Solicitation Doc.pdf

RFPSHELL. 8/29/2025

State of Florida Department of Transportation

REQUEST FOR PROPOSAL

Statewide Weigh Station Scale Maintenance Services

DOT-RFP-26-9081-DG

RESPONSES DUE:

Thursday, June 11, 2026 / 10:00 AM EST

CONTACT FOR QUESTIONS:

Destyne Grayson, Procurement Agent

CO.Purch@dot.state.fl.us 605 Suwannee St. MS20

Tallahassee, Fl. 32399-0450

State of Florida

Department of Transportation Central Procurement Office

605 Suwannee St. Mail Station 20 Tallahassee, Florida 32399-0450

REQUEST FOR PROPOSAL REGISTRATION

PLEASE COMPLETE AND RETURN THIS FORM ASAP

E-MAIL TO Destyne Grayson CO.Purch@dot.state.fl.us

RFP Number: DOT-RFP-26-9081-DG

Title: Statewide Weigh Station Scale Maintenance Services

Proposal Due Date & Time (On or Before): Thursday, June 11, 2026 / 10:00 AM EST.

Potential proposers should notify our office by returning this Registration Form as soon as possible after downloading. Complete the information below and e-mail to Destyne Grayson CO.Purch@dot.state.fl.us

THE REQUEST FOR PROPOSAL DOCUMENT YOU RECEIVED IS SUBJECT TO

CHANGE. Notice of changes (Addenda), will be posted on the Florida Vendor Information Portal at https://vendor.myfloridamarketplace.com/, under this bid number, click on “Search Advertisements”, click on the drop-down arrow beside the box under Advertisement Type, select Request for Proposal, click on the drop-down arrow beside the box for Organization, select FLORIDA DEPARTMENT OF TRANSPORTATION, then go to the bottom of the same page and click on Advertisement Search. It is the responsibility of all potential bidders to monitor this site for any changing information prior to submitting your bid.

Company Name:

Address:

City, State, Zip:

Telephone: ( )

Contact Person:

E-Mail Address: __________________________________________________

For further information on this process, e-mail or telephone: Destyne Grayson CO.Purch@dot.state.fl.us

Phone: (850) 414.4253 https://vendor.myfloridamarketplace.com/

EXHIBIT “C” – PRICE PROPOSAL FORM

RFP # : DOT-RFP-26-9081-DG

RFP TITLE : Statewid e Weig h Statio n Sca le Maintenan ce Services

No services shall be performed, nor costs incurred, outside the approved pricing structure without written authorization from the Department.

Exhibit C - Price Schedule FLORIDA DEPARTMENT OF TRANSPORTATION – MOTOR CARRIER SIXE AND WEIGHTS SCALE SITES

All compensation, unit pricing, labor rates, and reimbursable costs shall be governed exclusively by Exhibit C and Appendix III, as applicable. No pricing stated elsewhere in this Contract shall be binding.

(Page 1 of 3)

Location PMs/Yr

Bay SR-77 Becker Road Bunnell US-1

Cantonment US-29 Flagler I-95

Gadsden US-27 SB VWS Grand Ridge EB VWS

Hilliard US-1 Hopewell SR-60

I-10 Pensacola EB VWS I-75 White Springs SB VWS

I-95 Yulee SB VWS Indiantown Rd. VWS

Jackson US-231 SB Lake City US-441

MacClenny SR-121 Madison I-10

Madison US-90 VWS Marion SR-40 Martin NB I-95 Martin SB I-95

Old Town US-19 Palatka US-17

Palm Coast Exit 289 Palm Coast US-1 NB Palm Coast US-1 SB

Palm Coast US-1 Unmanned Hut Pensacola I-10

Pensacola US-90 Plantation Key US-1

Punta Gorda I-75 Punta Gorda Jones Loop

Punta Gorda Tuckers Grade Santa Rosa I-10

Unit price per Cleaning and PM

Total

EXHIBIT “C” PRICE SCHEDUL FORM

RFP # : DOT-RFP-26-9081-DG

RFP TITLE: Statewide Weigh Station Scale Maintenan ce Services

All compensation, unit pricing, labor rates, and reimbursable costs shall be governed exclusively by Exhibit C and Appendix II I, as applicable . N o p ricing stated els ewhere in this C ontract sha ll be b inding.

No services shall be performed, nor costs incurred, outside the approved pricing structure without written authorization from the Department.

FLORIDA DEPARTMENT OF TRANSPORTATION – MOTOR CARRIER SIXE AND WEIGHTS SCALE SITES

Location PMs/Yr Unit price per Cleaning and PM Total

Seffner I-4 2 $ $ Seffner US-92 EB/WB VWS 1 $ $

Sneads I-10 2 $ $ Sneads I-10 WB VWS 1 $ $

SR-77 Panama City VWS 1 $ $ US-27 Hendry Alt. NB/SB VWS 1 $ $

US-27 Hendry NB/SB VWS 1 $ $ White Springs I-75 2 $ $

Wildwood I-75 2 $ $ Wildwood CR-475 1 $ $ Wildwood CR-484 1 $ $

Yulee I-95 2 $ $ Yulee US-17 1 $ $

Starke US301 1 $ $

GRAND TOTAL FOR ALL LOCATIONS $

OPTIONAL SERVICES, REPAIRS, AND OTHER WORK (Will not be part of the Price Evaluation) (Will be authorized at the Department’s discretion)

Hourly Heavy Duty Test Truck Charge $ Hourly Bucket Truck Charge $

Hourly Repairs (All Sites 8am-5pm Est. M-F) $ First Hour Charge (All Sites): $

Project Manager Services Hourly Rates $ After Hours Service Hourly Rate (anything before 8am or after 5pm Est. M-F) $

Loop Installation $ Kistler Sensor Installation (to include grout) $

Remote Repair $ Hourly Mainline (Interstate) Lane Closure $

Hourly Lane Closure $ Nightly Lane Closure $

– E

(Page 2 of 3)

EXHIBIT “C” – PRICE PROPOSA L FORM

(P a ge 3 of 3)

RFP #: DOT-RFP-26-9081-DG

RFP TITLE : Statewide Weig h Statio n Sca le Maintenanc e Services

RENEWAL : see Special Condition 31).

THE UNIT RATE( s) WIL LAPPLYT O T HEINIT IALTE RMAND ANY REN EWAL PERIODS.

MFMP Transaction Fee:

All payment(s) to the vendor resulting from this competitive solicitation WILL be subject to the MFMP Transaction Fee in accordance with the referenced Form PUR 1000 General Contract Condition #7d. The Transaction Fees imposed shall be based upon the date of issuance of the payment.

NOTE: In submitting a response, the bidder acknowledges they have read and agree to the solicitation terms and conditions and their submission is made in conformance with those terms and conditions.

ACKNOWLEDGEMENT: I certify that I have read and agree to abide by all terms and conditions of this solicitation and that I am authorized to s ign for the bidder. I certify that the response submitted is made in conformance with all requirements of the solicitation.

Proposer:

Address:

Phone:

Authorized Signature:

Printed/Typed:

FEID #

City, State, Zip:

E-mail:

Date:

Title:

STATE OF FLORIDA DEPARTMENT OF TRANSPORTATION

E-VERIFY

375-031-06

PROCUREMENT

OGC – 10/21

Contract No: DOT-RFP-26-9081-DG

Financial Project No(s):

Project Description: Statewide Weigh Station Scale Maintenance Services

In accordance with the contract, the Vendor/Consultant/Contractor hereby acknowledges and certifies compliance with Section 448.095, Florida Statutes. The Vendor/Consultant/Contractor shall register with and use the E-Verify system to verify the work authorization status of all newly hired employees. The Vendor/Consultant/Contractor shall utilize the U.S. Department of Homeland Security’s E-Verify system, in accordance with the terms governing use of the system. The Vendor/Consultant/Contractor shall comply with Section 448.095, Florida Statutes, for the duration of the contract term, including any extensions or renewal periods.

Company/Firm:

Authorized Signature:

Title:

ITBTERMSHELL.COMM – 8/29/2025

Respondent Vendor Name:

Vendor FEIN:

Vendor’s Authorized Representative Name and Title:

Address:

City: ____________________________ State: ___________________ Zip:

Phone Number:

Email Address:

Section 287.135, Florida Statutes, prohibits a company or other entity from bidding on, submitting a proposal for, or entering into or renewing a contract for goods or services of: i) $100,000 or more if, at the time of bidding on, submitting a proposal for, or entering into or renewing such contract , the company or other entity is on the Scrutinized Companies or Other Entities that Boycott Israel List, created pursuant to Section 215.4725, Florida Statutes, or is engaged in a boycott of Israel; and, ii) $1,000,000 or more if, at the time of bidding on, submitting a proposal for, or entering into or renewing such contract, the company or other entity is on either the Scrutinized Companies with Activities in Sudan List or the Scrutinized Companies with Activities in the Iran Terrorism Sectors List, created pursuant to Section 215.473, Florida Statutes, or is engaged in business operations in Cuba or Syria.

As the authorized representative of the company or other entity identified above in the section entitled “Respondent Vendor Name”, I hereby certify that the company or other entity is not listed on either the Scrutinized Companies with Activities in Sudan List or the Scrutinized Companies with Activities in the Iran Terrorism Sectors List, or the Scrutinized Companies or Other Entities that Boycott Israel List. I further certify that the company or other entity is not engaged in a boycott of Israel and is not engaged in business operations in Cuba or Syria. I understand that pursuant to Section 287.135, Florida Statutes, the submission of a false certification may subject the company to civil penalties, attorney’s fees, costs, and/or ineligibility to bid on future contracts.

Certified By:

who is authorized to sign on behalf of the above referenced company.

Authorized Signature Print Name and Title:

PERFORMANCE BOND

375-040-27

PROCUREMENT

OGC – 10/04

KNOW ALL MEN BY THESE PRESENTS: That we, (name)

(hereinafter called Vendor) of (address) and

(hereinafter called Surety) of (name)

(address) duly authorized to do business in the State of Florida, are held and firmly bound unto the State of Florida in the full and just sum of Dollars ($ ), lawful money of the United States of America, to be paid to the Florida Department of Transportation (hereinafter called the Department), to which payment will and truly to be made we bind ourselves, our heirs, executors, administrators, successors and assigns, jointly and severally and firmly by these presents;

WHEREAS, the above Vendor has subscribed to an agreement with the Department to bear the date of

, for contractual services agreement in connection with in County(ies), particularly known as

(hereinafter called the Agreement), upon certain terms and conditions in said Agreement more particularly mentioned; and

NOW, THEREFORE, The condition of this obligation is such that if the above Vendor in all respects will comply with the terms and conditions of said Agreement, and its obligations thereunder, including the Scope of Services, Specifications, General Conditions, Special Conditions, Bid Blank therein referred to and made a part thereof, and such alterations as may be made in said conditions and specifications, as therein provided for; and, further, if such Vendor will promptly make payment to all persons supplying labor, material, equipment and supplies, used directly or indirectly by the said Vendor or any subcontractor(s) in the prosecution of the work provided for in said Agreement, and promptly will pay all State Workers' Compensation and Unemployment Compensation taxes incurred in the performance of the said

Agreement and will pay to the Department any amount in money or property, the Department may lose or be overcharged or otherwise defrauded of, by reason of any wrongful or criminal act of the Vendor, its agents, or employees, then this obligation is to be void; otherwise, to be and remain in full force and virtue in law.

WITNESS the signature of the Vendor and the signature of the Surety by its

(Agent or Attorney-in-Fact, or otherwise) with seals of said Vendor and Surety hereunto affixed this day of , .

Surety Vendor

BY: BY:

Signature Authorized Signature(s)

TITLE: TITLE:

Attorney-in-Fact/Agent (Surety Seal)

ATTEST:

Secretary/Notary

Name/Telephone #: BY:

Address: Signature

Note: Attach Power of Attorney showing authority of Surety’s Agent or Attorney-in-Fact. This bond is not for public works contracts required by Section 25.05, Florida Statutes.

Appendix II

INFORMATION TECHNOLOGY RESOURCES

325-060-13

TRANSPORTATION TECHNOLOGY

09/25

Agreement (Purchase Order) #:

CHAPTER 60GG-1, F.A.C. – INFORMATION TECHNOLOGY PROJECT MANAGEMENT AND

OVERSIGHT STANDARDS

Governed by the Department of Management Services’ Florida Digital Service (FL[DS]), Chapter 60GG-1, Florida Administrative Code (F.A.C.), Florida Information Technology Project Management and Oversight Standards, establishes project management principles that State Agencies are required to follow when implementing information technology projects. the Department must adhere to the State project management standards and ensure that all project documentation created by the Vendor, the Department, or in collaboration, is developed and maintained in accordance with Chapter 60GG-1 F.A.C. The Vendor must be familiar with the State project management standards and be prepared to satisfy all requirements. It is important for the Vendor to recognize that documentation, monitoring, or reporting requirements may change mid-project, based on the project’s FL[DS] Risk and Complexity Assessment, outlined in 60GG-

1.002. The Vendor must be adaptable to changes required by Chapter 60GG-1 F.A.C., without increasing cost to the Department.

The Department requires that the Vendor create and submit a Project Plan that demonstrates how the creation and maintenance of the application will be carried out. The Project Plan template may be found at https://www.fdot.gov/it/docs/dispFiles.shtm, and is the template which the Department requires the Vendor to follow. The Project Plan must be submitted to the Department within thirty (30) business days after execution of Agreement or as indicated in the Scope of Work. Upon receipt of the Project Plan, the Department will have fourteen (14) business days to review and approve the Project Plan in its sole discretion. No other work may begin prior to the submission and approval of the Project Plan. After the Project Plan is approved, the Vendor shall keep the Project Plan updated as necessary or upon notification by the Department of a deficiency in the Project Plan. Any change to the Project Plan must be approved by the Department.

CHAPTER 60GG-2, F.A.C. – FLORIDA CYBERSECURITY STANDARDS

Governed by the Department of Management Services’ Florida Digital Service, Chapter 60GG-2 F.A.C., Information Technology Security, also known as the Florida Cybersecurity Standards (FCS), establishes cybersecurity standards for information technology (IT) resources.

State Agencies are required to follow these standards in the management and operations of state IT resources. The Department must adhere to the Florida Cybersecurity Standards for all IT projects created by the Vendor, Department, or in collaboration. The Vendor must be familiar with the State cybersecurity standards and be prepared to work with the Department to satisfy all requirements.

CHAPTER 60GG-2.002, F.A.C. SYSTEM SECURITY PLANS

In support of the Florida Cybersecurity Standards, 60GG-2 F.A.C. Section 60GG-2.002, F.A.C., the Department requires that all IT systems have a system security plan (SSP). The SSP must address the security setup of the system, ensuring that security controls required by Section 60GG-2.003(5)(g)(4), F.A.C., are in place. The SSP must be submitted by the Vendor and approved by the Department Information Security Manager (ISM) prior to system implementation. The SSP must be completed using the SSP template made available from the Department ISM. The SSP must be submitted during the System Design/Configuration phase to allow time for changes in the security design that may be required. Upon receipt of the SSP, the Department will have ten (10) business days to review. The ISM will respond with feedback, approval, or denial of the plan. The Vendor must allow time for adjustments to the plan and resubmittal to the ISM. After the SSP is approved, the Vendor shall keep the SSP updated as necessary or upon notification by the Department of a deficiency in the SSP. Any change to the SSP must be reviewed by the Department and approved by the ISM.

CHAPTER 60GG-2.002, F.A.C. BACKGROUND CHECKS FOR VENDOR STAFF

Florida Department of Transportation (Department) requires Vendor employees working on systems identified by the Department with a risk factor of moderate or higher to undergo an FBI Level II background check. The Vendor shall pay the cost of their employee background checks. The Vendor shall utilize the Department’s Originating Agency Identifier (ORI). Contract employees must successfully pass the Level II background check before beginning work on the project.

CHAPTER 60GG-2.002, F.A.C. RISK ASSESSMENTS

The Vendor that operates as a service provider agrees to perform a third-party risk assessment on vendor owned resources that contain Department information. The assessment will follow the schedule below, and create a risk mitigation plan that assigns risk levels and proposed controls. A Plan of Action and Milestones will be shared and communicated with the Department as risk is mitigated. An annual Attestation or Certification from a third-party assessment, or report or proof of certification such as but not limited to a System and Organization Controls (SOC) 2, International Organization for Standardization (ISO) 27001, etc. will be accepted in place of a third-party risk assessment.

Assessment categorization established as per Federal Information Processing Standards (FIPS) 199 Publication standards:

1. High – will be completed every 12 months

2. Moderate – will be completed every 18 months

3. Low – will be completed every 24 months

CHAPTER 60GG-2.005, F.A.C. SECURITY INCIDENT RESPONSE

The Vendor agrees to provide a security incident response plan, which will be added as an addendum to the Department’s overall security incident response plan. The Vendor’s plan shall outline specific actions, response time frames, and roles and https://www.flrules.org/gateway/ChapterHome.asp?Chapter=60GG-1 https://www.fdot.gov/it/docs/dispFiles.shtm https://www.flrules.org/gateway/ChapterHome.asp?Chapter=60GG-2 responsibilities. The Vendor agrees to align its services with the Department by monitoring and responding to security incidents of Department data and information according to section 282.318, F.S.

In the event of a security incident or breach that involves Department data or IT assets, the Vendor shall within 24 hours of discovery notify the Department’s Information Security Manager (ISM) at ISM@dot.state.fl.us. In addition, the Vendor shall:

1. Take prompt corrective action to cure the incident, and any action pertinent to unauthorized disclosure required by applicable federal and state laws/regulations.

2. To the extent known, the Vendor shall provide daily status updates by 5pm EST to the ISM.

3. Vendor updates will continue until notified by the Department’s ISM and will include:

a. The nature of the unauthorized use or disclosure

b. Any confidential information used or disclosed

c. Who made the unauthorized use or received the unauthorized disclosure

d. What the Vendor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure

e. What corrective action the Vendor has taken or shall take to prevent future similar unauthorized use or disclosure

4. When notification of affected persons is required under section 501.171, F.S., the Vendor shall provide such notification, but only after the Department’s written approval of the contents of the notice.

CHAPTER 60GG-4, F.A.C. – Cloud Computing The State maintains a cloud-first policy for technology initiatives. The Vendor shall prioritize cloud-computing solutions that minimize or eliminate the use of state data center infrastructure, provided such solutions meet project requirements, reduce costs, and comply with applicable state and federal cybersecurity laws, regulations, and standards. State Statute can be viewed here: Statutes & Constitution :View Statutes : Online Sunshine

For all Agreements utilizing cloud computing, the Vendor shall provide demonstrated protections to ensure that systems provisioned in the cloud are appropriately secure and performant, appropriate to the workload and data hosted, and ultimately ensure the availability, integrity and confidentiality of Department’s data and resources. These protections shall be documented in the Agreement.

Location and Portability of Data:

All data will be geographically located within the continental United States. Remote access to data, other than open data, from outside the United States is prohibited, unless approved in writing by the agency head or designee. The Department maintains data ownership and the Vendor shall ensure portability to allow for the transfer of data from one cloud service to another. The portability method will be dependent upon data transfer requirements documented in the Agreement. The portability method shall be through an approved extract, transform, and load (ETL) process or, via an industry common electronic format using standard Application Programming Interface (API). The Vendor shall implement appropriate security measures to protect data confidentiality, integrity, and availability during all portability operations, in accordance with applicable data protection laws, rules, and standards. The Vendor shall clearly document its data egress charge model as part of any response to a solicitation for services.

Disentanglement Services:

If this Agreement is terminated for convenience or default or upon the Agreement completion date or expiration of the Agreement term or any extensions thereof, the Vendor shall cooperate with the Department to facilitate an effective and efficient transition to the Department’s selected successor for the Services. In the event of such Agreement termination, completion, or expiration, Vendor shall:

a. Provide Disentanglement Services for up to one (1) year from the date of termination, completion, or expiration. Unless otherwise agreed to by the Department in writing, the Vendor’s Payment Schedule, and Price Proposal, including labor rates identified in the Price Proposal, shall apply to all transition Work.

b. Make all operational records, documents, data, Systems, and facilities required to maintain day-to-day Operations of the Services being rendered under this Agreement available before the date of such termination, suspension, or expiration.

c. Make all other records, documents, data, and Software which is licensed to the Department and pertaining to the Services rendered for this Agreement available within thirty (30) Calendar Days upon written notice or as otherwise provided in the executed License Agreement.

d. Provide all staff necessary to facilitate transition and succession.

e. Make all necessary provisions for transferring any leases or sub-leases held by the Vendor to the Department, including without limitation, all keys, security codes and other facility access information or devices.

f. Make all necessary provisions for securing, providing, and/or granting Software licenses, to continue Operations.

Following successful data transition to a successor vendor, the outgoing Vendor must obtain written directions from FDOT specifying required disposition of the original dataset, whether through secure destruction, transfer to Department custody, continued storage, or other approved method. The Vendor shall execute FDOT's disposition requirements within 30 days, provide written certification of compliance, and ensure complete removal of data from all systems unless expressly authorized by FDOT to maintain copies.

Service Level Agreement (SLA) Requirements:

The Vendor’s cloud computing availability, performance metrics, and response times shall be measured and reported against Service Metrics developed by the Department. “Service Level Agreement” is the collective set of minimum standards for technology performance as set forth in the Agreement. The Department will identify applicable Service Level requirements, with associated penalties/consequences and include them in the Agreement. The Vendor shall:

mailto:ISM@dot.state.fl.us http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0200-0299/0282/Sections/0282.206.html http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0200-0299/0282/Sections/0282.206.html

a. Implement and utilize its current measurement and monitoring methods, tools, and procedures to track and report Vendor’s cloud computing availability, performance, and response in delivering the Hosting and Environment Services relative to the applicable Service Levels and shall produce a monthly written report to the Department.

b. If the Vendor’s cloud computing availability, performance, and/or response falls below the identified SLAs, the Department will be entitled to specified service penalties/financial consequences, as set forth in the Agreement.

CHAPTER 60GG-5, F.A.C. – Enterprise Architecture To document compliance with the State of Florida Enterprise Architecture: Transforming the Way Florida Purchases and Manages State Technology Resources (EA Document), all new Departmental technology procurements exceeding $195,000 must include the Form FL[DS]-01, Technology Initiative Management Form (FL[DS]-01) and comply with associated requirements.

A copy of all deliverables shall be submitted to the Department for business purposes. The submittal process, to include deliverable name and intended recipient(s), shall be established with vendor onboarding.

Prior to the Scheduled Implementation Date for the IT Resource:

The following FL[DS]-01 Domains and associated deliverables must be completed and submitted to FL[DS] prior to implementing the IT resource, in accordance with paragraphs (6) and (7) of Rule 60GG-5.002, F.A.C:

1. Security Domain Deliverables, which include creating and maintaining:

a. A Security Testing deliverable, to include the performance of testing and results demonstrating that the IT resource is secure. Testing includes, but is not limited to:

i. Vulnerability Scanning;

ii. Security Scanning;

iii. Penetration Testing; and

iv. Risk Assessment.

2. Data Domain Deliverables, which include:

a. Complete submittal of applicable datasets to FL[DS], along with associated metadata and business terms; and

b. Data Management Plan that describes the lifecycle of the applicable Data that is collected and managed from collection through archival.

3. Infrastructure Domain Deliverables, which require the following:

a. A visual diagram of the IT resource’s physical and software assets, including where the current and proposed IT resource are located and how the assets are connected;

b. Documentation of applicable development, test, and production environment;

c. Documentation of the IP addresses, URLs, domain names, certificates, and domain provider(s) used to publicly identify an online interface; and

d. Disaster recovery plan that is operational, functional, and regularly validated and identifies a strategy for processing critical applications during a major hardware or software failure, outage, or the destruction of infrastructure.

4. Testing Domain Deliverables, completing the following:

a. Testing Environment is included in the Infrastructure Diagram, and is a replica of the Production Environment;

b. User guide that provides instruction on the use of the IT resource;

c. Training plan to ensure all user groups receive the necessary training to use the application/system;

d. User Acceptance Test results to demonstrate that the application/system solves the Use Case(s) and fulfills business requirements;

e. Service Level Agreement is established detailing the following:

i. The vendor’s requirement to meet an uptime percentage of 99.999%; and

ii. The applicable financial consequences to be imposed for failure to meet the established uptime.

f. For applications/systems that support more than 10,000 users, there must be documentation of Load Test results. The

Load Test results must show the maximum number of connections and transactions supported by the application/system without degradation; and

g. Code Review documentation to identify potential Security defects.

ARTIFICIAL INTELLIGENCE (AI)

The Vendor shall ensure all works comply with the Department’s AL Policy (010-325-065)

SOFTWARE BILL OF MATERIALS (SBOM)

A Software Bill of Materials or “SBOM” is a formal record containing the details and supply chain relationships of various components used in building software. Many commercial off-the-shelf (COTS) software products are created by assembling existing open source and commercial software components. The purpose of the SBOM is to identify these components within a product. An SBOM is useful to those who develop or manufacture software, those who select or purchase software, and those who operate software. An SBOM allows the software developer to ensure the components are up to date and able to respond quickly to new vulnerabilities. Vendors providing software as part of this Agreement shall incorporate a widely used, machine-readable SBOM format, which will allow for greater benefits through automation and tool integration. The Department will use the SBOM to perform vulnerability or license analysis, both of which will be used to evaluate risk in a product. The use of an SBOM provides the Department with a valuable tool to understand the supply chain of software, analyze known vulnerabilities, and manage risk.

COMPUTER HARDWARE/SOFTWARE LIABILITY

In any Agreement for the purchase or maintenance of machines or computer hardware/software or licensed programs, the Vendor's entire liability and the Department's exclusive remedy for damages to the Department related to the machine or computer hardware/software or licensed program which is the subject of this Agreement, or maintenance thereof shall be limited to, at the Department's discretion, 1) the correction by the Vendor of the relevant defect(s); or 2) actual damages up to the greater of an amount equal to 12 months maintenance charges for said product or the purchase price of said product. Such maintenance charges will be those in effect for the specific product when the cause of action arose. The foregoing limitation of liability will not apply to (a) the payment of cost and damage awards resulting from liability in accordance with the Copyright or Patent Infringement paragraph below, or to (b) claims for reprocurement costs or the cost of cover pursuant to Rule 60A-1.006, Florida Administrative Code, or to (c) claims by the Department for personal injury or damage to real property or tangible personal property caused by the Vendor's negligence or tortious conduct.

CONFIDENTIAL INFORMATION

Trade secrets are not solicited or desired as submissions with responses. Respondents are advised to submit a redacted version of the quote if the Vendor deems any portion of the documents, data or records submitted in response to this solicitation to be confidential, trade secret or otherwise not subject to disclosure pursuant to Florida Statutes (F.S.), the Florida Constitution or other authority. Any confidential or trade secret submission must be conspicuously marked as such, and any redacted copy must be clearly titled “Proprietary and Confidential.” Failure to provide a redacted version when confidentiality is claimed by the Vendor may be cause for determination of non-conformance.

CONFLICT OF INTEREST

To prevent any bias, unfair competitive advantage, conflict of interest, or the appearance of any type of impropriety, Vendor personnel must not have been directly or indirectly involved in the development of the Scope of Services or related solicitation documentation by the Department. If Vendor personnel worked in conjunction with the Department on the development of the solicitation document, the Vendor is prohibited from submitting a bid for this solicitation. Vendor personnel assigned to other Department projects outside this Contract, shall hold and maintain any confidential information that could benefit the Vendor on future solicitations in strictest confidence. As a condition of the Agreement, the Department may require contracted personnel to sign a nondisclosure agreement. Violation of the non-disclosure agreement by contracted personnel may result in termination of the individual, and at the Department’s discretion, disqualification of the Vendor from future solicitations.

COPYRIGHT OR PATENT INFRINGEMENT

To the extent permitted by Florida Law, the Vendor, without exception, shall save, defend and hold harmless the Department and its employees from liability of any nature or kind, including cost and expenses, for or on account of any copyrighted, patented or unpatented invention, process, or article manufactured or supplied by the Vendor. The Vendor has no liability when such claim is solely and exclusively due to the combination, operation or use of articles supplied hereunder with equipment or data not supplied by Vendor or is based solely and exclusively upon the Department's alteration of the article. The Department will provide prompt written notification of a claim of copyright or patent infringement. Further, if such claim is made or is pending, the Vendor may, at its option and expense, procure for the Department the right to continued use of, or replace or modify the article to render it non-infringing. If the Vendor uses any design, device, or materials covered by letters, patent or copyright, it is mutually agreed and understood that, without exception, the Agreement price shall include all royalties or other costs arising from the use of such design, device, or materials in any way involved in the work. Copyrighted material will be accepted, as part of a technical Quote, only if accompanied by a waiver that will allow the

Department to make paper and electronic copies necessary for use by the Department staff and agents. It is noted that copyrighted material is not exempt from the Public Records Law, Chapter 119, F.S. Therefore, such material will be subject to viewing by the public.

DATA SECURITY AND CONFIDENTIALITY

The Vendor and its employees must comply with all Department security procedures while working on this Agreement. The Vendor shall provide immediate notice to the Department’s Chief Information Officer, Chief Data Officer, and the Information Security Manager in the event it becomes aware of any security breach, any unauthorized transmission of State Data as described below or of any allegation or suspected violation of the Department security procedures. Except as required by law or legal process and after notice to the Department, the Vendor shall not divulge to third parties any confidential information obtained by the Vendor or its agents, distributors, resellers, subcontractors, officers or employees in the course of performing Agreement work, including, but not limited to, Chapter 60GG- 2, F.A.C., security procedures, business operations information, or commercial proprietary information in the possession of the state and/or the Department.

a. Loss of Data In the event of loss of any Department or State data or record where such loss is due to the negligence of the Vendor or any of its subcontractors or agents, the Vendor shall be responsible for recreating such lost data in the manner and on the schedule set by the Department at the Vendor’s sole expense.

b. Data Protection No state data or information will be transmitted to, stored in, processed in, or shipped to offshore locations or out of the United States of America, regardless of method, except as required by law. Examples of these methods include (but are not limited to):

FTP transfer, DVD, tape, or drive shipping; regardless of level of encryption employed. Access to State Data shall only be available to approved and authorized staff, including remote/offshore personnel, that have a legitimate business need. The Vendor agrees to establish appropriate administrative, technical, and physical safeguards to prevent unauthorized use of or access to the data and comply with any other special requirements relating to safeguarding of the data; and vendor agrees to retain control over the data and not disclose, release, sell, rent, lease, loan, or otherwise grant access to the data to any third party, except authorized persons, without the Department's prior written consent.

DELIVERABLE WARRANTY

Vendor warrants that all Deliverables provided by Vendor shall comply with the form, content, performance, and functionality specified in the Scope or each applicable TWO. If at any time within the Warranty Period, the Department discovers that a Deliverable does not comply with this Warranty, the Vendor shall, at no cost to the Department and in a timely manner, make such Deliverable conform and comply with this Warranty.

Each Deliverable and any other work product provided by Vendor in performing the Services, does not and will not infringe and is not and will not misappropriate or infringe the intellectual property rights, privacy rights or other rights of any other person or entity, nor has any claim of such infringement been threatened or asserted, nor is such a claim pending against Vendor (or to the best of Vendor’s knowledge, any entity from which Vendor has obtained such Deliverable, Work Product, or rights related thereto.

ELECTRONIC ACCESSIBILITY

The Federal Electronic and Information Technology standard can be found at: https://www.section508.gov/ and the Florida Administrative Code accessibility requirements can be found at: https://flrules.org/gateway/ChapterHome.asp?Chapter=60-8. The Department standards set for section 508 compliance information for the supplies and services in this Agreement are available on the Department’s Standards and Guidance Set website.

ESCROW OF SOURCE CODE

The Vendor shall maintain in escrow a copy of the source code for the licensed software. With each new release of the software provided to the Department, the Vendor shall maintain the updated source code in escrow. In the event the Vendor files for bankruptcy or ceases operations for any reason, the Department shall promptly be provided the current source code in escrow. The Department will only use the source code to support the licensed software subject to the same nondisclosure provisions of this Agreement.

FACILITIES AND EQUIPMENT

Upon completion of Security Awareness Training by the Vendor’s personnel assigned to this project, the Department shall provide necessary access to the Department network. The work will be conducted on-site in the Tallahassee Project Office. The Project will provide work space to use while on site. All property furnished by the Department for use by the Vendor during this Agreement will remain the property of the State of Florida.

GUIDELINES AND STANDARDS

The Vendor agrees to comply with the Department’s best practices and standards, including, but not limited to, the most current version available on the Department Standards and Guidelines Set website. https://www.fdot.gov/it/appdevstandards

1. The Department requires that all technology systems that include custom development, hosting on, or integration with Department resources complete a Technical Architecture Document (TAD). The TAD must be submitted and approved prior to development. The TAD must be completed using the TAD template made available from the Department’s Application Services (AS). The TAD must be submitted during the System Design/Configuration phase to allow time for changes in the design that may be required. Upon receipt of the TAD, the Department will have ten (10) business days to review. The AS will respond with feedback, approval, or denial of the plan. The Vendor must allow time for adjustments to the plan and resubmittal to AS. After the TAD is approved, the vendor shall keep the TAD updated as necessary during the development phase. The Vendor shall submit the final version for review during Standards Compliance reviews.

2. The Department requires that all IT systems pass development standards compliance reviews. The compliance reviews must be submitted by the Vendor and marked as passed by the Department’s Office of Information Technology prior to system implementation. The compliance reviews must be completed via the Department’s compliance review process in ServiceNow.

The reviews must be submitted after all development and testing have been completed. Upon receipt of the request, the Department will have ten (10) business days to review. The Department will respond with passing and failing remarks for each standard. The Vendor must allow time for adjustments to bring any failures into compliance and resubmittal to the Department for verification. After the reviews have passed, the Vendor shall not make any changes before going to production. Any code, data, or UI changes will require a new review process.

3. The Vendor must ensure that they are following the Department’s data and geospatial standards, including any available data models that were previously established. Use of FDOT’s standardization practices will ensure alignment with the agency’s existing technologies and future goals. The standards that are ultimately followed must also be documented and shared as part of the project deliverables.

https://www.section508.gov/ https://flrules.org/gateway/ChapterHome.asp?Chapter=60-8 http://www.fdot.gov/it/AppDevDocsAndGuidelines.shtm https://www.fdot.gov/it/appdevstandards

OWNERSHIP OF WORKS AND INVENTIONS

The Vendor agrees that the Department will have full ownership of any works of authorship, inventions, improvements, ideas, data, processes, computer software programs, and discoveries (hereafter called intellectual property) conceived, created, or furnished under this Agreement, with no rights of ownership in Vendor or any subcontractors. Vendor and subcontractors shall fully and promptly disclose to the Department all intellectual property conceived, created, or furnished under this Agreement. Vendor or subcontractor hereby assigns to the Department the sole and exclusive right, title, and interest in and to all intellectual property conceived, created, or furnished under this Agreement, without further consideration. This Agreement operates as an irrevocable assignment by Vendor and subcontractors to the Department of the copyright in any intellectual property created, published, or furnished to the Department under this Agreement, including all rights thereunder in perpetuity. Vendor and subcontractors shall not patent any intellectual property conceived, created, or furnished under this Agreement. Vendor and subcontractors agree to execute and deliver all necessary documents requested by the Department to affect the assignment of intellectual property to the Department or the registration or confirmation of the Department’s rights in or to intellectual property under the terms of this Agreement. Vendor agrees to include this provision in all its subcontracts under this Agreement.

For scopes involving Artificial Intelligence (AI)-enabled tools, automation scripts, or machine learning models, the Vendor shall provide all deliverables in a format that ensures future reuse by the Department. This includes complete source code, documentation of inputs and outputs, configuration files, external dependencies (including open-source libraries), and clear instructions for reuse or deployment.

These materials shall be treated as deliverables under this Agreement and governed by the same ownership and intellectual property rights provisions outlined above.

The Vendor agrees that all work materials developed or provided by the Vendor under this Agreement and any prior agreement between the parties will be deemed to be work made for hire and owned exclusively by the State of Florida. The Vendor agrees that any intellectual property contained in a Deliverable and developed as a result of this Agreement will be the sole property of the State of Florida. This provision will survive the termination or expiration of the Agreement. The Vendor retains all ownership rights in any proprietary methodologies, methods, processes, ideas, concepts, algorithms, trade secrets, software documentation, other intellectual property, or procedures of the Vendor that pre-exist or were developed outside the scope of this Agreement. If any such property of Vendor is contained in any of the Deliverables hereunder, the Vendor grants to the Department a royalty-free, paid-up, non-exclusive, perpetual license to use such Vendor intellectual property in connection with the Department’s use of the Deliverables.

Purchase of Tangible Personal Property

Contractual services that provide for the Vendor to purchase tangible personal property, as defined in Section 273.02, F.S., for subsequent transfer to the Department may be entered into only in accordance with Rule 60A-1.017, F.A.C. Technology products (e.g., software, networking equipment, etc.) purchased by the Vendor shall be subsequently transferred to the Department and shall be of first quality, supplied by the original product manufacturer or an authorized reseller, and warrantied as appropriate. Technology products procured by the Contractor outside of authorized distributors/retailers are not deemed acceptable to the Department. The Agreement shall specify the quality of the technology products to be acquired, and provisions for warranty, service, and mandatory transfer of ownership to the Department.

SECURITY OF CONFIDENTIAL PERSONAL INFORMATION

The Vendor must implement procedures to ensure the protection and confidentiality of all data, files, and records involved with this Agreement.

Except as necessary to fulfill the terms of this Agreement and with the permission of the Department, Vendor and Vendor’s employees shall not divulge to third parties any confidential information obtained by Vendor or its agents, distributors, resellers, subcontractors, officers, or employees in the course of performing work on this Agreement, including, but not limited to, security procedures, business operations information, or commercial proprietary information in the possession of the State or the Department. If Vendor or Vendor’s employees have access to confidential information in order to fulfill Vendor’s obligations under this Agreement, Vendor agrees to abide by all applicable Department Information Technology Security procedures and policies. For purposes of this Agreement, “Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of Department information in Vendor’s possession. Vendor shall make a report to the Department not more than seven (7) business days after Vendor learns of such use or disclosure.

Vendor’s report shall identify, to the extent known: (i) the nature of the unauthorized use or disclosure, (ii) the confidential information used or disclosed, (iii) who made the unauthorized use or received the unauthorized disclosure, (iv) what Vendor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure, and (v) what corrective action Vendor has taken or shall take to prevent future similar unauthorized use or disclosure.

In the event a “Security Incident” also includes a “breach of security”, as defined by section 501.171, F.S., as amended, concerning confidential personal information involved with this Agreement, Vendor shall comply with section 501.171, F.S. When notification to affected persons is required under this section of the statute, Vendor shall provide that notification, but only after receipt of the Department’s approval of the contents of the notice. Defined statutorily, and for purposes of this Agreement, “breach of security” or “breach” means the unauthorized access of data in electronic form containing personal information.

http://www.leg.state.fl.us/STATUTES/index.cfm?App_mode=Display_Statute&Search_String=&URL=0500-0599/0501/Sections/0501.171.html

THIRD PARTY TOOLS

Vendors may not use third-party tools which impose licensing responsibility on the Department without written approval by the Department.

TRAINING

The Vendor shall provide, at its own expense, training necessary for keeping Vendor staff abreast of industry advances and for maintaining proficiency in equipment and systems that are available on the commercial market.

Appendix II Change Log

Version Date Change Description Change

Owner

1.0 7/10/25 Changed vendor language from “vendor will” to “vendor shall”. Moved project scope and language under 60GG-1 section. 60GG-4 section added statement that technology resources should be cloud first and section on data disposition upon termination and data protection measures. 60GG-5 section added language about a copy of deliverables. Under data security, language was added to section b.

Under guidelines and standards section 3 was added.

OIT

1.1 7/17/25 AI section was added. Language was added to the ownership of works section regarding AI.

Emerging

Technology

1.2 8/425 Added a statement to ensure that Vendors are following the

Department’s data and geospatial standards, including any available data models, that were previously established. Included the Florida

Administrative Code accessibility requirements. Moved Project Plan

Scope Language under 60GG-1 as part of the rule. Included sample language for the compliance review process and technical architecture process. Updated that in the event of unauthorized access as described here, the Chief Data Officer should also be notified. Updated sub-section 60GG-4. Added Change Log.

OIT

I N T R O D U C T I O N S E C T I O N

1) INVITATION

The State of Florida Department of Transportation, hereinafter referred to as the “Department”, requests written proposals from qualified Proposers to provide Statewide Weigh Station Scale Maintenance. It is anticipated that the term of the contract will begin on date of contract execution and be effective through five (5) years thereafter.

The Department intends to award this contract to the responsive and responsible Proposer whose proposal is determined to be the most advantageous to the Department. After the award, said Proposer will be referred to as the “Vendor”. For the purpose of this document, the term "Proposer" means the prime Vendor acting on its own behalf and those individuals, partnerships, firms, or corporations comprising the Proposer team. The term "proposal" means the complete response of the Proposer to the Request for Proposals (RFP), including properly completed forms and supporting documentation.

2) TIMELINE

Provided below is a list of critical dates and actions. These dates are subject to change.