SIF-25-01_Actuarial_Analysis_of_Projected_Liability___Assessment_Mechanism_RFP.docx

<<solicitationTitle>> Solicitation #: SIF-25-01 RFP Document

Actuarial Analysis of Projected Liability and Assessment Mechanism Solicitation #: SIF-25-01 RFP Document

State of Maryland

SUBSEQUENT INJURY FUND (SIF)

Request for Proposals (RFP) Actuarial Analysis of Projected Liability and Assessment Mechanism RFP Number SIF-25-01 Issue date: APRIL 23, 2025 A Prospective Offeror that has received this document from a source other than eMarylandMarketplace Advantage (eMMA) https://procurement.maryland.gov should register on eMMA https://emma.maryland.gov/

Minority Business Enterprises Are Encouraged to Respond to this Solicitation.

State of Maryland

SUBSEQUENT INJURY FUND (SIF)

Key Information Summary Sheet

222 Schilling Circle, Suite 180 Hunt Valley, MD 21031

Email:

Phone Number:

rhunt@mdsif.state.md.us 410-527-4017

222 Schilling Circle, Suite 180 Hunt Valley, MD 21031

Email:

Phone Number:

edodd@mdsif.state.md.us 410-527-4016

To submit a proposal, offerors must first register on emma.maryland.gov. We recommend registering in advance to become acquainted with the site.

Virtual Teleconference by Calendar Invitation from Procurement Officer Only See Section 4.3 for additional details.

See Appendix 1 to RSVP by May 6, 2025 to Attend

Offerors are reminded that a completed Feedback Form is requested if a no-bid/proposal decision is made (see Appendix 2, No Bid Notice/Vendor Feedback Form).

Six Month Duration. At the sole discretion of the Maryland Subsequent Injury Fund, the contract duration may extend.

222 Schilling Circle, Suite 180 Hunt Valley, MD 21031

TABLE OF CONTENTS – RFP

Minimum Qualifications Offeror Minimum Qualifications

There are no Offeror Minimum Qualifications for this procurement.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

Contractor Requirements: Scope of Work Summary Statement

2.1.1 This Request for Proposals (RFP) is issued to procure the services, as specified in this Section 2, from a contract between the selected offeror(s) and the State of Maryland (“State”). The SUBSEQUENT INJURY FUND (SIF or the "AGENCY") is issuing this Request for Proposals (RFP) in order to provide an actuarial review to project the adequacy of the current funding mechanism to meet the present and future (next ten years) obligations and operational costs of the fund specified in Section 3 of this Request for Proposals (RFP). Subcontracting is not allowed unless explicitly approved by the Contract Monitor or Procurement Officer, in writing.

2.1.2 The SIF was created to provide worker’s compensation benefits to injured workers who have pre-existing injuries or conditions which, when combined with a current injury, result in a significant disability. The liability of the current employer is thus limited to the damage judged to be caused by the current injury and the Fund incurs all additional liability from the combined effects of all injuries and/or conditions. The Fund derives its income from assessments of insurance companies on awards of compensation for permanent disability.

2.1.3 It is the State’s intention to obtain services, as specified in this RFP, from a Contract between the selected Offeror and the State. The anticipated duration of services to be provided under this Contract is approximately six (6) months.

2.1.4 The AGENCY intends to make a single award as a result of this RFP. See RFP Section 4.8 Award Basis for more Contract award information.

2.1.5 An Offeror must be able to provide all services and meet all of the requirements requested in this solicitation and the successful Offeror (the Contractor) shall remain responsible for Contract performance.

2.1.6 The purpose of this solicitation is to obtain services, as specified in this RFP, from a Contract between the selected Offeror and the State.

Background and Purpose The State is issuing this solicitation for the purposes of analyzing the Agency’s adequacy to meet its liabilities. There have been seven (7) previous actuarial analyses. These were performed in 1989, 1991, 1996, 2003, 2011, 2015 and 2021. The major focus of the previous studies was to determine a total unfunded loss liability for the total of the Awarded plus the Impleaded but not yet Awarded claims. While the total unfunded liability of the Agency at a given point in time is of interest, it is now felt that more relevant information will be obtained by limiting the analysis to a future period of ten years from the present.

It is unlikely that adequate financial resources will ever be available to fully fund the Agency’s total liability. The Agency will almost certainly continue to operate on a “pay as you go” basis. Thus far, the assessment rate has proven adequate to pay all claims and allow the Fund Balance to gradually increase. The assessment rate is subject to review by the State Legislature. If future requirements indicate a need to increase the rate, it may take one or more years to effect the change. The requested actuarial analysis is intended to provide the best possible look ahead to provide needed lead time for a rate change or to justify keeping the rate at the current level.

State Staff and Roles In addition to the Procurement Officer and Contract Monitor, the State project team consists of the following:

A. State Agency Information Technology Team

1. Mark Mondor-IT Director I is responsible for providing all necessary electronic system data and information to the Offeror from the Agency during the course of the actuarial investigation.

2. Roman Kulikovsky-IT Assistant Director I will assist in providing all necessary electronic system data and information to the Offeror from the Agency during the course of the actuarial investigation.

B. State Agency Fiscal Services Team

C. State Agency Contract Monitor

1. Edgar G. Dodd-Executive Director is responsible for all activities pertaining to the execution and monitoring of the actuarial investigation.

Contractor Responsibilities and Tasks

The previous 6.5% to 5.5% for five (5) years beginning at the same date as section 2.3.4.

The previous 6.5% to 6.0% for five (5) years beginning at the same date as section 2.3.4.

2.3.6 Thirty days prior to the due date of the final report, deliver a Draft Report discussing preliminary findings for Sections 2.3.1 through 2.3.5 above, and including clear definitions of any assumptions made to come to the reported conclusion. Approval and/or acceptance of the draft report shall rest solely with the Subsequent Injury Fund’s Contract Monitor.

2.3.7 Deliver a Final Report taking into consideration SIF’s comments, clarification and responses to noted assumptions as a result of reviewing the draft report. The final report shall include an Executive Summary or Short Form Summary Section, preferably before the more in-depth analysis. Approval and/or acceptance of the final report shall rest solely with the Subsequent Injury Fund’s Contract Monitor.

2.3.8 Testify before Boards, Legislative and administrative bodies in support of actuarial positions and/or the principles used in valuing subsequent (or second) injury funds. The Offeror shall show proof of experience in testifying before Boards, Legislative and administrative bodies in support of actuarial positions and/or the principles used in valuing subsequent (or second injury Funds).

2.3.9 The required documentation or proof for all items above shall be submitted in the Staffing Plan within the Offeror’s Technical Proposal (see Section 5.3.2 Tab E).

2.3.10 This RFP defines the professional services that the Offeror will deliver, and the responsibilities of both the Offeror and SIF. The Offeror will render services under this RFP upon receipt of the Notice to Proceed from SIF’s Contract Monitor. Any work that is performed before the receipt of a Notice to Proceed from SIF or outside of this Scope of Work, Section 2.3, shall be performed at the Offeror’s risk of non-payment.

Experience and Personnel Offeror Experience The following experience is expected and will be evaluated as part of the Technical Proposal (see the Offeror experience, capability and references evaluation factor from Section 6.2):

A. Demonstrated knowledge of at least three years actuarial experience with Workers Compensation Claims and/or second injury funds in several states. Use of a detailed work plan and multiple methodologies for accuracy with the main goal of estimating ultimate losses. For example, such methodologies include but are not limited to: Cash Flow Projections, Paid Loss Development, Incurred Loss Development, Paid Counts and Averages Development, Incurred Counts and Averages Development, Bornhuetter-Ferguson Method, Extended Exposure and Assessment Mechanism.

B. Prior senior level experience doing Second Injury Fund’s Actuarial Analysis.

C. Breadth of knowledge in evaluating the present claim caseload of the SIF to determine the Fund’s known liabilities over the next 10 years, perform actuarial analysis on impleaded but not yet awarded cases, develop a logical estimation of future cases and their liability over the next ten years and develop a logical estimation of income to the Fund over the next ten years.

D. At least two principal actuarial employees who maintain membership as Fellows in the Casualty Actuarial Society (FCAS), membership in the American Academy of Actuaries (AAA) and at least one other professional Actuary Association that is a member of the International Actuarial Association.

Personnel Experience The following experience is expected and will be evaluated as part of the Technical Proposal (see the capability of proposed resources evaluation factor from Section 6.2):

A. For each Key Person:

B. At least two principal actuarial employees who will be performing the Actuarial Review must maintain membership as Fellows in the Casualty Actuarial Society (FCAS), membership in the American Academy of Actuaries (AAA) and at least one other professional Actuary Association that is a member of the International Actuarial Association (at least four professional actuarial society memberships total).

C. Required Documentation: As proof of meeting this requirement, the Offeror shall provide with its Proposal the letter of membership approval for the Associate (or higher) designation from the CAS and membership materials from at least one other professional Actuary Association.

Number of Personnel to Propose As part of the Proposal evaluation, Offerors shall propose at least three personnel who are expected to be available as of the start date specified in the Notice to Proceed (NTP Date). Offerors shall describe in a Staffing Plan how additional resources shall be acquired to meet the needs of the AGENCY. Offerors may generally describe planned positions in a Staffing Plan. Such planned positions may not be used as evidence of fulfilling personnel minimum qualifications.

Contractor Personnel Maintain Certifications Any Contractor Personnel provided under this RFP shall maintain in good standing the required professional certifications listed in Section 2.4.1D for the duration of the Contract.

Work Hours Unless otherwise specified, the following work hours requirements are applicable:

A. Business Hours Support: Contractor shall assign Contractor Personnel to support Normal State Business Hours (see definition in Appendix 3).

B. Contractor Personnel may also be required to provide occasional support outside of normal State Business Hours, including evenings, overnight, and weekends, to support specific efforts and emergencies.

C. State-Mandated Closings: Contractor Personnel shall be required to participate in any State-mandated closings. In this event, the Contractor will be notified in writing by the Contract Monitor of these details.

D. Minimum and Maximum Hours: Full-time Contractor Personnel shall work 40 hours per week with starting and ending times as approved by the Contract Monitor. A flexible work schedule may be used with Contract Monitor approval, including time to support any efforts outside core business hours. Contractor personnel may also be requested to restrict the number of hours Contractor personnel can work within a given period of time that may result in less than an eight-hour day or less than a 40-hour work week.

E. Vacation Hours: Requests for leave shall be submitted to the Contract Monitor at least two weeks in advance. The Contract Monitor reserves the right to request a temporary replacement if leave extends longer than one consecutive week. In cases where there is insufficient coverage, a leave request may be denied.

Substitution of Personnel Continuous Performance of Key Personnel When Key Personnel are identified for the Contract, the following apply:

A. Key Personnel shall be available to perform Contract requirements as of the NTP Date. Unless explicitly authorized by the Contract Monitor or Procurement Officer specified in the Contract, Key Personnel shall be assigned to the State of Maryland as a dedicated resource.

B. Key Personnel shall perform continuously for the duration of the Contract, or such lesser duration as specified in the Technical Proposal. Key Personnel may not be removed by the Contractor from working under the Contract without the prior written approval of the Contract Monitor.

C. The provisions of this section apply to Key Personnel identified in any Task Order proposal and agreement, if issued, and any Work Order Request and Work Order, if issued.

Definitions For the purposes of this section, the following definitions apply:

A. Extraordinary Personal Event – means any of: leave under the Family Medical Leave Act; an Incapacitating injury or Incapacitating illness; or other circumstances that in the sole discretion of the State warrant an extended leave of absence, such as extended jury duty or extended military service that precludes the individual from performing his/her job duties under the Contract.

B. Incapacitating – means any health circumstance that substantially impairs the ability of an individual to perform the job duties described for that individual’s position in the RFP or the Contractor’s Technical Proposal.

Contractor Personnel General Substitution Provisions The following provisions apply to all of the circumstances of Contractor Personnel substitution described in Section 2.5.4.

A. The Contractor shall demonstrate to the Contract Monitor’s satisfaction that the proposed substitute has qualifications at least equal to those of the Contractor Personnel proposed to be replaced.

B. The Contractor shall provide the Contract Monitor with a substitution request that shall include:

1. A detailed explanation of the reason(s) for the substitution request;

2. The resume of the proposed substitute, signed by the substituting individual and his/her formal supervisor;

3. The official resume of the current personnel for comparison purposes; and

4. Evidence of any required credentials.

C. The Contract Monitor may request additional information concerning the proposed substitution and may interview the proposed substitute personnel prior to deciding whether to approve the substitution request.

D. The Contract Monitor will notify the Contractor in writing of: (i) the acceptance or denial, or (ii) contingent or temporary approval for a specified time limit, of the requested substitution. The Contract Monitor will not unreasonably withhold approval of a proposed Contractor Personnel replacement.

Replacement Circumstances A. Directed Personnel Replacement

1. The Contract Monitor may direct the Contractor to replace any Contractor Personnel who, in the sole discretion of the Contract Monitor, are perceived as being unqualified, non-productive, unable to fully perform the job duties, disruptive, or known, or reasonably believed, to have committed a major infraction(s) of law, Agency policies, or Contract requirements. Normally, a directed personnel replacement will occur only after prior notification of problems with requested remediation, as described in paragraph 2.5.4.A.2.

2. If deemed appropriate in the discretion of the Contract Monitor, the Contract Monitor may give written notice of any Contractor Personnel performance issues to the Contractor, describing the problem and delineating the remediation requirement(s). The Contractor shall provide a written response to the remediation requirements in a Remediation Plan within ten (10) days of the date of the notice and shall immediately implement the Remediation Plan upon written acceptance by the Contract Monitor. If the Contract Monitor rejects the Remediation Plan, the Contractor shall revise and resubmit the plan to the Contract Monitor within five (5) days, or in the timeframe set forth by the Contract Monitor in writing.

3. Should performance issues persist despite an approved Remediation Plan, the Contract Monitor may give written notice of the continuing performance issues and either request a new Remediation Plan within a specified time limit or direct the substitution of Contractor Personnel whose performance is at issue with a qualified substitute, including requiring the immediate removal of the Contractor Personnel at issue.

4. Replacement or substitution of Contractor Personnel under this section shall be in addition to, and not in lieu of, the State’s remedies under the Contract or which otherwise may be available at law or in equity.

5. If the Contract Monitor determines to direct substitution under paragraph 2.5.4.A.1, if at all possible, at least fifteen (15) days advance notice shall be given to the Contractor. However, if the Contract Monitor deems it necessary and in the State’s best interests to remove the Contractor Personnel with less than fifteen (15) days’ notice, the Contract Monitor may direct the removal in a timeframe of less than fifteen (15) days, including immediate removal.

6. In circumstances of directed removal, the Contractor shall, in accordance with paragraph 2.5.4.A.1 of this section, provide a suitable replacement for approval within fifteen (15) days of the notification of the need for removal, or the actual or immediate removal, whichever occurs first.

B. Key Personnel Replacement To replace any Key Personnel in a circumstance other than as described in paragraph 2.5.4.A.1, including transfers and promotions, the Contractor shall submit a substitution request as described in paragraph 2.5.3 to the Contract Monitor at least fifteen (15) days prior to the intended date of change. A substitution may not occur unless and until the Contract Monitor approves the substitution in writing.

C. Key Personnel Replacement Due to Sudden Vacancy

1. The Contractor shall replace Key Personnel whenever a sudden vacancy occurs (e.g., Extraordinary Personal Event, death, resignation, termination). A termination or resignation with fifteen (15) days or more advance notice shall be treated as a replacement under paragraph 2.5.4.A.1.

2. Under any of the circumstances set forth in this paragraph B, the Contractor shall identify a suitable replacement and provide the same information and items required under Section 2.5.3 within fifteen (15) days of the actual vacancy occurrence or from when the Contractor first knew or should have known that the vacancy would be occurring, whichever is earlier.

D. Key Personnel Replacement Due to an Indeterminate Absence

3. If any Key Personnel has been absent from his/her job for a period of five (5) days and it is not known or reasonably anticipated that the individual will be returning to work within the next ten (10) days to fully resume all job duties, before the 20th day of continuous absence, the Contractor shall identify a suitable replacement and provide the same information and items to the Contract Monitor as required under Section 2.5.3.

4. However, if this person is available to return to work and fully perform all job duties before a replacement has been authorized by the Contract Monitor, the Contract Monitor may, at his/her sole discretion, authorize the original personnel to continue to work under the Contract, or authorize the replacement personnel to replace the original personnel, notwithstanding the original personnel’s ability to return.

Substitution Prior to and Within 30 Days After Contract Execution Prior to Contract execution or within thirty (30) days after Contract execution, the Offeror may not substitute proposed Key Personnel except under the following circumstances (a) for actual full-time personnel employed directly by the Offeror: the vacancy occurs due to the sudden termination, resignation, or approved leave of absence due to an Extraordinary Personal Event, or the death of such personnel; and (b) for any temporary staff, subcontractors or 1099 contractors: the vacancy occurs due to an Incapacitating event or the death of such personnel. To qualify for such substitution, the Offeror must demonstrate to the State's satisfaction the event necessitating substitution. Proposed substitutions shall be of equal caliber or higher, in the State's sole discretion. Proposed substitutes deemed by the State to be less qualified than the originally proposed individual may be grounds for pre-award disqualification or post-award termination Deliverables 2.4 2.5

2.6.1 Deliverable Submission

A. For every deliverable, the Contractor shall request the Contract Monitor confirm receipt of that deliverable by sending an e-mail identifying the deliverable name and date of receipt.

B. Unless specified otherwise, written deliverables shall be compatible with Microsoft Office including Word and Excel, or Microsoft Project within two (2) versions of the 2016 version (2019 or 2021). At the Contract Monitor’s discretion, the Contract Monitor may request one hard copy of a written deliverable.

C. A standard deliverable review cycle will be elaborated and agreed-upon between the State and the Contractor. This review process is entered into when the Contractor completes a deliverable.

D. For any written deliverable, the Contract Monitor may request a draft version of the deliverable, to comply with the minimum deliverable quality criteria listed in Section 2.6.3 Minimum Deliverable Quality. Drafts of each final deliverable, except status reports, are required at least two weeks in advance of when the final deliverables are due (with the exception of deliverables due at the beginning of the project where this lead time is not possible, or where draft delivery date is explicitly specified). Draft versions of a deliverable shall comply with the minimum deliverable quality criteria listed in Section 2.6.3 Minimum Deliverable Quality.

2.6.2 Deliverable Acceptance

A. A final deliverable shall satisfy the scope and requirements of this RFP for that deliverable, including the quality and acceptance criteria for a final deliverable as defined in Section 2.6.3 J. Deliverable Descriptions/Acceptance Criteria.

B. The Contract Monitor shall review a final deliverable to determine compliance with the acceptance criteria as defined for that deliverable. The Contract Monitor is responsible for coordinating comments and input from various team members and stakeholders. The Contract Monitor is responsible for providing clear guidance and direction to the Contractor in the event of divergent feedback from various team members.

C. The Contract Monitor will issue to the Contractor a notice of acceptance or rejection of the deliverable in the Deliverable Product Acceptance Form DPAF (Section 7.2, Exhibit 2). Following the return of the DPAF indicating “Accepted” and signed by the Contract Monitor, the Contractor shall submit a proper invoice in accordance with the procedures in Section 3.3, Invoicing. The invoice must be accompanied by a copy of the executed DPAF or payment may be withheld.

D. In the event of rejection, the Contract Monitor will formally communicate in writing any deliverable deficiencies or non-conformities to the Contractor, describing in those deficiencies what shall be corrected prior to acceptance of the deliverable in sufficient detail for the Contractor to address the deficiencies. The Contractor shall correct deficiencies and resubmit the corrected deliverable for acceptance within the time period required by the Contract Monitor or Procurement Officer for correction.

2.6.3 Minimum Deliverable Quality

The Contractor shall subject each deliverable to its internal quality-control process prior to submitting the deliverable to the State.

Each deliverable shall meet the following minimum acceptance criteria:

A. Be presented in a format appropriate for the subject matter and depth of discussion.

B. Be organized in a manner that presents a logical flow of the deliverable’s content.

C. Represent factual information reasonably expected to have been known at the time of submittal.

D. In each section of the deliverable, include only information relevant to that section of the deliverable.

E. Contain content and presentation consistent with industry best practices in terms of deliverable completeness, clarity, and quality.

F. Meets the acceptance criteria applicable to that deliverable, including any State policies, functional or non-functional requirements, or industry standards.

G. Contains no structural errors such as poor grammar, misspellings or incorrect punctuation.

H. Must contain the date, author, and page numbers. When applicable for a deliverable, a revision table must be included.

I. A draft written deliverable may contain limited structural errors such as incorrect punctuation, and shall represent a significant level of completeness toward the associated final written deliverable. The draft written deliverable shall otherwise comply with minimum deliverable quality criteria above.

J. Deliverable Descriptions/Acceptance Criteria In addition to the items identified in the table below, the Contractor may suggest other subtasks, artifacts, or deliverables to improve the quality and success of the assigned tasks.

Deliverables Summary Table*

Updates: Weekly

*The deliverables summary table may not list every contractually-required deliverable. Offerors and Contractors should read the RFP thoroughly for all Contract requirements and deliverables.

Product Requirements A. Open source software may be proposed; however, operational support for the proposed software must also be proposed. Operational support shall include maintenance and updating of code to address software dependencies, software updates and security vulnerabilities.

B. No international storage or processing for State Data: Bidders/Offerors are advised that any processing or storage of data outside of the continental U.S. is strictly prohibited.

C. Any terms of use or other agreement applicable to the Bidder’s/Offeror's proposed services must be contained in the Bidder’s/Offeror’s Technical Proposal. The State is not subject to any terms of use or other agreement applicable to the Bidder’s/Offeror’s proposed services unless the same are explicitly agreed to by the State during the Proposal evaluation process.

D. The State does not recognize and is not subject to any auto-renewal of services provision that may be contained or provided for in any Contractor agreements.

2.8 Service Level Agreement (SLA)

THIS SECTION IS INAPPLICABLE TO THE RFP.

2.9 Disaster Recovery and Data

2.9.1 Redundancy, Data Backup and Disaster Recovery

a) Unless specified otherwise, throughout the Contract term, the Contractor shall maintain or cause to be maintained disaster avoidance procedures designed to safeguard State data and other confidential information, Contractor’s processing capability and the availability of hosted services. Any force majeure provisions of the Contract do not limit the Contractor’s obligations under this provision.

b) The Contractor shall have robust contingency and disaster recovery (DR) plans in place to ensure that the services provided under the Contract will be maintained in the event of disruption to the Contractor/subcontractor’s operations (including, but not limited to, disruption to information technology systems), however caused.

1) The Contractor shall furnish a DR site.

2) The DR site shall be at least 100 miles from the primary operations site, and have the capacity to take over complete production volume in case the primary site becomes unresponsive.

c) The contingency and DR plans must be designed to ensure that services under the Contract are restored after a disruption within 24 hours from notification, with a recovery point objective of one hour or less prior to the outage in order to avoid unacceptable consequences due to the unavailability of services.

d) The Contractor shall test the contingency/DR plans at least twice annually to identify any changes that need to be made to the plan(s) to ensure a minimum interruption of service. Coordination shall be made with the State to ensure limited system downtime when testing is conducted. At least one annual test shall include backup media restoration and failover/fallback operations at the DR location. The Contractor shall send the Contract Monitor a notice of completion following completion of DR testing.

e) Such contingency and DR plans shall be available for the State to inspect and practically test at any reasonable time, and subject to regular updating, revising, and testing throughout the term of the Contract.

2.9.2 Data Export/Import

a) The Contractor shall, at no additional cost or charge to the State, in an industry standard/non-proprietary format:

1) perform a full or partial import/export of State data within 24 hours of a request; or

2) provide to the State the ability to import/export data at will and provide the State with any access and instructions which are needed for the State to import or export data.

b) Any import or export shall be in a secure format per the Security Requirements.

2.9.3 Data Ownership and Access

As set forth in the Contract, data, databases and derived data products created, collected, manipulated, or directly purchased as part of the solicitation are the property of the State. The purchasing State agency is considered the custodian of all State data. The use, access, and distribution of all data shall comply with the requirements of the Data Use Agreement (Section 6.6, Attachment Y).

The Contractor may not access State data other than as necessary to perform the services under this Contract.

The Contractor shall limit access to and use of State data to Contractor Personnel whose responsibilities require such access or use and shall train such Contractor Personnel on the confidentiality obligations set forth herein.

At no time shall any data or processes – that either belong to or are intended for the use of the State or its officers, agents or employees – be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the State.

The Contractor shall not use any information collected in connection with the services furnished under the Contract for any purpose other than fulfilling such services.

Provisions in Sections 2.9.1 - 2.9.3 shall survive expiration or termination of the Contract. Additionally, the Contractor shall flow down the provisions of Sections 2.9.1 - 2.9.3 (or the substance thereof) in all subcontracts.

2.10 Security Requirements

The following requirements are applicable to the Contract:

a) Display his or her company ID badge in a visible location at all times while on State premises. Upon request of authorized State personnel, each Contractor Personnel shall provide additional photo identification.

b) Cooperate with State site requirements, including but not limited to, being prepared to be escorted at all times, and providing information for State badge issuance.

c) Remove any Contractor Personnel from working on the Contract where the State determines, in its’ sole discretion, that Contractor Personnel has not adhered to the Security requirements specified herein.

d) The State reserves the right to request that the Contractor submit proof of employment authorization of non-United States Citizens, prior to commencement of work under the Contract.

2. Security Clearance / Criminal Background Check The State reserves the right to refuse any individual Contractor Personnel to work on State premises, based upon certain specified criminal convictions, as specified by the State.

A criminal background check is required for Contractor Personnel.

A security clearance is not required for Contractor Personnel.

A. A criminal background check for each Contractor Personnel providing services under this RFP shall be completed prior to each Contractor Personnel providing any services under the Contract.

B. The Contractor shall obtain at its own expense a Criminal Justice Information System (CJIS) State and federal criminal background check for all Contractor Personnel listed in sub-paragraph A. This check may be performed by a public or private entity.

C. The Contractor shall provide the Contract Monitor with certification of completion of the required criminal background check described in this RFP for each required Contractor Personnel prior to assignment, and that the Contractor Personnel have successfully passed this check.

D. Persons with a criminal record may not perform services under the Contract unless prior written approval is obtained from the Contract Monitor. The Contract Monitor reserves the right to reject any individual based upon the results of the background check. Decisions of the Contract Monitor as to acceptability of a candidate are final.

E. The CJIS criminal record check of each Contractor Personnel who will work on State premises shall be reviewed and documented by the Contractor for convictions of any of the following crimes described in the Annotated Code of Maryland, Criminal Law Article:

1) §§ 6-101 through 6-104, 6-201 through 6-205, 6-409 (various crimes against property);

2) any crime within Title 7, Subtitle 1 (various crimes involving theft);

3) §§ 7-301 through 7-303, 7-313 through 7-317 (various crimes involving telecommunications and electronics);

4) §§ 8-201 through 8-302, 8-501 through 8-523 (various crimes involving fraud);

5) §§9-101 through 9-417, 9-601 through 9-604, 9-701 through 9-706.1 (various crimes against public administration); or

6) a crime of violence as defined in CL § 14-101(a).

F. Contractor Personnel that would have access to systems supporting the State or to State data who have been convicted of a felony or convicted of a crime involving telecommunications and electronics or convicted within the past five (5) years of a misdemeanor from the above list of crimes shall not be permitted to work on the Contract.

3. On-Site Security Requirement(s)

THIS SECTION IS INAPPLICABLE TO THIS RFP.

2.11 Information Technology Security

A. Contractors shall comply with and adhere to the State IT Security Manual, Policies and Standards. These policies may be revised from time to time and the Contractor shall comply with all such revisions. Updated and revised versions of the State IT Policy and Standards are available online at: Policies, Standards, and Guidelines.

B. The Contractor shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State as directed and coordinated with the Contract Monitor.

The Contractor shall:

1) For IT Security Policies and Standards that are not covered by the State IT Security Manual, the Contract shall Implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security such as those listed below.

2) Ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of the Contract; and

3) Ensure compliance with all applicable federal, State, and local laws, rules and regulations concerning security of Information Systems and Information Technology.

2.11.1 Security Incident Response

A. The Contractor shall notify the State when any Contractor system that may access, process, or store State data or State systems experiences a Security Incident or a Data Breach as follows:

1) notify the State within twenty-four (24) hours of the discovery of a Security Incident by providing notice via written or electronic correspondence to the Contract Monitor, State Chief Information Security Officer and Maryland Security Operations Center (MD-SOC);

2) notify the State within seventy-two (72) hours if there is a threat to Contractor’s solution as it pertains to the use, disclosure, and security of State data; and

3) provide written notice to the State within one (1) Business Day after Contractor’s discovery of unauthorized use or disclosure of State data and thereafter all information the State requests concerning such unauthorized use or disclosure.

B. Contractor’s notice shall identify:

1) the nature of the unauthorized use or disclosure;

2) the State data used or disclosed,

3) who made the unauthorized use or received the unauthorized disclosure;

4) what the Contractor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure; and

5) what corrective action the Contractor has taken or shall take to prevent future similar unauthorized use or disclosure.

6) The Contractor shall provide such other information, including a written report, as reasonably requested by the State.

C. Discussing Security Incidents with the State should be handled on an urgent as-needed basis, as part of Contractor communication and mitigation processes as mutually agreed upon, defined by law or contained in the Contract. The Contractor shall obtain approval from the State prior to communicating with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise.

D. The Contractor shall comply with all applicable system security breach laws.

2.12 Data Breach Responsibilities

A. If the Contractor reasonably believes or has actual knowledge of a Data Breach, the Contractor shall, unless otherwise directed:

1) Notify the appropriate State-identified contact within 24 hours by telephone and email to the Maryland Security Operations Center (MD-SOC) in accordance with the agreed upon security plan or security procedures unless a shorter time is required by applicable law;

2) Cooperate with the State to investigate and resolve the data breach;

3) Promptly implement commercially reasonable remedial measures to remedy the Data Breach; and

4) Document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services.

B. With respect to State data within the possession or control of the Contractor, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by State law; (3) a credit monitoring service required by State or federal law; (4) a website or a toll-free number and call center for affected individuals required by State law; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause; all [(1) through (5)] subject to the Contract’s limitation of liability.

C. The public disclosure of a cybersecurity incident shall be pursuant to Guidelines for the Public Disclosure of Cybersecurity Incidents or any successor thereto.

2.12.11 The State shall, at its discretion, have the right to review and assess the Contractor’s compliance to the security requirements and standards defined in the Contract.

2.12.12 Provisions in Sections 2.1 – 2.12.11 shall survive expiration or termination of the Contract.

2.13 SOC 2 Type 2 Audit Report

A SOC 2 Type 2 Audit Report is not a Contractor requirement for this Contract.

2.14 Location of the Performance of Services Disclosure

This solicitation does require a Location of the Performance of Services Disclosure. The address of each location where work will be completed must be disclosed.

2.15 Purchasing and Recycling Electronic Products

This section does not apply to this solicitation.

Standard Terms and Conditions Contract Initiation Requirements Once all approvals have been obtained and the Contract is fully executed, the Procurement Officer may schedule a kickoff meeting to be held prior to commencement of Contract performance.

End of Contract Transition The Contractor shall cooperate in the orderly transition of services from it to a subsequent contractor at the end of the contract term or upon receipt of a Notice of Termination from the State. Transition shall be provided in a prompt and timely manner and shall proceed in accordance with the schedule provided to the Contractor by the State in the Notice of Transition. Additional instructions regarding transition services may be provided in the event of a Notice of Termination issued by the State.

Invoicing Submission of an invoice constitutes the Contractor’s verification that the information in the invoice is accurate as of the time of submission.

An invoice not satisfying the requirements of a Proper Invoice (as defined in COMAR 21.06.09) will not be processed for payment. To be considered a Proper Invoice, invoices must include the following information, without error:

A. Contractor name and address;

B. Remittance address;

C. Federal taxpayer identification (FEIN) number, social security number, as appropriate;

D. Invoice period…