SRA 20-08 - Identity Proofing SaaS RFP - issued 07.17.20.pdf

STATE OF MARYLAND

MARYLAND STATE RETIREMENT AGENCY (MSRA)

REQUEST FOR PROPOSALS (RFP)

IDENTITY PROOFING SOFTWARE-AS-A-SERVICE

RFP NUMBER SRA 20-08

ISSUE DATE: JULY 17, 2020

NOTICE

A Prospective Offeror that has received this document from a source other than eMaryland Marketplace

Advantage (eMMA) https://procurement.maryland.gov should register on eMMA. See Section 4.2.

MINORITY BUSINESS ENTERPRISES ARE ENCOURAGED TO

RESPOND TO THIS SOLICITATION.

Identity Proofing Software-as-a-Service

Solicitation #: SRA 20-08 RFP Document

RFP for Maryland State Retirement Agency Page ii of 81

VENDOR FEEDBACK FORM

To help us improve the quality of State solicitations, and to make our procurement process more responsive and business friendly, please provide comments and suggestions regarding this solicitation.

Please return your comments with your response. If you have chosen not to respond to this solicitation, please email or fax this completed form to the attention of the Procurement Officer (see Key

Information Summary Sheet below for contact information).

Title: Identity Proofing Software-as-a-Service

Solicitation No: SRA 20-08

1. If you have chosen not to respond to this solicitation, please indicate the reason(s) below:

Other commitments preclude our participation at this time

The subject of the solicitation is not something we ordinarily provide

We are inexperienced in the work/commodities required

Specifications are unclear, too restrictive, etc. (Explain in REMARKS section)

The scope of work is beyond our present capacity

Doing business with the State is simply too complicated. (Explain in REMARKS section)

We cannot be competitive. (Explain in REMARKS section)

Time allotted for completion of the Proposal is insufficient

Start-up time is insufficient

Bonding/Insurance requirements are restrictive (Explain in REMARKS section)

Proposal requirements (other than specifications) are unreasonable or too risky (Explain in

REMARKS section)

MBE or VSBE requirements (Explain in REMARKS section)

Prior State of Maryland contract experience was unprofitable or otherwise unsatisfactory.

(Explain in REMARKS section)

Payment schedule too slow

Other: __________________________________________________________________

2. If you have submitted a response to this solicitation, but wish to offer suggestions or express concerns, please use the REMARKS section below. (Attach additional pages as needed.)

REMARKS:

Vendor Name: ________________________________ Date: _______________________

Contact Person: _________________________________ Phone (____) _____ - _________________

Address: ______________________________________________________________________

E-mail Address: ________________________________________________________________

RFP for Maryland State Retirement Agency Page iii of 81

STATE OF MARYLAND

MARYLAND STATE RETIREMENT AGENCY (MSRA)

KEY INFORMATION SUMMARY SHEET

Request for Proposals Services - Identity Proofing Software-as-a-Service

Solicitation Number: SRA 20-08

RFP Issue Date: July 17, 2020

RFP Issuing Office: Maryland State Retirement Agency (MSRA or the "Agency")

Procurement Officer: Margie J. Gordon, CPPB

Maryland State Retirement Agency

120 E. Baltimore Street, 16th Floor

Baltimore, MD 21202

E-mail:

Office Phone:

mgordon@sra.state.md.us

410-625-5656

Proposals are to be sent to: procurement@sra.state.md.us

Attn: Ms. Margie J. Gordon, CPPB

Pre-Proposal Conference: Wednesday, August 5, 2020 at 1:00 P.M., Local Time

Via Microsoft Team Online Conference

See Attachment A for instructions.

Questions Due Date and Time Friday, August 14, 2020 at 2:00 P.M. Local Time

Proposal Due (Closing) Date and Time:

Wednesday, August 26, 2020 at 2:00 P.M., Local Time

Offerors are reminded that a completed Feedback Form is requested if a no-bid decision is made (see page ii).

MBE Subcontracting Goal: 0%

VSBE Subcontracting Goal: 0%

Contract Type: Indefinite quantity with tiered pricing

Contract Duration: Five (5) year base period with two (2) one-year option periods, effective on the Notice to Proceed Date.

Primary Place of

Performance:

Maryland State Retirement Agency

120 E. Baltimore Street

Baltimore, MD 21202

SBR Designation: No

Federal Funding: No mailto:mgordon@sra.state.md.us mailto:procurement@sra.state.md.us

RFP for Maryland State Retirement Agency Page iv of 81

TABLE OF CONTENTS – RFP

1 Minimum Qualifications

1.1 Offeror Minimum Qualifications

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.2 Background and Purpose

2.4 Deliverables

2.5 Service Level Agreement (SLA)

3 Contractor Requirements: General

3.1 Contract Initiation Requirements

3.2 End of Contract Transition (Reserved)

3.3 Invoicing

3.5 Disaster Recovery and Data

3.6 Insurance Requirements

3.7 Security Requirements

3.8 Problem Escalation Procedure

3.9 SOC 2 Type 2 Audit Report

3.10 Experience and Personnel

4 Procurement Instructions

4.1 Pre-Proposal Conference

4.2 eMaryland Marketplace Advantage (eMMA)

4.3 Questions

4.4 Procurement Method

4.5 Proposal Due (Closing) Date and Time

4.6 Multiple or Alternate Proposals

4.7 Economy of Preparation

4.8 Public Information Act Notice

4.9 Award Basis

4.10 Oral Presentation/Demonstrations

4.11 Proof of Concept

4.12 Duration of Proposal

4.13 Revisions to the RFP

4.14 Cancellations

RFP for Maryland State Retirement Agency Page v of 81

4.15 Incurred Expenses

4.16 Protest/Disputes

4.17 Offeror Responsibilities

4.18 Acceptance of Terms and Conditions

4.19 Proposal Affidavit

4.20 Contract Affidavit

4.21 Compliance with Laws/Arrearages

4.22 Verification of Registration and Tax Payment

4.23 False Statements

4.24 Payments by Electronic Funds Transfer

4.25 Electronic Procurements Authorized

4.26 MBE Participation Goal

4.27 VSBE Goal

4.28 Living Wage Requirements

4.29 Federal Funding Acknowledgement

4.30 Conflict of Interest Affidavit and Disclosure

4.31 Non-Disclosure Agreement

4.32 HIPAA - Business Associate Agreement

4.34 Mercury and Products That Contain Mercury

4.35 Location of the Performance of Services Disclosure

4.36 Department of Human Services (DHS) Hiring Agreement

4.37 Small Business Reserve (SBR) Procurement

5 Proposal Format

5.1 Two Part Submission

5.2 Proposal Delivery and Packaging

5.3 Volume I - Technical Proposal

5.4 Volume II – Financial Proposal

6 Evaluation and Selection Process

6.1 Evaluation Committee

6.2 Technical Proposal Evaluation Criteria

6.3 Financial Proposal Evaluation Criteria

6.4 Reciprocal Preference

6.5 Selection Procedures

6.6 Documents Required upon Notice of Recommendation for Contract Award

RFP for Maryland State Retirement Agency Page vi of 81

7 RFP ATTACHMENTS AND APPENDICES

Attachment A. Pre-Proposal Conference Response Form

Attachment B. Financial Proposal Instructions & Form

Attachment C. Proposal Affidavit

Attachment D. Minority Business Enterprise (MBE) Forms

Attachment E. Veteran-Owned Small Business Enterprise (VSBE) Forms

Attachment F. Maryland Living Wage Affidavit of Agreement for Service Contracts

Attachment G. Federal Funds Attachments

Attachment H. Conflict of Interest Affidavit and Disclosure

Attachment I. Non-Disclosure Agreement (Contractor)

Attachment J. HIPAA Business Associate Agreement

Attachment K. Mercury Affidavit

Attachment L. Location of the Performance of Services Disclosure

Attachment M. Contract

Attachment N. Contract Affidavit

Attachment O. DHS Hiring Agreement

Appendix 1. – Abbreviations and Definitions

Appendix 2. – Offeror Information Sheet

RFP for Maryland State Retirement Agency Page 1 of 81

1 Minimum Qualifications

1.1 Offeror Minimum Qualifications

There are no minimum qualifications for this RFP.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK

RFP for Maryland State Retirement Agency Page 2 of 81

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.1.1 The Maryland State Retirement Agency (MSRA or the "Agency") is issuing this Request for

Proposals (“RFP”) in order to contract with a commercially available identity proofing SaaS

Solution to be integrated into the Agency’s secure Internet portal, allowing Agency participants to register to securely transact business with the Agency.

2.1.2 It is the Agency’s intention to obtain goods and services, as specified in this RFP, from a Contract between the selected Offeror and the Agency.

2.1.3 The Agency is seeking to make up to three (3) awards as a result of this RFP to select up to three

(3) identity proofing services to incorporate into mySRPS. See RFP Section 4.9 Award Basis for more Contract award information.

2.1.4 An Offeror, directly, must be able to provide all goods and services and meet all of the requirements requested in this solicitation. The successful Offeror (the “Contractor”) shall remain responsible for Contract performance regardless of subcontractor participation in the work.

2.1.5 A Contract award does not ensure a Contractor will receive all or any State business under the

Contract.

2.2 Background and Purpose

The Maryland State Retirement Agency administers the Maryland State Retirement and Pension System

(“MSRPS”), which consists of several qualified governmental defined benefit retirement plans for public sector employees throughout the State of Maryland. To improve direct service to its participants, MSRA is initiating a secure Internet “portal” for participants, which includes approximately 400,000 active and retired employees, vested former employees, and beneficiaries. That portal, branded mySRPS, will enable participants to view Agency records related to their membership (service credit, compensation history, etc.), update information (retiree address, bank account, beneficiaries, etc.), obtain estimates of future retirement benefits based on records on file, and offer many other services to users.

NOTE: This procurement is not for use in a single sign-on configuration for internal staff; rather, this specific procurement is to integrate with mySRPS for external customers.

The identity proofing services shall incorporate into mySRPS. These services, through a series of interactions and activities, shall reasonably prove an assertion of identity – by first verifying that an identity is legitimate, and then confirming that the prospective mySRPS registrant matches that identity.

2.2.1 User Registration and Login Detail

A two-step user process is incorporated into the design of mySRPS. First, a participant registers as a user of the secure web portal, and then on an ongoing basis, the registrant logs into the site to transact business with the Agency. In reverse order, addressing ongoing login, the Agency has contracted with a commercial service (SecureAuth) that offers multifactor / adaptive authentication (e.g., device identifier, time of day, location, patterns, etc.) along with self-service password reset. This leaves to be addressed how initial participant registration will occur.

The Agency intends to focus increased attention at the time of user registration, rather than take a “step up” approach to authentication as transaction risk escalates. Certain prospective online transactions are

RFP for Maryland State Retirement Agency Page 3 of 81 inherently riskier than others. The Agency has prioritized some of the riskier transactions for early deployment in mySRPS since they also provide the greatest value to our participants. Therefore, the

Agency seeks to pursue the most rigorous identity verification at the time of registration, to help ensure that mySRPS credentials are only granted to authorized individuals.

In addition, registration is the first point of vulnerability. Information is often publicly available related to a public sector employee’s name, compensation, place of work, work history, retirement plans, etc.

These have been exploited to perpetrate fraud at our peer organizations, and as we initiate mySRPS we wish to mitigate as much of this risk as practical, balancing rigor against the simplicity of the user access experience.

Given this background, the Agency looks to accomplish baseline registration to use mySRPS by combining matching of information on file for each individual with enhanced or advanced authentication services known as “ID Proofing.” MSRA seeks to contract with up to three (3) service providers to encompass a multi-layered approach that has the ability to evolve as the future marketplace offers improved proofing options, or as some options become either obsolete or are deemed too cumbersome for a segment of end users.

2.2.2 General Approach

In the current marketplace, the Agency has identified many different approaches to ID proofing. Some require use of ancillary devices, such as a smart phone with a camera, while other approaches do not.

This implies that there could be a cascade / choice of acceptable strategies taken by the Agency. For example, if a prospective registrant has a smart phone, s/he might opt to use one method of proving identity; however, if not, then a different method could be used. No decision has been made on which combination of approaches will be employed in mySRPS.

In addition, in the event that, for some uncontrollable reason, one method is found to be compromised, the Agency’s strong preference is to be able to select another method from the selected service provider(s). This implies that a preferred vendor both (1) begins with multiple options to offer, and (2) constantly stays in touch with technology, to enhance its offering with new options over time. For example, at one point, cellular phones did not have built-in cameras, thereby limiting use of facial recognition as a means of identity verification; however, as smart phones became prevalent in the marketplace, proofing options opened up. MSRA is seeking one or more Contractors that offer multiple options today and are strategically oriented to expand those offerings into the future as opportunities arise and practical realities evolve.

The Agency is also open to changes in authentication and identification strategies in the future. While it is not currently anticipated that a rigorous identity proofing stratagem will be used during ongoing login and transaction activity once a participant is registered to use mySRPS, MSRA may decide in the future to implement a “step-up” approach wherein additional identification services may be inserted into mySRPS programs to increase risk-mitigation for such high-risk future transactions as changing bank deposit accounts or beneficiaries.

Last, in deciding which specific approaches to identity proofing to incorporate into the mySRPS product, customer experience is very important. As is obvious, the System’s participants consist of active members, former members, retirees, and beneficiaries, and span a wide range of experience, technology savvy and technology ownership.

2.2.3 Methodologies

Some of the applicable services which the Agency has seen in the marketplace include:

RFP for Maryland State Retirement Agency Page 4 of 81

A. One-time codes by email, phone, or text message

B. Document recognition (validation of government issued identification documents)

C. Facial recognition (e.g., matching a “selfie” with a driver’s license or passport photo)

D. Retinal or iris scan, fingerprint recognition, voice-printing, or other biometric

E. Behavioral, e.g., time of day or keyboard/click patterns (versus use of cut-and-paste or insertion rather than key entry, or BOT-type activity), frequency of access, device identification, login location, source and link/hop analysis

F. Knowledge-based authentication (knowledge of prior street addresses, mortgagees, motor vehicles … other information on public record through multiple choice questions)

G. Prior identity proofing experience, in the event that a given user returns multiple times to attempt to register

H. Maintenance of black lists of previously used fraudulent or compromised identities

I. Use of machine learning or so-called “artificial intelligence” to improve proofing accuracy.

2.2.4 Technology Approach

The Agency intends to implement mySRPS on premise in its Baltimore Data Center (with a back-up instance at the Agency’s disaster recovery location), behind a web application firewall that is SaaS, a configuration that will be regularly tested for security and efficacy by internal staff and independently by external parties. Hardware will be high-availability, replicated, and load-balanced. The majority of data resources that will be displayed in mySRPS are planned to be on premise.

The mySRPS application is primarily developed under Microsoft’s .NET architecture and will run on servers running Microsoft operating systems, SQL Server, and additional Internet tools within the

Microsoft suite of products.

That stated, MSRA’s understanding of the marketplace for identity proofing services is that most (if not all) of the rigorous solutions are cloud-based services. Therefore, the Agency will integrate its on premise application with the awarded Contractor(s) cloud-based services.

2.2.5 State Staff and Roles

In addition to the Procurement Officer and Contract Monitor, the Agency is developing mySRPS using both State employees and supplemental contractors. Overall project management is also being provided through a contract. The selected Contractor(s) will interact with Agency employees and contractors to provide technical interface information and assistance to ensure that the service integrates with mySRPS seamlessly and provides an acceptable end user experience. Based on guidance from the selected

Contractor(s), the Agency development team will develop the mySRPS code that integrates with the selected ID Proofing SaaS Solution(s). The development team is under the direct management of a contracted Project Manager and the general guidance of an Information Technology Steering

Committee. All application development in the Agency is conducted under formal development operations procedures administered by the Agency’s Information Systems Division and its Director of

Systems Development, in conjunction with the Agency’s Business Operations Office. Ongoing support for mySRPS will be provided by the same Agency team, which will continue to interface with the selected Contractor.

2.3 Responsibilities and Tasks

Generally, subject to qualification in Subsection 2.3.1 below, the following responsibilities and tasks are required of each Offeror under this procurement.

RFP for Maryland State Retirement Agency Page 5 of 81

A. Following Contract award, the selected Contractor(s) shall work with the Agency development team to ensure that identity proofing services are properly configured and provisioned to operate

“seamlessly” with mySRPS, to ensure an uninterrupted mySRPS site user experience, assuming that the secure web site will be configured to be a high availability, load-balanced system with both a primary and back-up site.

B. Following elevation of mySRPS to Production status, Contractor(s) will provide continuous identity proofing services under Contract to the Agency, conforming to an SLA included in the

Contract.

C. Selected Contractor(s) shall regularly update the contracted service, to ensure that the identity proofing application / service remains secure, efficient, effective, and responsive. As available, the Contractor shall provide new or revised identity proofing service offerings as options for

Agency use, subject to adjustments in APIs, SLAs, and pricing models, and subject to further participation by the selected Contractor(s) in Proof of Concepts (POC) and testing prior to initiation of the new or revised offering (refer to RFP Section 4.11).

2.3.1 Contractor-Supplied Hardware, Software, and Materials

Depending on the Offeror solution(s) proposed in the Technical Proposal, some of the following terms and conditions may apply. In its Technical Proposal, from the Offeror’s perspective, Offerors shall identify which of these terms apply and which are not applicable. The Agency will review Technical

Proposals with these considerations in mind. Disagreements with the Offeror’s assertions of applicability will be discussed and resolved prior to any Contract award.

A. By responding to this RFP and accepting a Contract award, the Offeror specifically agrees that for any software, hardware or hosting service that it proposes, the Agency will have the right to purchase such item(s) from another source, instead of from the selected Offeror(s).

B. SaaS applications shall be accessible from various Web-connected client devices (PC, smartphones, tablets, etc.).

C. The Agency shall be permitted user-specific application configuration settings.

D. The Contractor is responsible for the acquisition and operation of all hardware, software and network support related to the services being provided and shall keep all software current.

E. All upgrades and regulatory updates shall be provided at no additional cost.

F. The Agency requires that the Offeror price individual software services separately.

The Offeror shall install and provide all documentation for the software furnished under the

Contract.

2.3.2 Required Project Policies, Guidelines and Methodologies

The Contractor shall be required to comply with all applicable laws, regulations, policies, standards and guidelines affecting Information Technology projects, which may be created or changed periodically.

Offeror is required to review all applicable links provided below and state compliance in its response.

It is the responsibility of the Contractor to ensure adherence and to remain abreast of new or revised laws, regulations, policies, standards and guidelines affecting project execution. These include, but are not limited to:

A. The State of Maryland System Development Life Cycle (SDLC) methodology at:

http://doit.maryland.gov/SDLC/Pages/agile-sdlc.aspx;

http://doit.maryland.gov/SDLC/Pages/agile-sdlc.aspx

RFP for Maryland State Retirement Agency Page 6 of 81

B. The State of Maryland Information Technology Security Policy and Standards at:

http://www.DoIT.maryland.gov/policies/Pages/default.aspx;

C. The State of Maryland Information Technology Non-Visual Standards at:

http://doit.maryland.gov/policies/Pages/nva.aspx;

D. The State of Maryland Information Technology Project Oversight at:

http://doit.maryland.gov/epmo/Pages/ProjectMgmt.aspx;

E. The National Institute of Standards and Technology, Special Publication 800-63 at:

https://pages.nist.gov/800-63-3/; and

F. The Contractor shall follow project management methodologies consistent with the most recent edition of the Project Management Institute’s Project Management Body of

Knowledge Guide.

2.3.3 Product Requirements

A. Offeror shall be authorized to furnish the proposed goods and services. Offerors proposing to resell services of another entity must be authorized by such other entity.

B. No international processing for State Data: As described in Section 3.7 Security

Requirements, Offerors are advised that any processing or storage of data outside of the

U.S. is prohibited.

C. Offeror consistent expiration dates: A PO for a service already being delivered to the

Agency under the Contract shall terminate on the same calendar day as the prior product/service. As appropriate, charges shall be pro-rated.

D. Any Contract award is contingent on the State’s agreement, during the Proposal evaluation process, to any applicable terms of use and any other agreement submitted in the Offeror’s

Technical Proposal (see Section 5.3.2). Such agreed upon terms of use shall apply consistently across services ordered under the Contract.

E. The Contractor shall not establish any auto-renewal of services beyond the period identified in Contract documents.

F. In addition to any notices of renewal sent to the Agency, Contractors shall email notices of renewal to the e-mail address designated by the Contract Monitor.

2.3.4 Maintenance and Support

Depending on the Offeror solution(s) proposed in the Technical Proposal, some of the following terms and conditions may apply. In its Technical Proposal, from the Offeror’s perspective, Offerors shall identify which of these terms apply and which are not applicable. The Agency will review Technical

Proposals with these considerations in mind. Disagreements with the Offeror’s assertions of applicability will be discussed and resolved prior to any Contract award.

Maintenance and support, and Contractor’s ongoing maintenance and support obligations, are defined as follows:

A. Maintenance commences at point of State licensing of an identity proofing solution, after completion of any required POC and/or acceptance testing.

B. Software maintenance includes all future software updates and system enhancements applicable to system modules licensed without further charge to all licensed users maintaining a renewable software support contract. The Agency requires notification, at least

72 normal State business hours in advance of any maintenance activity or configuration change that would substantively interrupt service during the term of the Contract.

http://www.doit.maryland.gov/policies/Pages/default.aspx http://doit.maryland.gov/policies/Pages/nva.aspx http://doit.maryland.gov/epmo/Pages/ProjectMgmt.aspx https://pages.nist.gov/800-63-3/

RFP for Maryland State Retirement Agency Page 7 of 81

C. Support shall be provided for superseded releases and back releases still in use by the State.

D. For the first year and all subsequent Contract years, the following services shall be provided for the current version and one previous version of any software provided with the

Deliverables:

1) Error Correction. Upon notice by the Agency of a problem with the software, prompt, appropriate, and reasonable efforts to correct or provide a working solution for the problem.

2) Material Defects. Contractor shall immediately notify the Agency of any material errors or defects in the Deliverables known or made known to Contractor from any source during the life of the Contract that could cause the production of inaccurate or otherwise materially incorrect results. The Contractor shall promptly initiate actions as may be commercially necessary or proper to effect corrections of any such errors or defects.

3) Updates. Contractor will provide to the Agency at no additional charge all new releases and bug fixes (collectively referred to as “Updates”) for any software

Deliverable developed or published by the Contractor and made available to its other customers.

2.3.4.1 Technical Support

A. “Technical Support” means Contractor-provided assistance for the services or Solution furnished under the Contract, after initial end-user support confirms a technical issue that requires additional troubleshooting capabilities; sometimes referenced as Tier II – IV support.

B. The Agency shall be able to contact a Technical Support team member 24 hours per day, 7 days per week, 365 days per year.

C. The Contractor shall return calls for service of emergency system issues (see Section 2.5 –

Service Level Agreement) within one (1) hour.

D. The Contractor shall return calls for non-emergency IT service requests within three (3) hours.

E. The Contractor shall provide the Agency with information on software problems encountered at other locations, along with the solution to those problems, when relevant to

State software.

2.4 Deliverables

Depending on the Offeror solution(s) proposed in the Technical Proposal, some of the following terms and conditions may apply. In some instances, deliverables apply to monthly usage reports to the

Agency from the Contractor. In its Technical Proposal, from the Offeror’s perspective, Offerors shall identify which of these terms apply and which are not applicable. The Agency will review Technical

Proposals with these considerations in mind. Disagreements with the Offeror’s assertions of applicability will be discussed and resolved prior to any Contract award.

2.4.1 Deliverable Submission

A. Unless specified otherwise, written deliverables shall be compatible with Microsoft Office, Microsoft Project or Microsoft Visio within two (2) versions of the current version. At the

Contract Monitor’s discretion, the Contract Monitor may request one hard copy of a written deliverable.

RFP for Maryland State Retirement Agency Page 8 of 81

B. A standard deliverable review cycle will be elaborated and agreed-upon between the State and the Contractor. This review process is entered into when the Contractor completes a deliverable.

C. For any written deliverable, the Contract Monitor may request a draft version of the deliverable, to comply with the minimum deliverable quality criteria listed in Section 2.4.3

Minimum Deliverable Quality. Drafts of each final deliverable, except status reports, are required at least two weeks in advance of when the final deliverables are due (with the exception of deliverables due at the beginning of the project where this lead time is not possible, or where draft delivery date is explicitly specified). Draft versions of a deliverable shall comply with the minimum deliverable quality criteria listed in Section 2.4.3 Minimum

Deliverable Quality.

2.4.2 Deliverable Acceptance

A. A final deliverable shall satisfy the scope and requirements of this RFP for that deliverable, including the quality and acceptance criteria for a final deliverable as defined in Section

2.4.4 Deliverable Descriptions/Acceptance Criteria.

B. The Contract Monitor shall review a final deliverable to determine compliance with the acceptance criteria as defined for that deliverable. The Contract Monitor is responsible for coordinating comments and input from various team members and stakeholders. The

Contract Monitor is responsible for providing clear guidance and direction to the Contractor in the event of divergent feedback from various team members.

C. The Contract Monitor will notify the Contractor of acceptance or rejection of the deliverable.

Following acceptance, in the event that a deliverable is priced separately from the identity proofing service, the Contractor shall submit a proper invoice in accordance with the procedures in Section 3.3.

D. In the event of rejection, the Contract Monitor will formally communicate in writing any deliverable deficiencies or non-conformities to the Contractor, describing in those deficiencies what shall be corrected prior to acceptance of the deliverable in sufficient detail for the Contractor to address the deficiencies. The Contractor shall correct deficiencies and resubmit the corrected deliverable for acceptance within the agreed-upon time period for correction.

2.4.3 Minimum Deliverable Quality

The Contractor shall subject each deliverable to its internal quality-control process prior to submitting the deliverable to the Agency.

Each deliverable shall meet the following minimum acceptance criteria:

A. Be presented in a format appropriate for the subject matter and depth of discussion.

B. Be organized in a manner that presents a logical flow of the deliverable’s content.

C. Represent factual information reasonably expected to have been known at the time of submittal.

D. In each section of the deliverable, include only information relevant to that section of the deliverable.

E. Contain content and presentation consistent with industry best practices in terms of deliverable completeness, clarity, and quality.

F. Meets the acceptance criteria applicable to that deliverable, including any State policies, functional or non-functional requirements, or industry standards.

RFP for Maryland State Retirement Agency Page 9 of 81

G. Contains no structural errors such as poor grammar, misspellings or incorrect punctuation.

H. A draft written deliverable may contain limited structural errors such as incorrect punctuation and shall represent a significant level of completeness toward the associated final written deliverable. The draft written deliverable shall otherwise comply with minimum deliverable quality criteria above.

2.4.4 Deliverable Descriptions/Acceptance Criteria

Deliverable requirements, along with deliverable descriptions and acceptance criteria, will be determined uniquely for the selected Offeror proposal(s), prior to Contract award.

2.5 Service Level Agreement (SLA)

Offerors shall submit proposed SLAs in their Technical Proposals, associated with each identity proofing service proposed. If multiple identity proofing solutions are available and offered by any single Offeror, SLAs shall clearly identify to which specific solutions they apply. In cases where

Offerors have options for delivering services at different levels, all options being proposed shall be included in Technical Proposal submissions. SLAs are considered a key component of Technical

Proposal submission evaluations, discussed between the State and selected Offeror(s) prior to Contract award, and then incorporated into Contract(s) awarded.

RFP for Maryland State Retirement Agency Page 10 of 81

3 Contractor Requirements: General

3.1 Contract Initiation Requirements

See Section 2.3 of this RFP for tasks that may be required at time of Contract initiation.

3.2 End of Contract Transition (Reserved)

3.3 Invoicing

3.3.1 General

A. The Contractor shall e-mail the original of each invoice and signed authorization to invoice to the Contract Monitor at e-mail address: rdiehl@sra.state.md.us with a copy to procurement@sra.state.md.us.

B. All invoices for services shall be verified by the Contractor as accurate at the time of submission.

C. An invoice not satisfying the requirements of a Proper Invoice (as defined at COMAR

21.06.09.01 and .02) cannot be processed for payment. To be considered a Proper Invoice, invoices must include the following information, without error:

1) Contractor name and address;

2) Remittance address;

3) Federal taxpayer identification (FEIN) number, social security number, as appropriate;

4) Invoice period (i.e. time period during which services covered by invoice were performed);

5) Invoice date;

6) Invoice number;

7) State assigned Contract number;

8) State assigned (Blanket) Purchase Order number(s);

9) Goods or services provided;

10) Amount due; and

11) Any additional documentation required by regulation or the Contract.

D. The Agency reserves the right to reduce or withhold Contract payment in the event the

Contractor does not provide the Agency with all required deliverables within the time frame specified in the Contract or otherwise breaches the terms and conditions of the Contract until such time as the Contractor brings itself into full compliance with the Contract.

E. Any action on the part of the Agency, or dispute of action by the Contractor, shall be in accordance with the provisions of Md. Code Ann., State Finance and Procurement Article §§

15-215 through 15-223 and with COMAR 21.10.04.

F. The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of Columbia sales taxes and transportation taxes. The Contractor; however, is not exempt from such sales and use taxes and may be liable for the same.

mailto:rdiehl@sra.state.md.us

RFP for Maryland State Retirement Agency Page 11 of 81

G. Invoices for final payment shall be clearly marked as “FINAL” and submitted when all work requirements have been completed and no further charges are to be incurred under the

Contract. In no event shall any invoice be submitted later than 60 calendar days from the

Contract termination date.

3.3.2 Invoice Submission Schedule

The Contractor shall submit invoices in accordance with the following schedule:

A. For items of work for which there is one-time pricing (see Attachment B – Financial

Proposal Form) those items shall be billed in the month following the acceptance of the work by the Agency.

B. For items of work for which there is annual pricing, (see Attachment B– Financial Proposal

Form), those items shall be billed in equal monthly installments for the applicable Contract year in the month following the performance of the services.

C. For services for which there is ongoing monthly pricing based on usage (see Attachment B

– Financial Proposal Form) those items shall be billed in the month following the delivery of service to the Agency.

3.3.3 For the purposes of the Contract an amount will not be deemed due and payable if:

A. The amount invoiced is inconsistent with the Contract;

B. The proper invoice has not been received by the party or office specified in the Contract;

C. The invoice or performance is in dispute or the Contractor has failed to otherwise comply with the provisions of the Contract;

D. The item or services have not been accepted;

E. The quantity of items delivered is less than the quantity ordered;

F. The items or services do not meet the quality requirements of the Contract;

G. If the Contract provides for progress payments, the proper invoice for the progress payment has not been submitted pursuant to the schedule;

H. If the Contract provides for withholding a retainage and the invoice is for the retainage, all stipulated conditions for release of the retainage have not been met; or

I. The Contractor has not submitted satisfactory documentation or other evidence reasonably required by the Procurement Officer or by the Contract concerning performance under the

Contract and compliance with its provisions.

3.3.4 Travel Reimbursement

Travel will not be reimbursed under this RFP.

3.4 Liquidated Damages

3.4.1 MBE Liquidated Damages

Inapplicable because there is no MBE goal for this RFP.

3.4.2 Liquidated Damages other than MBE

THIS SECTION IS INAPPLICABLE TO THIS RFP.

RFP for Maryland State Retirement Agency Page 12 of 81

3.5 Disaster Recovery and Data

The following requirements apply to the Contract:

3.5.1 Redundancy, Data Backup and Disaster Recovery

A. Unless specified otherwise in the RFP, Contractor shall maintain or cause to be maintained disaster avoidance procedures designed to safeguard Agency data and other confidential information, Contractor’s processing capability and the availability of hosted services, in each case throughout the Contract term. Any force majeure provisions of the Contract do not limit the Contractor’s obligations under this provision.

B. The Contractor shall have robust contingency and disaster recovery (DR) plans in place to ensure that the services provided under the Contract will be maintained in the event of disruption to the Contractor/subcontractor’s operations (including, but not limited to, disruption to information technology systems), however caused.

1) The Contractor shall furnish a DR site.

2) The DR site shall be at least 100 miles from the primary operations site and have the capacity to take over complete production volume in case the primary site becomes unresponsive.

C. The contingency and DR plans must be designed to ensure that services under the Contract are restored after a disruption within twenty-four (24) hours from notification and a recovery point objective of one (1) hour or less prior to the outage in order to avoid unacceptable consequences due to the unavailability of services.

D. The Contractor shall test the contingency/DR plans at least twice annually to identify any changes that need to be made to the plan(s) to ensure a minimum interruption of service.

Coordination shall be made with the State to ensure limited system downtime when testing is conducted. At least one (1) annual test shall include backup media restoration and failover/fallback operations at the DR location. The Contractor shall send the Contract

Monitor a notice of completion following completion of DR testing.

E. Such contingency and DR plans shall be available for the Agency to inspect and practically test at any reasonable time, and subject to regular updating, revising, and testing throughout the term of the Contract.

3.5.2 Data Export/Import

THIS SECTION IS INAPPLICABLE TO THIS RFP.

3.5.3 Data Ownership and Access

A. Data, databases and derived data products created, collected, manipulated, or directly purchased as part of a RFP are the property of the State. The purchasing State agency is considered the custodian of the data and shall determine the use, access, distribution and other conditions based on appropriate State statutes and regulations.

B. Public jurisdiction user accounts and public jurisdiction data shall not be accessed, except

(1) in the course of data center operations, (2) in response to service or technical issues, (3) as required by the express terms of the Contract, including as necessary to perform the services hereunder or (4) at the State’s written request.

C. The Contractor shall limit access to and possession of State data to only Contractor

Personnel whose responsibilities reasonably require such access or possession and shall train such Contractor Personnel on the confidentiality obligations set forth herein.

RFP for Maryland State Retirement Agency Page 13 of 81

D. At no time shall any data or processes – that either belong to or are intended for the use of the State or its officers, agents or employees – be copied, disclosed or retained by the

Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the State.

E. The Contractor shall not use any information collected in connection with the services furnished under the Contract for any purpose other than fulfilling such services.

3.5.4 Provisions in Sections 3.5.1 – 3.5.3 shall survive expiration or termination of the Contract.

Additionally, the Contractor shall flow down the provisions of Sections 3.5.1-3.5.3 (or the substance thereof) in all subcontracts.

3.6 Insurance Requirements

The Contractor shall maintain, at a minimum, the insurance coverages outlined below, or any minimum requirements established by law if higher, for the duration of the Contract, including option periods, if exercised:

3.6.1 The following type(s) of insurance and minimum amount(s) of coverage are required:

A. Commercial General Liability – of $1,000,000 combined single limit per occurrence for bodily injury, property damage, and personal and advertising injury and $3,000,000 annual aggregate. The minimum limits required herein may be satisfied through any combination of primary and umbrella/excess liability policies.

B. Errors and Omissions/Professional Liability - $1,000,000 per combined single limit per claim and $3,000,000 annual aggregate.

C. Cyber Security / Data Breach Insurance

The Contractor shall possess and maintain throughout the Term and for three (3) years thereafter, cyber risk/ data breach insurance (either separately or as part of a broad

Professional Liability or Errors and Omissions Insurance) with limits of at least US

$1,000,000 (one million dollars) per claim. Any “insured vs. insured” exclusions will be modified accordingly to allow the State additional insured status without prejudicing the

State’s rights under the policy (ies). Coverage shall be sufficiently broad to respond to the

Contractor’s duties and obligations under the Contract and shall include, but not be limited to, claims involving privacy violations, information theft, damage to or destruction of electronic information, the release of Sensitive Data, and alteration of electronic information, extortion, and network security. The policy shall provide coverage for, not by way of limitation, breach response costs as well as regulatory fines and penalties as well as credit monitoring expenses with limits sufficient to respond to these obligations.

3.6.2 The State shall be listed as an additional insured on the faces of the certificates associated with the coverages listed above, including umbrella policies, excluding Workers’ Compensation

Insurance and professional liability.

3.6.3 All insurance policies shall be endorsed to include a clause requiring the insurance carrier provide the Procurement Officer, by certified mail, not less than 30 days’ advance notice of any non-renewal, cancellation, or expiration. The Contractor shall notify the Procurement Officer in writing, if policies are cancelled or not renewed within five (5) days of learning of such cancellation or nonrenewal. The Contractor shall provide evidence of replacement insurance coverage to the Procurement Officer at least 15 days prior to the expiration of the insurance policy then in effect.

RFP for Maryland State Retirement Agency Page 14 of 81

3.6.4 Any insurance furnished as a condition of the Contract shall be issued by a company authorized to do business in the State.

3.6.5 The recommended awardee(s) must provide current certificate(s) of insurance with the prescribed coverages, limits and requirements set forth in this section within five (5) Business Days from notice of recommended award. During the period of performance for multi-year contracts, the

Contractor shall provide certificates of insurance annually, or as otherwise directed by the

Contract Monitor.

3.7 Security Requirements

The following requirements are applicable to the Contract:

3.7.1 Employee Identification

A. Contractor Personnel shall display his or her company ID badge in a visible location at all times while on State premises. Upon request of authorized State personnel, each Contractor

Personnel shall provide additional photo identification.

B. Contractor Personnel shall cooperate with State site requirements, including but not limited to, being prepared to be escorted at all times, and providing information for State badge issuance.

C. Contractor shall remove any Contractor Personnel from working on the Contract where the

State determines, in its sole discretion that Contractor Personnel has not adhered to the

Security requirements specified herein.

D. The State reserves the right to request that the Contractor submit proof of employment authorization of non-United States Citizens, prior to commencement of work under the

Contract.

3.7.2 Security Clearance / Criminal Background Check

The Contractor shall provide certification to the Agency that the Contractor has completed the required criminal background check described in this RFP for each required Contractor Personnel prior to assignment, and that the Contractor Personnel have successfully passed this check.

3.7.3 On-Site Security Requirement(s)

THIS SECTION IS INAPPLICABLE TO THIS RFP.

3.7.4 Information Technology

The Contractor shall:

1) Implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security such as those listed below (see Section 3.7.5);

2) Ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of the Contract; and

3) The Contractor, and Contractor Personnel, shall (i) abide by all applicable federal, State and local laws, rules and regulations concerning security of Information

Systems and Information Technology and (ii) comply with and adhere to the State

IT Security Policy and Standards as each may be amended or revised from time to

RFP for Maryland State Retirement Agency Page 15 of 81 time. Updated and revised versions of the State IT Policy and Standards are available online at: www.doit.maryland.gov – keyword: Security Policy.

3.7.5 Data Protection and Controls

A. Contractor shall ensure a secure environment for all State data and any hardware and software

(including but not limited to servers, network and data components) provided or used in connection with the performance of the Contract and shall apply or cause application of appropriate controls so as to maintain such a secure environment (“Security Best Practices”).

Such Security Best Practices shall comply with an accepted industry standard, such as the

NIST cybersecurity framework.

B. To ensure appropriate data protection safeguards are in place, the Contractor shall implement and maintain the following controls at all times throughout the Term of the Contract (the

Contractor may augment this list with additional controls):

1) Establish separate production, test, and training environments for systems supporting the services provided under the Contract and ensure that production data is not replicated in test or training environment(s) unless it has been previously anonymized or otherwise modified to protect the confidentiality of Sensitive Data elements. The Contractor shall ensure the appropriate separation of production and non-production environments by applying the data protection and control requirements listed in Section 3.7.5.

2) Apply hardware and software hardening procedures as recommended by Center for

Internet Security (CIS) guides https://www.cisecurity.org/, Security Technical

Implementation Guides (STIG) http://iase.disa.mil/Pages/index.aspx, or similar industry best practices to reduce the systems’ surface of vulnerability, eliminating as many security risks as possible and documenting what is not feasible or not performed according to best practices. Any hardening practices not implemented shall be documented with a plan of action and milestones including any compensating control. These procedures may include but are not limited to removal of unnecessary software, disabling or removing unnecessary services, removal of unnecessary usernames or logins, and the deactivation of unneeded features in the

Contractor’s system configuration files.

3) Ensure that State data is not comingled with non-State data through the proper application of compartmentalization Security Measures.

4) Apply data encryption to protect Sensitive Data at all times, including in transit, at rest, and also when archived for backup purposes. Unless otherwise directed, the

Contractor is responsible for the encryption of all Sensitive Data.

5) For all State data the Contractor manages or controls, data encryption shall be applied to such data in transit over untrusted networks.

6) Encryption algorithms which are utilized for encrypting data shall comply with current Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules”, FIPS PUB 140-2:

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm

7) Enable appropriate logging parameters to monitor user access activities, authorized and failed access attempts, system exceptions, and critical information security http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf…