SP_REQ-DASOBO-00023068_Arpeggio Software_ODOC_Approved.pdf

SP_REQ-DASOBO-00023068_Arpeggio Software & Services Page 1 of 6

REQUEST FOR SPECIAL PROCUREMENT No. REQ-DASOBO-00023068

PART A. Requesting Agency must complete Items 1 through 13.

1. Requesting Agency Name: Oregon Department of Corrections (“ODOC”)

2. Date of Request: March 1, 2022 3. Agency Number: 29100

4. Agency Contact Name: Arlene Whitney 5. Phone: 503.779.9641

6. Type of Request: Class Special Procurement _X____ Contract-specific Special Procurement

7. Time Period Requested: From: 4-1-2022 To: 4-1-2032

8. Total Estimated Cost: $20,000.00 ($2,000/annually x 10 years)

Note: The total amount expended to date is $10,000.00. With approval of this SP Request, the cumulative, not-to-exceed (“NTE”) compensation Arpeggio S&S will be $30,000.00.

9. Title: Supplies and/or Services to be Acquired:

Arpeggio ARP-SFTP Software License Subscription (“Software”) and Support and Maintenance Services (“Services”) (collectively “S&S”)

10. Request, Background, Current Need, and Proposed Contracting Procedure:

a. Request:

ODOC requests approval of this Special Procurement (“SP”) #REQ-DASOBO-00023068 to:

• extend its ARP-SFTP Software License Subscription and related services with Arpeggio Software, LLC. (“Arpeggio” or “Contractor”) for 10 years, renewable annually; And

• increase the S&S NTE compensation an additional $20,000.00.

b. Background:

ODOC’s mission echoes the Oregon constitution: To promote public safety by holding offenders accountable for their actions and reducing the risk of future criminal behavior. ODOC has custody of adults sentenced to prison for more than 12 months, housing approximately 14,900 adults in 14 state prisons throughout Oregon. ODOC is recognized nationally among correctional agencies for providing individuals with the cognitive, education, and job skills needed to become productive citizens when they transition back to their communities. As a result of these efforts, Oregon’s recidivism rate has decreased.

ODOC conducts its responsibilities and provides its services through five (5) internal divisions:

• Administrative Services

• Community Corrections

• Correctional Services

• Human Resources

SP_REQ-DASOBO-00023068_Arpeggio Software & Services Page 2 of 6

• Operations Data Center Services (“DCS”), housed within the Administrative Services Division, specifically provides Information Technology (“IT”) services to all DOC work locations and external customers.

Information security and cybersecurity has been – and continues to be – crucially important for protection of data from breaches, theft, fraud, and damage. To ensure sufficient protection of ODOC data, ODOC and DCS staff conducted market research in 2016 for a software product enabling secure IT file transfer. Several ‘secure file transfer’ products were reviewed, and Arpeggio’s software was identified as the best software product meeting ODOC’s needs including:

• ease of use

• IBM-like commands

• easily written into CL, RPG or Cobol programming language

Based on its research findings, and in accordance with Oregon Administrative Rule (“OAR”) 125-247- 0265 and Oregon Revised Statute (“ORS”) 279B.065, which provides in part “(1) A contracting agency may award a procurement of goods or services that does not exceed $10,000 in any manner the contracting agency deems practical or convenient, including by direct selection or award”, ODOC directly selected Arpeggio and contracted for its ARP-SFTP software.

• Address Resolution Protocol (“ARP”): a mapping protocol that connects an Internet Protocol (“IP”) address to a fixed, physical machine; and

• Secure File Transfer Protocol (“SFTP”): provides secure access to a remote computer to deliver secure communications.

Arpeggio’s ARP-SFTP software is a powerful and intelligent Secure File Transfer Protocol (“FTP”) client for the IBM iSeries with many favorable features and functionality such as:

• ARP-SFTP runs natively and does not require the use of extra hardware, partitions or a Portable Application Solutions Environment (“PASE”).

• ARP-SFTP provides the ability to automate any secure FTP task.

• ARP-SFTP provides one interface for automating transfers via FTP or SFTP and tracking for both types of activities can be found in one location.

• ARP-SFTP supports multiple authentication methods and remote host verification to prevent man in the middle attacks; a form of active wiretapping attack in which the attacker intercepts and selectively modifies communicated data to masquerade as one or more of the entities.

ODOC uses the Software for multiple, regular business practices which involves data transfer/sharing among various agencies and all 36 Oregon Counties. ODOC transfers/shares AIC (‘adults in custody’) data through ARP-SFTP to the appropriate contractor(s). Those contractor(s) disseminate the data and use it to carry out their contractual obligations by providing notices, fulfilling information requests, funding AIC canteen accounts, and so on. Following are some examples of ODOCs current data transfer/sharing:

o County Data Extracts: Data provided to all 36 Oregon counties including AIC Personal Identifiable Information (“PII”), AIC release or transfer status, etc.

o VINE Reporting: Victim Information and Notification Everyday (“VINE”) is an anonymous telephone service that monitors offenders in the custody of ODOC, Oregon Youth Authority and all county jails. Anyone can call the service to:

SP_REQ-DASOBO-00023068_Arpeggio Software & Services Page 3 of 6 o ask for the current status of an offender.

o register to receive immediate notification if an offender is released, transferred, escapes or dies.

o ask about any other important probation and parole information.

o CenturyLink: AICs can receive money from friends and family to buy things from correctional facility canteens. Money is submitted to the contractor, in this case CenturyLink, and then deposited into the appropriate AIC account.

o TIN Verification: Using a Taxpayer Identification Number (“TIN") process, contractors such as CenturyLink can match the right information to the right AIC.

ODOC’s total expenditures for the Arpeggio Software and Services to date are detailed in the following Table 10.B:

TABLE 10.B

Arpeggio S&S Expenditures To Date

c. Current Need:

The current S&S term will expire March 31, 2022. ODOC has been using the Software since 2016 and has integrated all of its FTP processes into the Software. As long as ODOC is running on the IBM iSeries server for its DOC400 and DEVL400 environments, it will need this ‘transport medium’ Software and Services.

d. Proposed Contracting Procedure:

1. As required by OAR 125-247-0287, ODOC, through its Procurement Office, will issue a public notice (“Notice”) regarding approval of this SP on OregonBuys, the state’s eProcurement system of record, for a period of seven (7) calendar days.

2. The public Notice will include provisions that any affected party may protest the approval of the

SP.

3. Oregon Department of Administrative Services (“DAS”), working with ODOC, will respond to and resolve all protests, if any.

4. If no protests to this SP are received or sustained:

• ODOC will issue a Purchase Order (“PO”) for the next S&S renewal term as set out in Sections 9 and 10.a above.

PO S&S Term Total Cost 384574 4/1/2017 – 3/31/2018 $2,000 388081 4/1/2018 – 3/31/2019 $2,000 391313 4/1/2019 – 3/31/2020 $2,000 394888 4/1/2020 – 3/31/2021 $2,000 397204 4/1/2021 – 3/31/2022 $2,000

Total $10,000

SP_REQ-DASOBO-00023068_Arpeggio Software & Services Page 4 of 6

• Thereafter, ODOC will issue annual Purchase Orders (“POs”) for each subsequent S&S renewal through the term of this SP.

5. ODOC will work with DAS Enterprise Information Services (“EIS”) and obtain its endorsement prior to executing all annual renewals, as required.

11. Justification for use of Special Procurement: Describe the circumstances that justify the use of a Special Procurement. Attach relevant documentation.

• Arpeggio has been providing the Software to ODOC for as its FTP transport medium for the last five

(5) years.

• ODOC’s FTP processes are heavily integrated with the Software as detailed above in Section 10.b, Background.

• All 36 Oregon counties and ODOC external customers have integrated Arpeggio SFTP into their ODOC-related processes.

• As long as ODOC is running on the IBM iSeries server, ODOC will require this Software.

• Moving to a different software product, if required, will be a very large undertaking for ODOC’s’ staff and require the affected processes to be changed and tested to verify the extract (SFTP) process works appropriately, which will take a significant amount of time.

• Although other FTP software products are available in the open market, they lack integration with IBM iSeries Command Language. They also require a password for each user, which is not feasible.

• Arpeggio ARP-SFTP software meets the Oregon Secretary of State security standards for SFTP and cyber security services (“CSS”).

12. Findings to Satisfy the Required Standards: This proposed special procurement:

___X___ (a) will be unlikely to encourage favoritism in the awarding of public contracts or to substantially diminish competition for public contracts because:

• The Arpeggio Software and Services were procured in accordance with Oregon statutes and rules for Small Procurements.

• Arpeggio has both international and domestic partners/resellers. However, its domestic partners typically buy an ARP-SFTP software subscription from Arpeggio and embed it into a larger solution (i.e., software suite) designed to address a broader purpose for their end users. The ARP-Software would be a small component with a turnkey application design for specific business sectors. For example:

o Arpeggio partners that provide hosted healthcare applications for doctors and clinics embed the ARP-SFTP in a software suite that also includes patient tracking, claims submissions, remittances, etc.

o Arpeggio partners that provide banking applications embed the ARP-SFTP in a turnkey software suite for financial institutions.

SP_REQ-DASOBO-00023068_Arpeggio Software & Services Page 5 of 6

ODOC needs only the ARP-SFTP, not a suite of multiple software applications beyond its requirements. The ARP-SFTP S&S, as a standalone software product, must be procured directly from Arpeggio.

• ODOC runs on an IBM iSeries server. Although other FTP software products are available, they lack integration with IBM iSeries Command Language.

and

______ (b)(i) will result in substantial cost savings to the contracting agency or to the public because:

or

___X___ (b)(ii) will otherwise substantially promote the public interest in a manner that could not practicably be realized by complying with the requirements of ORS 279B.055, 279B.060, 279B.065, or 279B.070, or any rules adopted thereunder because:

The Arpeggio Software product is integrated within ODOC systems and has been functioning effectively for the last five (5) years. Procuring and transitioning to a different SFTP product, if required, will entail additional ODOC resources to:

1. re-work all existing processes, which may introduce significant errors.

2. test each re-worked process for efficacy and compliance with all state standards.

3. assist all 36 Oregon counties and external customers with their transition to each re-worked process.

ODOC would be unable to use a new (different) product until bulleted items 1 and 2 are completed, which would cause delays in data transfer/sharing. Further, it would cause unacceptable disruptions in victim notifications, which may place certain members of the public in precarious situations and predispose the State to lawsuits.

13. Signature: The actual signature of the Agency Head or designee (e.g., Designated Procurement Officer) is not required on the Request if it is submitted through OregonBuys. Agency may elect to attach a signed Request.

Signature: e.g. Electronically in OregonBuys _________________ Type Name: Date:

SP_REQ-DASOBO-00023068_Arpeggio Software & Services Page 6 of 6

PART B. The Department of Administrative Services completes Part B.

STATUTORY AND RULE AUTHORITY:

ORS 279B.085(2) states the Director of the Department of Administrative Services may approve a special procurement if the Director finds that a written request submitted under ORS 279B.085(4) demonstrates that the use of a special procurement as described in the request, or an alternative procedure prescribed by the Director will:

(a) Be unlikely to encourage favoritism in the awarding of public contracts or to substantially diminish competition for public contracts; and (b)(A) Result in substantial cost savings to the contracting agency or to the public; or

(B) Otherwise substantially promote the public interest in a manner that could not practicably be realized by complying with requirements that are applicable under ORS 279B.055, 279B.060, 279B.065 or 279B.070 or under any rules adopted thereunder.

OAR 125-246-0170 delegates the authority of the Director of the Department of Administrative Services to approve special procurements to the State Chief Procurement Officer. OAR 125-247-0285 through 125- 247-0288 implement ORS 279B.085.

OAR 125-247-0700(2) Protests and Judicial Review of Special Procurements designates the State Chief Procurement Officer as the Contract Review Authority.

FINDINGS: The findings are accepted, adopted, and incorporated by reference herein.

CONDITIONS OF APPROVAL:

1. Notice Period. The Authorized Agency shall post the Public Notice on ORPIN. The Special

Procurement may not be used until after the completion of the seven (7) day notice period required pursuant to OAR 125-247-0287(4), and either:

a. No Written protests are received by the Contract Review Authority, State Chief Procurement Officer, from an Affected Person in response to the notice, or

b. If any protest is received during the notice period, then not until:

i. the State Chief Procurement Officer or delegate issues a written disposition of the protest in accordance with ORS 279B.400 and OAR 125-247-0700 and OAR 137-047-0700, and

ii. confirms in writing the first possible date of use of the Special Procurement.

2. ORS 279A.165 Requirements. Authorized Agency shall comply with the requirements of ORS 279A.165 and OAR 125-247-0287(12) regarding a report about this Special Procurement. Agency shall use a form and follow the instructions provided by the State Chief Procurement Officer or delegate.

3. Authorized Agency shall comply with all Enterprise Information Services (“EIS”) conditions and requirements prior to contract execution (i.e., issuing a Purchase Order for each annual renewal), if any.

APPROVED:

Darwin Kumpula, Deputy State Chief Procurement Officer, Date Department of Administrative Services

3/31/2022Darwin Kumpula Digitally signed by Darwin Kumpula Date: 2022.03.31 15:54:30 -07'00'