SRA 23-16 Election Services IFB.pdf

ELECTION SERVICES

Solicitation #: SRA 23-16 IFB Document

IFB for Maryland State Retirement Agency Page i of 72

STATE OF MARYLAND

MARYLAND STATE RETIREMENT AGENCY (SRA)

INVITATION FOR BIDS (IFB)

IFB NUMBER SRA 23-16

ISSUE DATE:

DECEMBER 2, 2022

NOTICE

A Prospective Bidder that has received this document from a source other than eMarylandMarketplace

(eMMA) https://procurement.maryland.gov should register on eMMA. See Section 4.2.

MINORITY BUSINESS ENTERPRISES ARE ENCOURAGED TO

RESPOND TO THIS SOLICITATION.

IFB for Maryland State Retirement Agency Page ii of 72

NO BID NOTICE/VENDOR FEEDBACK FORM

To help us improve the quality of State solicitations, and to make our procurement process more responsive and business friendly, please provide comments and suggestions regarding this solicitation.

Please return your comments with your response. If you have chosen not to respond to this solicitation, please email or fax this completed form to the attention of the Procurement Officer (see Key

Information Summary Sheet below for contact information).

Title: ELECTION SERVICES

Solicitation No: SRA 23-16

1. If you have chosen not to respond to this solicitation, please indicate the reason(s) below:

Other commitments preclude our participation at this time

The subject of the solicitation is not something we ordinarily provide

We are inexperienced in the work/commodities required

Specifications are unclear, too restrictive, etc. (Explain in REMARKS section)

The scope of work is beyond our present capacity

Doing business with the State is simply too complicated. (Explain in REMARKS section)

We cannot be competitive. (Explain in REMARKS section)

Time allotted for completion of the Bid is insufficient

Start-up time is insufficient

Bonding/Insurance requirements are restrictive (Explain in REMARKS section)

Bid requirements (other than specifications) are unreasonable or too risky (Explain in

REMARKS section)

MBE or VSBE requirements (Explain in REMARKS section)

Prior State of Maryland contract experience was unprofitable or otherwise unsatisfactory.

(Explain in REMARKS section)

Payment schedule too slow

Other: __________________________________________________________________

2. If you have submitted a response to this solicitation, but wish to offer suggestions or express concerns, please use the REMARKS section below. (Attach additional pages as needed.)

REMARKS:

Vendor Name: ________________________________ Date: _______________________

Contact Person: _________________________________ Phone (____) _____ - _________________

Address: ______________________________________________________________________

E-mail Address: ________________________________________________________________

IFB for Maryland State Retirement Agency Page iii of 72

STATE OF MARYLAND

MARYLAND STATE RETIREMENT AGENCY (SRA)

KEY INFORMATION SUMMARY SHEET

Invitation for Bids Services - ELECTION SERVICES

Solicitation Number: SRA 23-16

IFB Issue Date: December 2, 2022

IFB Issuing Office: Maryland State Retirement Agency (MSRA or the "Agency")

Procurement Officer: Jane Noble

Maryland State Retirement Agency

120 East Baltimore Street

Baltimore, Maryland 21202 e-mail:

Office Phone:

procurement@sra.state.md.us

(410) 625-5660

Bids are to be sent to: Submit Via eMMA

Pre-Bid Conference (virtual): December 13, 2022, 10:00 A.M. Local Time

Via Microsoft Team Online Conference

See Attachment A for instructions.

Questions Due Date and Time December 27, 2022, 10:00 A.M. Local Time

Bid Due (Closing) Date and

Time:

December 28, 2022, 10:00 A.M. Local Time

Bidders are reminded that a completed Feedback Form is requested if a no-bid decision is made (see page ii).

Public Bid Opening Date, Time and Location

December 28, 2022, 2:00 P.M. Local Time

Via Microsoft Team Online Conference

Contact Procurement@sra.state.md.us for info on how to attend

Virtual Meeting.

MBE Subcontracting Goal: 0 %

VSBE Subcontracting Goal: 0 %

Contract Type: Firm Fixed-Price Contract (per COMAR 21.06.03.03.B (1))

Contract Duration: One Year with no renewal options

Primary Place of

Performance:

Maryland State Retirement Agency

120 E. Baltimore Street, 16th Floor

Baltimore, MD 21202

SBR Designation: No

Federal Funding: No mailto:Procurement@sra.state.md.us

IFB for Maryland State Retirement Agency Page iv of 72

TABLE OF CONTENTS – IFB

1 Minimum Qualifications

1.1 Bidder Minimum Qualifications

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.2 Background and Purpose

2.3 Requirements and Tasks

3 Contractor Requirements: General

3.1 Contract Initiation Requirements

3.2 End of Contract Transition

3.3 Invoicing

3.4 Liquidated Damages

3.5 Disaster Recovery and Data

3.6 Insurance Requirements

3.7 Security Requirements

3.8 Problem Escalation Procedure

3.9 SOC 2 Type 2 Audit Report

3.10 Minority Business Enterprise (MBE) Reports

3.11 Veteran Small Business Enterprise (VSBE) Reports

3.12 Work Orders

3.13 No-Cost Extensions

4 Procurement Instructions

4.1 Pre-Bid Conference

4.2 eMaryland Marketplace Advantage (eMMA)

4.3 Questions

4.4 Procurement Method

4.5 Bid Due (Closing) Date and Time

4.6 Multiple or Alternate Bids

4.7 Receipt, Opening and Recording of Bids

4.8 Confidentiality of Bids / Public Information Act Notice

4.9 Award Basis

4.10 Tie Bids

4.11 Duration of Bids

IFB for Maryland State Retirement Agency Page v of 72

4.12 Revisions to the IFB

4.13 Cancellations

4.14 Incurred Expenses

4.15 Protest/Disputes

4.16 Bidder Responsibilities

4.17 Acceptance of Terms and Conditions

4.18 Bid/Proposal Affidavit

4.19 Contract Affidavit

4.20 Compliance with Laws/Arrearages

4.21 Verification of Registration and Tax Payment

4.22 False Statements

4.23 Payments by Electronic Funds Transfer

4.24 Prompt Payment Policy

4.25 Electronic Procurements Authorized

4.26 MBE Participation Goal

4.27 VSBE Participation Goal

4.28 Living Wage Requirements

4.29 Federal Funding Acknowledgement

4.30 Conflict of Interest Affidavit and Disclosure

4.31 Non-Disclosure Agreement

4.32 HIPAA - Business Associate Agreement

4.33 Nonvisual Access

4.34 Mercury and Products That Contain Mercury

4.35 Location of the Performance of Services Disclosure

4.36 Department of Human Services (DHS) Hiring Agreement

4.37 Small Business Reserve (SBR) Procurement

4.38 Maryland Healthy Working Families Act Requirements

5 Bid Format

5.1 One Part Submission

5.2 Labeling

5.3 Bid Price Form

5.4 Required Bid Submission

5.5 Delivery

5.6 Documents Required upon Notice of Recommendation for Contract Award

IFB for Maryland State Retirement Agency Page vi of 72

6 Bid Evaluation and Award

6.1 Bid Evaluation Criteria

6.2 Reciprocal Preference

6.3 Award Determination

6.4 Documents Required upon Notice of Recommendation for Contract Award

7 IFB ATTACHMENTS AND APPENDICES

Attachment A. Pre-Bid Conference Response Form

Attachment B. Bid Instructions & Form

Attachment C. Bid/Proposal Affidavit

Attachment D. Minority Business Enterprise (MBE) Forms

Attachment E. Veteran-Owned Small Business Enterprise (VSBE) Forms

Attachment F. Maryland Living Wage Affidavit of Agreement for Service Contracts

Attachment G. Federal Funds Attachments

Attachment H. Conflict of Interest Affidavit and Disclosure

Attachment I. Non-Disclosure Agreement (Contractor)

Attachment J. HIPAA Business Associate Agreement

Attachment K. Mercury Affidavit

Attachment L. Location of the Performance of Services Disclosure

Attachment M. Contract

Attachment N. Contract Affidavit

Attachment O. DHS Hiring Agreement

Attachment P. Board of Trustees Election Schedule

Appendix 1. – Abbreviations and Definitions

Appendix 2. – Bidder Information Sheet

IFB for Maryland State Retirement Agency Page 1 of 72

1 Minimum Qualifications

1.1 Bidder Minimum Qualifications

To be considered reasonably susceptible of being selected for award, the Bidder must document in its Bid that it satisfies the following Minimum Qualifications:

1.1.1 The Bidder shall have no less than two (2) years’ experience within the past five (5) years in providing election services using an Integrated Voice Response (IVR) system, paper ballots, and electronic voting via the internet for a minimum of 100,000 voters.

Required Documentation: As proof of meeting this requirement, the Bidder shall provide with its

Bid three (3) references that collectively attest that the Bidder has met this requirement. For each reference, Bidder must provide:

1.1.1.1 Client name and contact information (phone number, email address),

1.1.1.2 How many voters,

1.1.1.3 Type of election services provided (IVR, paper ballots, electronic voting via internet), and

1.1.1.4 Duration of contract or other engagement.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

IFB for Maryland State Retirement Agency Page 2 of 72

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.1.1 The Maryland State Retirement Agency (SRA or the "Agency") is issuing this Invitation for Bids

(IFB) in order to procure the services defined in this Section 2, as specified in this IFB, from a contract between the successful bidder(s) and the Maryland State Retirement Agency. The

Contractor is to provide a secret ballot election for the election of two members to the Board of

Trustees for the Maryland State Retirement and Pension System if such elections are required. If such elections are not required, the Agency reserves the right to terminate its contract with the successor bidder, in accordance with Attachment M, paragraph 18.

2.1.2 It is the State’s intention to obtain goods and services, as specified in this IFB, from a Contract between the selected Bidder and the State.

2.1.3 The Agency intends to make a single award for the work under this IFB. See IFB Section 4.9

Award Basis for more Contract award information.

2.1.4 A Bidder, either directly or through its subcontractor(s), must be able to provide all goods and services and meet all of the requirements requested in this solicitation and the successful Bidder

(the Contractor) shall remain responsible for Contract performance regardless of subcontractor participation in the work.

2.2 Background and Purpose

The Maryland State Retirement Agency administers the Maryland State Retirement and Pension System

(“MSRPS”), which consists of several qualified governmental defined benefit retirement plans for public sector employees throughout the State of Maryland. The System provides retirement allowances and other benefits to State employees, teachers, judges, legislators, state police, law enforcement officers, correctional officers, and employees of participating governmental units (PGUs), participating municipal corporations, local boards of education, libraries, and community colleges within the State. The combined systems’ net assets held in trust to pay pension benefits now total approximately $67.6 billion as of June 30, 2021.

Additionally, the System has in excess of 363,000 participants, of which approximately 194,000 are active members, administered by a full-time staff of approximately 200 employees. Responsibility for the

System’s administration and operations is vested in a 15-member Board of Trustees (Board) made up of public officials, elected representatives of State employees and retirees, and appointed representatives of participating governmental units and the public.

2.2.1 Project Goals

In accordance with SPP §21-104 and Code of Maryland Regulations 22.03.01, the Agency is issuing this solicitation to obtain a Contractor to provide election services for two secret ballot elections. These elections are for two members for the Board of Trustees for the Maryland State Retirement and Pension

System. A secret ballot election is only required when there is more than one candidate for an office. To lower costs and encourage greater participation, the Contractor must have the capability to utilize electronic methods of voting, using both the internet and an interactive voice response (IVR) telephone system. It is anticipated that a small portion of the population will vote by paper ballot only. However, the selected

Contractor must have the capability to conduct an election entirely via paper ballots, if necessary. The

Contractor shall make certain that proper controls are utilized to ensure the integrity of the election, as further explained in the IFB.

2.3 Requirements and Tasks

2.3.1 Agency Requirements

IFB for Maryland State Retirement Agency Page 3 of 72

2.3.1.1 Appoint a Contract Manager. The Contract Manager shall be assigned to represent the

Agency, be responsible for oversight of the Election Services, and be available on a daily basis to address any and all concerns regarding this agreement. The Contract Manager shall coordinate and manage all activity, services, and deliverables associated with this

Agreement. The Agency may replace the Contract Manager with written notice to the

Contractor.

2.3.1.2 Provide an Electronic Data File to the Contractor by March 24, 2023:

2.3.1.2.1 The data file shall be in Microsoft Excel 2019 (.xls), Plain-Text (.txt) or XML format

(.xml) and shall be agreed upon by both parties.

2.3.1.2.2 The size of the data file may vary depending upon the number of eligible voters in the election; however, the Contractor should be aware that the data file may contain as many as 400,000 records.

2.3.1.2.3 The Agency will upload the data file to a secure website that the Contractor provides and maintains.

2.3.1.2.4 The data file will contain at least the following information: the eligible voter’s first and last name, address (including street, city, state and zip code), birth date (mm/dd/yyyy), gender, SRA System, SRA location, SRA Status and the last 4 digits of his or her Social

Security Number.

2.3.1.3 Provide a bulk mailing permit for all domestic mailings.

2.3.1.4 Provide the Contractor with an electronic copy of the ballot to be mailed.

2.3.1.5 Approve the voter ballot packet and voter notification packet (see 3.2.2.6) within 7 days of receipt from the Contractor.

2.3.1.6 Provide the names and biographies of the candidates for election to the Contractor by March

6, 2023, or no later than 7 days after the ratification of this agreement, whichever is later.

The candidate’s names and biographies shall be provided to the Contractor via an e-mail message.

2.3.1.7 Perform a test of the IVR and website using the PINs provided by the Contractor.

2.3.1.8 Review all questionable ballots and provide instructions to the Contractor as to how those ballots shall be handled.

2.3.1.9 Notify the Contractor no later than August 5, 2023, if a recount of ballots is required.

2.3.2 Contractor Requirements

The Contractor must:

2.3.2.1 Appoint an Account Manager. The Account Manager shall be assigned to represent the

Contractor, be responsible for oversight of the Election Services, and be available on a daily basis to address any and all concerns regarding this Agreement. The Account Manager shall coordinate and manage all activity, services, and deliverables associated with this

Agreement. The Account Manager shall not be replaced or removed from this position without the written consent of the Contract Manager.

2.3.2.2 Appoint a Back-up Contact to assume the duties of the Account Manager in his/her absence.

IFB for Maryland State Retirement Agency Page 4 of 72

2.3.2.3 Provide all the equipment, computer software and staffing necessary to receive and calculate ballots through both an Interactive Voice Response (IVR) system and the internet, and, as needed, paper ballots.

2.3.2.4 Have the capability to conduct an election entirely via paper ballots in the event that the

Board of Trustees revokes its authorization to conduct electronic balloting at any time before or during the course of this Agreement.

2.3.2.5 Ensure that the notification packets are constructed in such a way that the packets do not weigh more than one ounce.

2.3.2.6 Mail the Notification Packet to all eligible voters. This packet should notify the eligible voters of any pertinent details concerning the election, which includes voting dates, assigned identification number and PIN number; and instructions on how to vote by IVR telephone system or through the internet. The notification packet will consist of a personalized letter and voting instructions printed front and back of an 8 ½” x 11” sheet of paper and also include contact information for customer support in the event that assistance is required.

The notification packet shall also include a candidate biography page that will be printed on

8 ½” x 11” letter sized paper, depending on the number of candidates this could be printed front and back or on multiple sheets of “8 ½ x 11” paper.

2.3.2.7 Provide all paper stock and other printing supplies.

2.3.2.8 Sort in zip code order the notification packets, stuffed in the correct envelopes, and sealed.

Envelopes must be metered and barcoded prior to placing them in approved mail trays, which the Contractor can obtain from any United States Postal Office facility free of charge.

Envelopes must be pre-sorted to maximize the postage discount.

2.3.2.9 Comply with all current United States Postal Service requirements including, but not limited to, Coding Accuracy Support System (CASS) certification.

2.3.2.10 Deliver the presorted envelopes in the approved First-Class mail trays to the Business Entry location at the main Baltimore, Maryland United States Post Office located at 900 East

Fayette Street, Baltimore, MD 21202.

2.3.2.11 Provide copies of the United States Postal Service Mailing Transaction Receipt form 3607R and the Postage Statement-First Class Mail and First-Class Package Service Receipt form

3600-FCM for proof of delivery to the required post office. A copy of these proofs of delivery must be scanned and emailed to the Agency’s Contract Manager within 3 business days of completion.

2.3.2.12 Provide customer support during the voting period to address technical or miscellaneous issues. At a minimum, customer support must include:

2.3.2.12.1 A toll-free customer support telephone line staffed with live representatives that are available to speak with members Monday through Friday throughout the hours of

8:00am and 6:00pm EST during the voting period.

2.3.2.12.2 A voice mail service for calls received outside of the hours of Monday through Friday

8:00 am to 6:00 pm EST; and

IFB for Maryland State Retirement Agency Page 5 of 72

2.3.2.12.3 Assistance via electronic mail.

At no time should customer service address the candidates or the election in general.

2.3.2.13 Ensure the election web application and/or the IVR contain the following features and requirements to ensure the Agency’s expectations are met regarding the voters’ web and

IVR experience with respect to data confidentiality, availability, usability, stability, etc.

2.3.2.13.1 Ensure the election website is compatible with most versions of commonly used web browser software (e.g., Internet Explorer, Mozilla Firefox, Safari, Opera, Google

Chrome, etc.).

2.3.2.13.2 Ensure the election website and IVR system allow the voter to re-authenticate if the voter fails to successfully cast his/her vote either during the initial or subsequent attempts.

2.3.2.13.3 Ensure the voter ID will be locked out and prevented from authentication to the website and IVR after four (4) unsuccessful attempts. Voters who are locked out must contact the Contractor to verify their identity.

2.3.2.13.4 Actively monitor the election website and IVR to prevent any loss of data confidentiality, integrity, or availability due to Internet-born attacks or hacking attempts.

2.3.2.13.5 Ensure the application will be specifically protected from known security vulnerabilities such as SQL injection and Cross-site scripting (XSS) type attacks, through a regular regime of application testing.

2.3.2.13.6 Ensure the electronic voting application integrates non-repudiation protections designed to positively identify each voter and record all actions associated with his/her voting selections, through system auditing and logging mechanisms. Applicable logging mechanisms shall be in place to record voter activities beginning at the authentication process at the web interface, downstream through the application tiers, and concluding at the backend database where the final votes are tabulated and stored.

2.3.2.13.7 Set-up a test walk through of the IVR and website no later than April 10, 2023. This includes providing the Agency with test PIN numbers to log into the IVR and website and cast a test ballot in each. These ballots shall not be counted with the actual ballots cast.

2.3.2.13.8 Preserve and protect database server logs containing authentication and voter transaction information during the election. The Contractor must make the logs available to the Agency after the election.

2.3.2.13.9 Forward all questionable ballots to the Contract Manager as they are received.

IFB for Maryland State Retirement Agency Page 6 of 72

2.3.2.13.10 Email notification packets to verified eligible voters with valid email addresses if the original mailed packet is returned. If a valid e-mail address is not provided, then re-mail the notification packet to the eligible voter. The Contractor shall maintain a log of eligible voters that were emailed information from the Contractor.

2.3.2.13.11 Employ a balloting system that contains safeguards against ballot tampering.

2.3.2.13.12 Assure that the identities of voters are not revealed, and that each voter is eligible to vote in the election, and that each voter casts only one valid ballot.

2.3.2.13.13 Add the individual voter identification numbers, PINs, and the voting instructions to the Agency-supplied electronic notification packet. The Contractor shall submit a sample of the completed notification packet to the Contract Manager for approval no later than 7 days after receipt of the electronic notification packet from the Agency.

Once the packet has been approved by the Agency’s Contract Manager, the Contractor shall print and mail the notification packets as per the Agency Election Schedule (see

Attachment P):

2.3.2.13.13.1 The purpose of the notification packet is to notify the eligible voters of any pertinent details concerning the election.

2.3.2.13.13.2 The notification packet should clearly communicate the following: the voting dates; the assigned identification number and PIN number; and instructions on how to vote by telephone (IVR) or through the internet.

2.3.2.13.13.3 The notification packet shall include a candidate biography page and shall be printed on 8 ½” x 11” letter sized paper. The Contractor should be aware that the notification packet may require more than one page. The length of the letter may vary with the number of candidates for election.

2.3.2.13.14 The notification packet shall also include contact information for customer support in the event that assistance is required.

2.3.2.14 Ensure that the scheduled mailing shall be mailed on the same date according to the schedule developed by the Agency.

2.3.2.15 Provide an analysis of general voter statistics by June 30, 2023, as follows:

2.3.2.15.1 The analysis shall include, but is not necessarily limited to, the total number of ballots cast, total number of invalid ballots, total number of questionable ballots, total valid ballots, and total ballots returned by the USPS as undeliverable.

2.3.2.15.2 Provide a breakdown of the number of voters by age, status, and employer location code.

2.3.2.15.3 Provide a report of the activity generated from the customer service system, including, but not limited to, inbound calls and e-mails received from voters. These reports shall

IFB for Maryland State Retirement Agency Page 7 of 72 detail any work orders or trouble tickets generated, a description of the problems identified, and the solutions used to resolve said problems.

2.3.2.15.4 Submit the aforementioned reports in an electronic file format, or through a secure website. The use of spreadsheets, charts, or graphs to illustrate data is encouraged.

2.3.2.16 Provide a process for the validation of all ballots.

2.3.2.16.1 A valid ballot is a ballot cast by an eligible voter during the voting period.

2.3.2.16.2 A questionable ballot is a ballot in which the Contractor or Contractor’s personnel is unable to match the voter’s identification number with the list of eligible voters provided by the Agency. A ballot is also questionable if an eligible voter submits multiple votes.

2.3.2.16.3 An invalid ballot is a ballot in which the candidate designated by an eligible voter cannot be determined and a ballot in which more than one candidate is designated in the same election.

2.3.2.16.4 Forward all invalid and questionable ballots to the Contract Manager for review.

2.3.2.17 Submit to the Executive Director of the Agency, no later than July 7, 2023, a tabulation of the ballots, which shall include a certification of the validity and accuracy of the results.

The tabulation shall also include the total number of valid ballots cast and the total number of valid ballots cast for each candidate.

2.3.2.18 Retain and preserve all voting records for a period of 45 days following the announcement of the results. After the retention period has expired, the Contractor shall destroy all records of the election and certify to the Agency that no eligible voters’ names, addresses or any other confidential information has been retained.

2.3.2.19 Provide for a recount of the ballots in the event of a timely challenge to the certified election results by an unsuccessful candidate.

2.3.2.20 Communicate immediately to the Contract Manager, either orally or in writing, any problems encountered during the election or the tabulation of ballots:

2.3.2.20.1 Notification by telephone is considered as acceptable oral communication and a statement via electronic mail is considered acceptable written communication.

2.3.2.20.2 Examples of problems that must be reported immediately include, but are not limited to, breach of data security, delays in the mailing of letters or ballots, internet or IVR telephone system inaccessibility or inoperability, and difficulty among the voters with logging into the website or the IVR telephone systems.

IFB for Maryland State Retirement Agency Page 8 of 72

3 Contractor Requirements: General

3.1 Contract Initiation Requirements

THIS SECTION IS INAPPLICABLE TO THIS IFB.

3.2 End of Contract Transition

3.2.1 Return and Maintenance of State Data

a) Upon termination or the expiration of the Contract Term, the Contractor shall: (a) return to the State all State data in either the form it was provided to the Contractor or in a mutually agreed format along with the schema necessary to read such data; (b) preserve, maintain, and protect all State data until the earlier of a direction by the State to delete such data or the expiration of 90 days (“the retention period”) from the date of termination or expiration of the Contract term; (c) after the retention period, the Contractor shall securely dispose of and permanently delete all State data in all of its forms, such as disk, CD/DVD, backup tape and paper such that it is not recoverable, according to National Institute of Standards and

Technology (NIST)-approved methods with certificates of destruction to be provided to the

State; and (d) prepare an accurate accounting from which the State may reconcile all outstanding accounts. The final monthly invoice for the services provided hereunder shall include all charges for the 90-day data retention period.

b) During any period of service suspension, the Contractor shall maintain all State data in its then existing form, unless otherwise directed in writing by the Contract Monitor.

c) In addition to the foregoing, the State shall be entitled to any post-termination/expiration assistance generally made available by Contractor with respect to the services.

3.3 Invoicing

3.3.1 General

a) The Contractor shall e-mail the original of each invoice and signed authorization to invoice to the Contract Monitor Angie Jenkins at e-mail address: (ajenkins@sra.state.md.us) with a copy to (procurement@sra.state.md.us).

b) All invoices for services shall be verified by the Contractor as accurate at the time of submission.

c) An invoice not satisfying the requirements of a Proper Invoice (as defined at COMAR

21.06.09.01 and .02) cannot be processed for payment. To be considered a Proper Invoice, invoices must include the following information, without error:

1) Contractor name and address

2) Remittance address

3) Federal taxpayer identification (FEIN) number, social security number, as appropriate

4) Invoice period (i.e., time period during which services covered by invoice were performed);

5) Invoice date

6) Invoice number

7) State assigned Contract number mailto:ajenkins@sra.state.md.us mailto:procurement@sra.state.md.us

IFB for Maryland State Retirement Agency Page 9 of 72

8) State assigned (Blanket) Purchase Order number(s)

9) Goods or services provided

10) Amount due; and

11) Any additional documentation required by regulation or the Contract.

d) Invoices that contain both fixed price and time and material items shall clearly identify each item as either fixed price or time and material billing.

e) The Agency reserves the right to reduce or withhold Contract payment in the event the

Contractor does not provide the Agency with all required deliverables within the time frame specified in the Contract or otherwise breaches the terms and conditions of the Contract until such time as the Contractor brings itself into full compliance with the Contract.

f) Any action on the part of the Agency, or dispute of action by the Contractor, shall be in accordance with the provisions of Md. Code Ann., State Finance and Procurement Article §§

15-215 through 15-223 and with COMAR 21.10.04.

g) The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of Columbia sales taxes and transportation taxes. The Contractor, however, is not exempt from such sales and use taxes and may be liable for the same.

h) Invoices for final payment shall be clearly marked as “FINAL” and submitted when all work requirements have been completed and no further charges are to be incurred under the

Contract. In no event shall any invoice be submitted later than 60 calendar days from the

Contract termination date.

3.3.2 Invoice Submission Schedule

The Contractor shall submit invoices in accordance with the following schedule:

a) For items of work for which there is one-time pricing (see Attachment B –Bid Form) those items shall be billed in the month following the acceptance of the work by the Agency.

3.3.3 For the purposes of the Contract an amount will not be deemed due and payable if:

a) The amount invoiced is inconsistent with the Contract

b) The proper invoice has not been received by the party or office specified in the Contract

c) The invoice or performance is in dispute, or the Contractor has failed to otherwise comply with the provisions of the Contract

d) The item or services have not been accepted

e) The quantity of items delivered is less than the quantity ordered

f) The items or services do not meet the quality requirements of the Contract

g) If the Contract provides for progress payments, the proper invoice for the progress payment has not been submitted pursuant to the schedule

h) If the Contract provides for withholding a retainage and the invoice is for the retainage, all stipulated conditions for release of the retainage have not been met; or

i) The Contractor has not submitted satisfactory documentation or other evidence reasonably required by the Procurement Officer or by the Contract concerning performance under the

Contract and compliance with its provisions.

IFB for Maryland State Retirement Agency Page 10 of 72

3.3.4 Travel Reimbursement

Travel will not be reimbursed under this IFB.

3.4 Liquidated Damages

3.4.1 MBE Liquidated Damages

Inapplicable because there is no MBE goal for this IFB.

3.4.2 Liquidated Damages other than MBE

THIS SECTION IS INAPPLICABLE TO THIS IFB.

3.5 Disaster Recovery and Data

The following requirements apply to the Contract:

3.5.1 Redundancy, Data Backup and Disaster Recovery

a) Unless specified otherwise in the IFB, Contractor shall maintain or cause to be maintained disaster avoidance procedures designed to safeguard State data and other confidential information, Contractor’s processing capability and the availability of hosted services, in each case throughout the Contract term. Any force majeure provisions of the Contract do not limit the

Contractor’s obligations under this provision.

b) The Contractor shall have robust contingency and disaster recovery (DR) plans in place to ensure that the services provided under the Contract will be maintained in the event of disruption to the

Contractor/subcontractor’s operations (including, but not limited to, disruption to information technology systems), however caused.

1) The Contractor shall furnish a DR site.

2) The DR site shall be at least 100 miles from the primary operations site and have the capacity to take over complete production volume in case the primary site becomes unresponsive.

c) The contingency and DR plans must be designed to ensure that services under the Contract are restored after a disruption within twenty-four (24) hours from notification and a recovery point objective of one (1) hour or less prior to the outage in order to avoid unacceptable consequences due to the unavailability of services.

d) The Contractor shall test the contingency/DR plans at least twice annually to identify any changes that need to be made to the plan(s) to ensure a minimum interruption of service.

Coordination shall be made with the State to ensure limited system downtime when testing is conducted. At least one (1) annual test shall include backup media restoration and failover/fallback operations at the DR location. The Contractor shall send the Contract Monitor a notice of completion following completion of DR testing.

e) Such contingency and DR plans shall be available for the Agency to inspect and practically test at any reasonable time, and subject to regular updating, revising, and testing throughout the term of the Contract.

3.5.2 Data Export/Import

a) The Contractor shall, at no additional cost or charge to the State, in an industry standard/non-proprietary format:

IFB for Maryland State Retirement Agency Page 11 of 72

1) perform a full or partial import/export of State data within 24 hours of a request; or

2) provide to the State the ability to import/export data at will and provide the State with any access and instructions which are needed for the State to import or export data.

b) Any import or export shall be in a secure format per the Security Requirements.

3.5.3 Data Ownership and Access

a) Data, databases, and derived data products created, collected, manipulated, or directly purchased as part of an IFB are the property of the State. The purchasing State agency is considered the custodian of the data and shall determine the use, access, distribution, and other conditions based on appropriate State statutes and regulations.

b) Public jurisdiction user accounts and public jurisdiction data shall not be accessed, except (1) in the course of data center operations, (2) in response to service or technical issues, (3) as required by the express terms of the Contract, including as necessary to perform the services hereunder or

(4) at the State’s written request.

c) The Contractor shall limit access to and possession of State data to only Contractor Personnel whose responsibilities reasonably require such access or possession and shall train such

Contractor Personnel on the confidentiality obligations set forth herein.

d) At no time shall any data or processes – that either belong to or are intended for the use of the

State or its officers, agents, or employees – be copied, disclosed, or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the

State.

e) The Contractor shall not use any information collected in connection with the services furnished under the Contract for any purpose other than fulfilling such services.

3.5.4 Provisions in Sections 3.5.1 – 3.5.3 shall survive expiration or termination of the Contract.

Additionally, the Contractor shall flow down the provisions of Sections 3.5.1-3.5.3 (or the substance thereof) in all subcontracts.

3.6 Insurance Requirements

The Contractor shall maintain, at a minimum, the insurance coverages outlined below, or any minimum requirements established by law if higher, for the duration of the Contract, including option periods, if exercised:

3.6.1 The following type(s) of insurance and minimum amount(s) of coverage are required:

a) Commercial General Liability - of $1,000,000 combined single limit per occurrence for bodily injury, property damage, and personal and advertising injury and $2,000,000 annual aggregate.

The minimum limits required herein may be satisfied through any combination of primary and umbrella/excess liability policies.

b) Errors and Omissions/Professional Liability - $1,000,000 per combined single limit per claim and annual aggregate.

c) Cyber Security / Data Breach Insurance – (For any service offering hosted by the Contractor) one million dollars ($1,000,000) per occurrence. The coverage must be valid at all locations where work is performed or data or other information concerning the State’s claimants or employers is processed or stored.

d) Worker’s Compensation - The Contractor shall maintain such insurance as necessary or as required under Workers’ Compensation Acts, the Longshore and Harbor Workers’

IFB for Maryland State Retirement Agency Page 12 of 72

Compensation Act, and the Federal Employers’ Liability Act, to not be less than one million dollars ($1,000,000) per occurrence (unless a state’s law requires a greater amount of coverage).

Coverage must be valid in all states where work is performed.

3.6.2 The State shall be listed as an additional insured on the faces of the certificates associated with the coverages listed above, including umbrella policies, excluding Workers’ Compensation

Insurance and professional liability.

3.6.3 All insurance policies shall be endorsed to include a clause requiring the insurance carrier provide the Procurement Officer, by certified mail, not less than 30 days’ advance notice of any non-renewal, cancellation, or expiration. The Contractor shall notify the Procurement Officer in writing if policies are cancelled or not renewed within five (5) days of learning of such cancellation or nonrenewal. The Contractor shall provide evidence of replacement insurance coverage to the Procurement Officer at least 15 days prior to the expiration of the insurance policy then in effect.

3.6.4 Any insurance furnished as a condition of the Contract shall be issued by a company authorized to do business in the State.

3.6.5 The recommended awardee must provide current certificate(s) of insurance with the prescribed coverages, limits and requirements set forth in this section within five (5) Business Days from notice of recommended award. During the period of performance for multi-year contracts, the

Contractor shall provide certificates of insurance annually, or as otherwise directed by the

Contract Monitor.

3.6.6 The Contractor shall require any subcontractors to obtain and maintain comparable levels of coverage and shall provide the Contract Monitor with the same documentation as is required of the Contractor.

3.7 Security Requirements

The following requirements are applicable to the Contract:

3.7.1 Employee Identification

a) Contractor Personnel shall display his or her company ID badge in a visible location at all times while on State premises. Upon request of authorized State personnel, each Contractor Personnel shall provide additional photo identification.

b) Contractor Personnel shall cooperate with State site requirements, including but not limited to, being prepared to be escorted at all times, and providing information for State badge issuance.

c) Contractor shall remove any Contractor Personnel from working on the Contract where the State determines, in its sole discretion that Contractor Personnel has not adhered to the Security requirements specified herein.

d) The State reserves the right to request that the Contractor submit proof of employment authorization of non-United States Citizens, prior to commencement of work under the Contract.

3.7.2 Security Clearance / Criminal Background Check

a) The Contractor shall obtain from all Contractor and subcontractor personnel assigned to work on the Contract a signed statement permitting a criminal background check. The Contractor shall secure at its own expense a Maryland State Police and/or FBI background check and shall provide the Contract Monitor with completed checks on the above-listed personnel assigned to work under the Contractor prior to assignment. At a minimum, these background checks must include all convictions and probation before judgment (PBJ) dispositions. The Contractor may

IFB for Maryland State Retirement Agency Page 13 of 72 not assign an individual whose background check reflects any criminal activity to work under this

Contract unless prior written approval is obtained from the Contract Monitor.

b) The Contractor shall provide certification to the Agency that the Contractor has completed the required criminal background check described in this IFB for each required Contractor Personnel prior to assignment, and that the Contractor Personnel have successfully passed this check.

c) Persons with a criminal record may not perform services under the Contract unless prior written approval is obtained from the Contract Monitor. The Contract Monitor reserves the right to reject any individual based upon the results of the background check. Decisions of the Contract Monitor as to acceptability of a candidate are final. The State reserves the right to refuse any individual

Contractor Personnel to work on State premises, based upon certain specified criminal convictions, as specified by the State.

3.7.3 On-Site Security Requirement(s)

THIS SECTION IS INAPPLICABLE TO THIS IFB.

3.7.4 Information Technology

(a) Contractors shall comply with and adhere to the State IT Security Policy and Standards.

These policies may be revised from time to time and the Contractor shall comply with all such revisions. Updated and revised versions of the State IT Policy and Standards are available online at: www.doit.maryland.gov – keyword: Security Policy.

(b) The Contractor shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State. The Contractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the

State to connect Contractor-owned equipment to a State LAN/WAN.

The Contractor shall:

1) Implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security such as those listed below (see Section 3.7.5);

2) Ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of, and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of the Contract;

and

3) The Contractor, and Contractor Personnel, shall (i) abide by all applicable federal, State and local laws, rules and regulations concerning security of Information

Systems and Information Technology and (ii) comply with and adhere to the State IT

Security Policy and Standards as each may be amended or revised from time to time.

Updated and revised versions of the State IT Policy and Standards are available online at: www.doit.maryland.gov – keyword: Security Policy.

3.7.5 Data Protection and Controls.

a) Contractor shall ensure a secure environment for all State data and any hardware and software

(including but not limited to servers, network, and data components) provided or used in connection with the performance of the Contract and shall apply or cause application of appropriate controls so as to maintain such a secure environment (“Security Best Practices”).

Such Security Best Practices shall comply with an accepted industry standard, such as the

NIST cybersecurity framework.

http://www.doit.maryland.gov/

IFB for Maryland State Retirement Agency Page 14 of 72

b) To ensure appropriate data protection safeguards are in place, the Contractor shall implement and maintain the following controls at all times throughout the Term of the Contract (the

Contractor may augment this list with additional controls):

1) Establish separate production, test, and training environments for systems supporting the services provided under the Contract and ensure that production data is not replicated in test or training environment(s) unless it has been previously anonymized or otherwise modified to protect the confidentiality of Sensitive Data elements. The Contractor shall ensure the appropriate separation of production and non-production environments by applying the data protection and control requirements listed in Section 3.7.5.

2) Apply hardware and software hardening procedures as recommended by the Center for Internet Security (CIS) guides https://www.cisecurity.org/ Security Technical

Implementation Guides (STIG) https://public.cyber.mil/stigs/, or similar industry best practices to reduce the systems’ surface of vulnerability, eliminating as many security risks as possible and documenting what is not feasible or not performed according to best practices. Any hardening practices not implemented shall be documented with a plan of action and milestones including any compensating control. These procedures may include, but are not limited to, the removal of unnecessary software, disabling or removing unnecessary services, removal of unnecessary usernames or logins, and the deactivation of unneeded features in the

Contractor’s system configuration files.

3) Ensure that State data is not comingled with non-State data through the proper application of compartmentalization Security Measures.

4) Apply data encryption to protect Sensitive Data at all times, including in transit, at rest, and also when archived for backup purposes. Unless otherwise directed, the

Contractor is responsible for the encryption of all Sensitive Data.

5) For all State data the Contractor manages or controls, data encryption shall be applied to such data in transit over untrusted networks.

6) Encryption algorithms which are utilized for encrypting data shall comply with current Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules”, FIPS PUB 140-2:

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm

7) Enable appropriate logging parameters to monitor user access activities, authorized and failed access attempts, system exceptions, and critical information security events as recommended by the operating system and application manufacturers and information security standards, including Maryland Department of Information

Technology’s Information Security Policy.

8) Retain the aforementioned logs and review them at least daily to identify suspicious or questionable activity for investigation and documentation as to their cause and remediation, if required. The Agency shall have the right to inspect these policies and procedures and the Contractor or subcontractor’s performance to confirm the effectiveness of these measures for the services being provided under the Contract.

9) Ensure system and network environments are separated by properly configured and updated firewalls.

https://www.cisecurity.org/ https://public.cyber.mil/stigs/ http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm

IFB for Maryland State Retirement Agency Page 15 of 72

10) Restrict network connections between trusted and untrusted networks by physically or logically isolating systems from unsolicited and unauthenticated network traffic.

11) By default, “deny all” and only allow access by exception.

12) Review, at least annually, the aforementioned network connections, documenting and confirming the business justification for the use of all service, protocols, and ports allowed, including the rationale or compensating controls implemented for those protocols considered insecure but necessary.

13) Perform regular vulnerability testing of operating system, application, and network devices. Such testing is expected to identify outdated software versions; missing software patches; device or software misconfigurations; and to validate compliance with or deviations from the security policies applicable to the Contract. Contractor shall evaluate all identified vulnerabilities for potential adverse effect on security and integrity and remediate the vulnerability no later than 30 days following the earlier of vulnerability’s identification or public disclosure, or document why remediation action is unnecessary or unsuitable. The Agency shall have the right to inspect the Contractor’s policies and procedures and the results of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

14) Enforce strong user authentication and password control measures to minimize the opportunity for unauthorized access through compromise of the user access controls. At a minimum, the implemented measures should be consistent with the most current Maryland Department of Information Technology’s Information

Security Policy (https://doit.maryland.gov/policies/Pages/default.aspx), including specific requirements for password length, complexity, history, and account lockout.

15) Ensure State data is not processed, transferred, or stored outside of the United States

(“U.S.”). The Contractor shall provide its services to the State and the State’s end users solely from data centers in the U.S. Unless granted an exception in writing by the State, the Contractor shall not allow Contractor Personnel to store State data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers.