall implement and maintain the following controls at all times throughout the Term of the Contract (the

Contractor may augment this list with additional controls):

1) Establish separate production, test, and training environments for systems supporting the services provided under the Contract and ensure that production data is not replicated in test or training environment(s) unless it has been previously anonymized or otherwise modified to protect the confidentiality of Sensitive Data elements. The

Contractor shall ensure the appropriate separation of production and non-production environments by applying the data protection and control requirements listed in

Section 3.7.5.

2) Apply hardware and software hardening procedures as recommended by Center for

Internet Security (CIS) guides https://www.cisecurity.org/ Security Technical

Implementation Guides (STIG) https://public.cyber.mil/stigs/, or similar industry best practices to reduce the systems’ surface of vulnerability, eliminating as many security risks as possible and documenting what is not feasible or not performed according to best practices. Any hardening practices not implemented shall be documented with a plan of action and milestones including any compensating control.

These procedures may include but are not limited to removal of unnecessary software, disabling or removing unnecessary services, removal of unnecessary usernames or logins, and the deactivation of unneeded features in the Contractor’s system configuration files.

3) Ensure that State data is not comingled with non-State data through the proper application of compartmentalization Security Measures.

4) Apply data encryption to protect Sensitive Data at all times, including in transit, at rest, and also when archived for backup purposes. Unless otherwise directed, the

Contractor is responsible for the encryption of all Sensitive Data.

5) For all State data the Contractor manages or controls, data encryption shall be applied to such data in transit over untrusted networks.

6) Encryption algorithms which are utilized for encrypting data shall comply with current Federal Information Processing Standards (FIPS), “Security Requirements for

Cryptographic Modules”, FIPS PUB 140-2:

https://www.cisecurity.org/ https://public.cyber.mil/stigs/

IFB for Department of Housing and Community Development (DHCD) Page 15 of 71 http://csrc.nist.gov/publications/fips/fips140-2/fips 1402.pdf http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm

7) Enable appropriate logging parameters to monitor user access activities, authorized and failed access attempts, system exceptions, and critical information security events as recommended by the operating system and application manufacturers and information security standards, including Maryland Department of Information

Technology’s Information Security Policy.

8) Retain the aforementioned logs and review them at least daily to identify suspicious or questionable activity for investigation and documentation as to their cause and remediation, if required. The Department shall have the right to inspect these policies and procedures and the Contractor or subcontractor’s performance to confirm the effectiveness of these measures for the services being provided under the Contract.

9) Ensure system and network environments are separated by properly configured and updated firewalls.

10) Restrict network connections between trusted and untrusted networks by physically or logically isolating systems from unsolicited and unauthenticated network traffic.

11) By default “deny all” and only allow access by exception.

12) Review, at least annually, the aforementioned network connections, documenting and confirming the business justification for the use of all service, protocols, and ports allowed, including the rationale or compensating controls implemented for those protocols considered insecure but necessary.

13) Perform regular vulnerability testing of operating system, application, and network devices. Such testing is expected to identify outdated software versions; missing software patches; device or software misconfigurations; and to validate compliance with or deviations from the security policies applicable to the Contract. Contractor shall evaluate all identified vulnerabilities for potential adverse effect on security and integrity and remediate the vulnerability no later than 30 days following the earlier of vulnerability’s identification or public disclosure, or document why remediation action is unnecessary or unsuitable. The Department shall have the right to inspect the Contractor’s policies and procedures and the results of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the

Contract.

14) Enforce strong user authentication and password control measures to minimize the opportunity for unauthorized access through compromise of the user access controls.

At a minimum, the implemented measures should be consistent with the most current

Maryland Department of Information Technology’s Information Security Policy

(https://doit.maryland.gov/policies/Pages/default.aspx), including specific requirements for password length, complexity, history, and account lockout.

15) Ensure State data is not processed, transferred, or stored outside of the United States

(“U.S.”). The Contractor shall provide its services to the State and the State’s end users solely from data centers in the U.S. Unless granted an exception in writing by the State, the Contractor shall not allow Contractor Personnel to store State data on portable devices, including personal computers, except for devices that are used and http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm https://doit.maryland.gov/policies/Pages/default.aspx

IFB for Department of Housing and Community Development (DHCD) Page 16 of 71 kept only at its U.S. data centers. The Contractor shall permit its Contractor Personnel to access State data remotely only as required to provide technical support.

16) Ensure Contractor’s Personnel shall not connect any of its own equipment to a State

LAN/WAN without prior written approval by the State, which may be revoked at any time for any reason. The Contractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the State to connect Contractor -owned equipment to a State LAN/WAN.

17) Ensure that anti-virus and anti-malware software is installed and maintained on all systems supporting the services provided under the Contract; that the anti-virus and anti-malware software is automatically updated; and that the software is configured to actively scan and detect threats to the system for remediation. The Contractor shall perform routine vulnerability scans and take corrective actions for any findings.

18) Conduct regular external vulnerability testing designed to examine the service provider’s security profile from the Internet without benefit of access to internal systems and networks behind the external security perimeter. Evaluate all identified vulnerabilities on Internet-facing devices for potential adverse effect on the service’s security and integrity and remediate the vulnerability promptly or document why remediation action is unnecessary or unsuitable. The Department shall have the right to inspect these policies and procedures and the performance of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

3.7.6 Security Logs and Reports Access

THIS SECTION IS INAPPLICABLE TO THIS IFB.

3.7.7 Security Plan

THIS SECTION IS INAPPLICABLE TO THIS IFB

3.7.8 Data Breach Responsibilities

A. If the Contractor reasonably believes or has actual knowledge of a Data Breach, the

Contractor shall, unless otherwise directed:

1) Notify the appropriate State-identified contact within 24 hours by telephone in accordance with the agreed upon security plan or security procedures unless a shorter time is required by applicable law;

2) Cooperate with the State to investigate and resolve the data breach;

3) Promptly implement commercially reasonable remedial measures to remedy the

Data Breach; and

4) Document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services.

B. If a Data Breach is a direct result of the Contractor’s breach of its Contract obligation to encrypt

State data or otherwise prevent its release, the Contractor shall bear the costs associated with

(1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by State law; (3) a credit monitoring service required by State or

IFB for Department of Housing and Community Development (DHCD) Page 17 of 71 federal law; (4) a website or a toll-free number and call center for affected individuals required by State law; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause; all [(1) through (5)] subject to the Contract’s limitation of liability.

3.8 Problem Escalation Procedure

3.8.1 The Contractor must provide and maintain a Problem Escalation Procedure (PEP) for both routine and emergency situations. The PEP must state how the Contractor will address problem situations as they occur during the performance of the Contract, especially problems that are not resolved to the satisfaction of the State within appropriate timeframes.

3.8.2 The Contractor shall provide contact information to the Contract Monitor, as well as to other State personnel as directed should the Contract Monitor not be available.

3.8.3 The Contractor shall provide the PEP no later than ten (10) Business Days after notice of recommended award or after the date of the Notice to Proceed, whichever is earlier. The PEP, including any revisions thereto, must also be provided within ten (10) Business Days after the start of each Contract year and within ten (10) Business Days after any change in circumstance which changes the PEP. The PEP shall detail how problems with work under the Contract will be escalated in order to resolve any issues in a timely manner. The PEP shall include:

a) The process for establishing the existence of a problem;

b) Names, titles, and contact information for progressively higher levels of personnel in the

Contractor’s organization who would become involved in resolving a problem;

c) For each individual listed in the Contractor’s PEP, the maximum amount of time a problem will remain unresolved with that individual before the problem escalates to the next contact person listed in the Contractor’s PEP;

d) Expedited escalation procedures and any circumstances that would trigger expediting them;

e) The method of providing feedback on resolution progress, including the frequency of feedback to be provided to the State;

f) Contact information for persons responsible for resolving issues after normal business hours

(e.g., evenings, weekends, holidays) and on an emergency basis; and

g) A process for updating and notifying the Contract Monitor of any changes to the PEP.

3.8.4 Nothing in this section shall be construed to limit any rights of the Contract Monitor or the State which may be allowed by the Contract or applicable law.

3.9 SOC 2 Type 2 Audit Report

THIS SECTION IS INAPPLICABLE TO THIS IFB

3.10 Minority Business Enterprise (MBE) Reports

THIS SECTION IS INAPPLICABLE TO THIS IFB

3.11 Veteran Small Business Enterprise (VSBE) Reports

THIS SECTION IS INAPPLICABLE TO THIS IFB

IFB for Department of Housing and Community Development (DHCD) Page 18 of 71

3.12 Work Orders

See Section 2.3 for Responsibilities and Tasks

3.13 Additional Clauses

THIS SECTION IS INAPPLICABLE TO THIS IFB.

3.14 No-Cost Extensions

In accordance with BPW Advisory 1995-1 item 7.b, in the event there are unspent funds remaining on the

Contract, prior to the Contract's expiration date the Procurement Officer may modify the Contract to extend the Contract beyond its expiration date for a period up to, but not exceeding, one-third of the base term of the Contract (e.g., eight-month extension on a two-year contract) for the performance of work within the

Contract's scope of work. Notwithstanding anything to the contrary, no funds may be added to the Contract in connection with any such extension.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

IFB for Department of Housing and Community Development (DHCD) Page 19 of 71

4 Procurement Instructions

4.1 Pre-Bid Conference

4.1.1 A pre-bid conference will be held at the date, time, and location indicated on the Key

Information Summary Sheet.

4.1.2 Attendance at the Conference is not mandatory, but all interested parties are encouraged to attend in order to facilitate better preparation of their bids.

4.1.3 Following the Conference, the attendance record and summary of the Conference will be distributed via the same mechanism described for amendments and questions (see Section

4.2.1 – eMMA).

4.1.4 In order to assure adequate accommodations at the Google Meet virtual Teleconference, please e-mail the Pre-Bid Conference Response Form (Attachment A) no later than the time and date indicated on the form. In addition, if there is a need for sign language interpretation or other special accommodations due to a disability, please notify the Procurement Officer at least seven (7) Business Days prior to the Conference date. The Department will make a reasonable effort to provide such special accommodation.

4.1.5 Those wishing to attend the Google Meet virtual Teleconference may request an invitation by emailing Joy Niles the Pre-Bid Conference Response Form (Attachment A) at joy.niles@maryland.gov no later than 3:00 PM the day before the teleconference. Upon receipt of the email, the Procurement Officer will reply via email with a link that may be used to login for the Teleconference.

4.2 eMaryland Marketplace Advantage (eMMA)

4.2.1 eMMA is the electronic commerce system for the State of Maryland. The IFB, Conference summary and attendance sheet, Bidders’ questions and the Procurement Officer’s responses, addenda, and other solicitation-related information will be made available via eMMA.

4.2.2 In order to receive a contract award, a vendor must be registered on eMMA.

Registration is free. Go to emma.maryland.gov, click on “New Vendor? Register

Now” to begin the process, and then follow the prompts.

4.3 Questions

4.3.1 All questions, including concerns regarding any applicable MBE or VSBE participation goals, shall identify in the subject line the Solicitation Number and Title (S00R3600017 -

THREE-IN-ONE CREDIT SERVICES), and shall be submitted in writing via e-mail to the

Procurement Officer no later than the date and time specified the Key Information Summary

Sheet. The Procurement Officer, based on the availability of time to research and communicate an answer, shall decide whether an answer can be given before the bid due date.

4.3.2 Answers to all questions that are not clearly specific only to the requestor will be distributed via the same mechanism as for IFB amendments and posted on eMMA.

4.3.3 The statements and interpretations contained in responses to any questions, whether responded to verbally or in writing, are not binding on the Department unless it issues an amendment in writing.

mailto:joy.niles@maryland.gov https://emma.maryland.gov/page.aspx/en/usr/login?ReturnUrl=%2fpage.aspx%2fen%2fbuy%2fhomepage

IFB for Department of Housing and Community Development (DHCD) Page 20 of 71

4.4 Procurement Method

A Contract will be awarded in accordance with the Competitive Sealed Bidding method under COMAR

21.05.02.

4.5 Bid Due (Closing) Date and Time

4.5.1 Bids, in the number and form set forth in Section 5 (Bid Format), must be submitted electronically through eMMA and received by the Procurement Officer no later than the bid due date and time indicated on the Key Information Summary Sheet in order to be considered.

4.5.2 Requests for extension of this date or time shall not be granted.

4.5.3 Bidders submitting bids should allow sufficient delivery time to ensure timely receipt by the

Procurement Officer. Except as provided in COMAR 21.05.02.10, bids received after the due date and time listed in the Key Information Summary Sheet will not be considered.

4.5.4 Bids will be accepted through the State’s eMaryland Marketplace Advantage (eMMA) e-

Procurement system. Instructions on how to submit bids electronically can be found at:

https://procurement.maryland.gov/wp-content/uploads/sites/12/2019/08/5-eMMA-QRG-

Responding-to-Solicitations-Double-Envelope-v2.pdf

4.5.5 Bids may be modified or withdrawn through eMMA before the time and date set forth in the

Key Information Summary Sheet for receipt of bids.

4.5.6 Bids may not be submitted by e-mail or facsimile.

4.5.7 Potential bidders not responding to this solicitation are requested to submit the “No Bid

Notice/Vendor Feedback” form, which includes company information and the reason for not responding (e.g., too busy, cannot meet mandatory requirements).

4.6 Multiple or Alternate Bids

Multiple or alternate bids will not be accepted.

4.7 Receipt, Opening and Recording of Bids

4.7.1 Upon receipt, each bid and any timely modification(s) to a bid shall be stored in a secure place until the time and date set for bid opening. Before bid opening, the State may not disclose the identity of any bidder.

4.7.2 Bids shall be opened, on the date, designated in the IFB Key Information Summary Sheet

(near the beginning of the solicitation, after the Title Page and Notice to Vendors). The name of each bidder, the Total Bid Price, and such other information as is deemed appropriate shall be read aloud or otherwise made available and recorded at the time of bid opening.

4.8 Confidentiality of Bids / Public Information Act Notice

4.8.1 The bidder should give specific attention to the clear identification of those portions of its bid that it considers confidential and/or proprietary commercial information or trade secrets, and provide justification why such materials, upon request, should not be disclosed by the

State under the Public Information Act, Md. Code Ann., General Provisions Article, Title

4. This information should be identified by page number and placed in the Transmittal

Letter with the bid.

https://procurement.maryland.gov/wp-content/uploads/sites/12/2019/08/5-eMMA-QRG-Responding-to-Solicitations-Double-Envelope-v2.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2019/08/5-eMMA-QRG-Responding-to-Solicitations-Double-Envelope-v2.pdf

IFB for Department of Housing and Community Development (DHCD) Page 21 of 71

4.8.2 The bids shall be tabulated, or a bid abstract made. The opened bids shall be available for public inspection at a reasonable time after bid opening, but in any case, before contract award, except to the extent the bidder designates trade secrets or other proprietary data to be confidential as set forth in this solicitation. Material so designated as confidential shall accompany the bid and shall be readily separable from the bid in order to facilitate public inspection of the non-confidential portion of the bid, including the Total Bid Price.

4.8.3 For requests for information made under the PIA, the Procurement Officer shall examine the bids to determine the validity of any requests for nondisclosure of trade secrets and other proprietary data identified in writing. Nondisclosure is permissible only if approved by the

Office of the Attorney General.

4.9 Award Basis

4.9.1 A Contract shall be awarded to the responsible bidder(s) submitting a responsive bid with the most favorable bid price or most favorable evaluated bid price (as referenced in COMAR

21.05.02.13) for providing the goods and services as specified in this IFB. Bidders must bid all line items. Partial or incomplete bids will be rejected unless otherwise stated in the solicitation. See IFB Section 6 for bid evaluation and award information.

4.9.2 Award of this contract will not be final and complete until after: (1) the Contractor submits complete and satisfactory documentation required under the Contract and/or documentation required by the Procurement Officer; and (2) the Contract is signed by the Department following any required approvals of the Contract, including approval by the Board of Public

Works, if such approval is required.

4.10 Tie Bids

Tie bids will be decided pursuant to COMAR 21.05.02.14.

4.11 Duration of Bids

Bids submitted in response to this IFB are irrevocable for the latest of the following: one hundred twenty

(120) calendar days following the bid due date and time or the date any protest concerning this IFB is finally resolved. This period may be extended at the Procurement Officer’s request only with the bidder’s written agreement.

4.12 Revisions to the IFB

4.12.1 If the IFB is revised before the due date for bids, the Department shall post any addenda to the IFB on eMMA and shall endeavor to provide such addenda to all prospective bidders that were sent this IFB or are otherwise known by the Procurement Officer to have obtained this IFB. It remains the responsibility of all prospective bidders to check eMMA for any addenda issued prior to the submission of bids.

4.12.2 Bidders shall acknowledge the receipt of all addenda to this IFB issued before the bid due date.

4.12.3 Failure to acknowledge receipt of an addendum does not relieve the bidder from complying with the terms, additions, deletions, or corrections set forth in the addendum, and may cause the bid to be deemed not responsive.

IFB for Department of Housing and Community Development (DHCD) Page 22 of 71

4.13 Cancellations

4.13.1 The State reserves the right to cancel this IFB, accept or reject any and all bids, in whole or in part, received in response to this IFB and to waive or permit the cure of minor irregularities.

4.13.2 In the event a government entity proposes and receives the recommendation for award, the procurement may be cancelled, and the award processed in accordance with COMAR

21.01.03.01.A(4).

4.13.3 If the services that are the subject of the IFB are currently being provided under an interagency agreement with a public institution of higher education and the State determines that the services can be provided more cost effectively by the public institution of higher education, then the IFB may be cancelled in accordance with Md. Code Ann., State Finance and Procurement Art., § 3-207(b)(2).

4.14 Incurred Expenses

The State will not be responsible for any costs incurred by any bidder in preparing and submitting a bid or performing any other activities related to submitting a bid in response to this solicitation.

4.15 Protest/Disputes

Any protest or dispute related to this solicitation or the Contract award shall be subject to the provisions of COMAR 21.10 (Administrative and Civil Remedies).

4.16 Bidder Responsibilities

4.16.1 Bidders must be able to provide all goods and services and meet all of the requirements requested in this solicitation and the successful bidder shall be responsible for Contract performance including any subcontractor participation.

4.16.2 If applicable, subcontractors utilized in meeting the established MBE or VSBE participation goal(s) for this solicitation shall be identified as provided in the appropriate Attachment(s) to this IFB (see Section 4.26 “MBE Participation Goal” and Section 4.27 “VSBE Goal”).

4.16.3 If the bidder is the subsidiary of another entity, all information submitted by the bidder, including but not limited to references, financial reports, or experience and documentation

(e.g. insurance policies, bonds, letters of credit) used to meet minimum qualifications, if any, shall pertain exclusively to the bidder, unless the parent organization will guarantee the performance of the subsidiary. If applicable, the bidder’s bid shall contain an explicit statement, signed by an authorized representative of the parent organization, stating that the parent organization will guarantee the performance of the subsidiary.

4.16.4 A parental guarantee of the performance of the bidder under this Section will not automatically result in crediting the bidder with the experience or qualifications of the parent under any evaluation criteria pertaining to the actual bidder’s experience and qualifications.

Instead, the bidder’s responsibility will be assessed to the extent to which the State determines that the experience and qualifications of the parent are applicable to and shared with the bidder, any stated intent by the parent to be directly involved in the performance of the Contract, and the value of the parent’s participation as determined by the State.

IFB for Department of Housing and Community Development (DHCD) Page 23 of 71

4.17 Acceptance of Terms and Conditions

By submitting a bid in response to this IFB, the bidder, if selected for award, shall be deemed to have accepted the terms and conditions of this IFB and the Contract, attached hereto as Attachment M. Any exceptions to this IFB or the Contract must be raised prior to bid submission. Changes to the solicitation, including the Bid Form or Contract, made by the bidder may result in bid rejection.

4.18 Bid/Proposal Affidavit

A bid submitted by the bidder must be accompanied by a completed Bid/Proposal Affidavit. A copy of this Affidavit is included as Attachment C of this IFB.

4.19 Contract Affidavit

All bidders are advised that if a Contract is awarded as a result of this solicitation, the successful bidder will be required to complete a Contract Affidavit. A copy of this Affidavit is included for informational purposes as Attachment N of this IFB. This Affidavit must be provided within five (5) Business Days of notification of recommended award. For purposes of completing Section “B” of this Affidavit

(Certification of Registration or Qualification with the State Department of Assessments and Taxation), a business entity that is organized outside of the State of Maryland is considered a “foreign” business.

4.20 Compliance with Laws/Arrearages

By submitting a bid in response to this IFB, the bidder, if selected for award, agrees that it will comply with all federal, State, and local laws applicable to its activities and obligations under the Contract.

By submitting a response to this solicitation, each bidder represents that it is not in arrears in the payment of any obligations due and owing the State, including the payment of taxes and employee benefits, and shall not become so in arrears during the term of the Contract if selected for Contract award.

4.21 Verification of Registration and Tax Payment

Before a business entity can do business in the State, it must be registered with the State Department of

Assessments and Taxation (SDAT). SDAT is located at State Office Building, Room 803, 301 West

Pres…