SW- DGSR4600016 - On-Call Bus and Transportation Services - IFB - approved.pdf

STATE OF MARYLAND

DEPARTMENT OF GENERAL SERVICES (DGS)

INVITATION FOR BIDS (IFB)

STATEWIDE: ON-CALL BUS AND TRANSPORTATION

SERVICES

IFB NUMBER: BPM041923/001IT821432

ISSUE DATE: JANUARY 26, 2024

NOTICE TO BIDDERS

A Prospective Bidder that has received this document from a source other than eMarylandMarketplace

(eMMA) https://procurement.maryland.gov should register on eMMA. See Section 4.2.

MINORITY BUSINESS ENTERPRISES ARE ENCOURAGED TO

RESPOND TO THIS SOLICITATION.

STATEWIDE: ON-CALL BUS AND TRANSPORTATION

Solicitation #: BPM041923/001IT821432

IFB Document

IFB for the Department of General Services Page ii of 76

NO BID NOTICE/VENDOR FEEDBACK FORM

To help us improve the quality of State solicitations, and to make our procurement process more responsive and business friendly, please provide comments and suggestions regarding this solicitation.

Please return your comments with your response. If you have chosen not to respond to this solicitation, please email this completed form to the attention of the Procurement Officer (see Key Information

Summary Sheet below for contact information).

Title: STATEWIDE: ON-CALL BUS AND TRANSPORTATION SERVICES

Solicitation No: BPM041923/001IT821432

1. If you have chosen not to respond to this solicitation, please indicate the reason(s) below:

Other commitments preclude our participation at this time

The subject of the solicitation is not something we ordinarily provide

We are inexperienced in the work/commodities required

Specifications are unclear, too restrictive, etc. (Explain in REMARKS section)

The scope of work is beyond our present capacity

Doing business with the State is simply too complicated. (Explain in REMARKS section)

We cannot be competitive. (Explain in REMARKS section)

Time allotted for completion of the Bid is insufficient

Start-up time is insufficient

Bonding/Insurance requirements are restrictive (Explain in REMARKS section)

Bid requirements (other than specifications) are unreasonable or too risky (Explain in

REMARKS section)

MBE or VSBE requirements (Explain in REMARKS section)

Prior State of Maryland contract experience was unprofitable or otherwise unsatisfactory.

(Explain in REMARKS section)

Payment schedule too slow

Other: __________________________________________________________________

2. If you have submitted a response to this solicitation, but wish to offer suggestions or express concerns, please use the REMARKS section below. (Attach additional pages as needed.)

REMARKS:

Vendor Name: ________________________________ Date: _______________________

Contact Person: _________________________________ Phone (____) _____ - _________________

Address: ______________________________________________________________________

E-mail Address: ________________________________________________________________

IFB for the Department of General Services Page iii of 76

STATE OF MARYLAND

DEPARTMENT OF GENERAL SERVICES (DGS)

KEY INFORMATION SUMMARY SHEET

Invitation for Bids Statewide Services Contract - STATEWIDE: ON-CALL BUS AND

TRANSPORTATION SERVICES

Solicitation Number: BPM041923/001IT821432

IFB Issue Date: January 26, 2024

IFB Issuing Office: Department of General Services (DGS or "The Department")

Procurement Officer: Tierra Ali-Said

301 West Preston Street, Suite M-4 e-mail:

Office Phone:

Tierra.Ali-Said1@maryland.gov

(410) 767-0788

Bids are to be sent to: Online Only via eMarylandMarketplace Advantage “eMMA” located at procurement.maryland.gov

Pre-Bid Conference: A Pre-Bid Meeting will not be held for this Solicitation

Questions Due Date and Time February 12, 2024, at 3:00 PM Local Time

Bid Due (Closing) Date and

Time:

February 23, 2024, at 3:00 PM Local Time

Bidders are reminded that a completed Feedback Form is requested if a no-bid decision is made (see page iv).

MBE Subcontracting Goal: 0%

VSBE Subcontracting Goal: 0%

Contract Type: Indefinite Quantity with Firm Fixed Price

Contract Duration: Two (2) Year base period with One (1) Two-Year Renewal option

Primary Place of

Performance:

Statewide throughout the State of Maryland

SBR Designation: No

Federal Funding: No

IFB for the Department of General Services Page iv of 76

TABLE OF CONTENTS – IFB

1 Minimum Qualifications

1.1 Bidder Minimum Qualifications

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.2 Background and Purpose

2.3 Responsibilities and Tasks

3 Contractor Requirements: General

3.1 Contract Initiation Requirements

3.2 End of Contract Transition

3.3 Invoicing

3.4 Liquidated Damages

3.5 Disaster Recovery and Data

3.6 Insurance Requirements

3.7 Security Requirements

3.8 Problem Escalation Procedure

3.9 SOC 2 Type 2 Audit Report

3.10 Minority Business Enterprise (MBE) Reports

3.11 Veteran Small Business Enterprise (VSBE) Reports

3.12 Work Orders

3.13 Additional Clauses

4 Procurement Instructions

4.1 Pre-Bid Conference

4.2 eMaryland Marketplace Advantage (eMMA)

4.3 Questions

4.4 Procurement Method

4.5 Bid Due (Closing) Date and Time

4.6 Multiple or Alternate Bids

4.7 Receipt, Opening and Recording of Bids

4.8 Confidentiality of Bids / Public Information Act Notice

4.9 Award Basis

4.10 Tie Bids

IFB for the Department of General Services Page v of 76

4.11 Duration of Bids

4.12 Revisions to the IFB

4.13 Cancellations

4.14 Incurred Expenses

4.15 Protest/Disputes

4.16 Bidder Responsibilities

4.17 Acceptance of Terms and Conditions

4.18 Bid/Proposal Affidavit

4.19 Contract Affidavit

4.20 Compliance with Laws/Arrearages

4.21 Verification of Registration and Tax Payment

4.22 False Statements

4.23 Payments by Electronic Funds Transfer

4.24 Prompt Payment Policy

4.25 Electronic Procurements Authorized

4.26 MBE Participation Goal

4.27 VSBE Participation Goal

4.28 Living Wage Requirements

4.29 Federal Funding Acknowledgement

4.30 Conflict of Interest Affidavit and Disclosure

4.31 Non-Disclosure Agreement

4.32 HIPAA - Business Associate Agreement

4.33 Nonvisual Access

4.34 Mercury and Products That Contain Mercury

4.35 Location of the Performance of Services Disclosure

4.36 Department of Human Services (DHS) Hiring Agreement

4.37 Small Business Reserve (SBR) Procurement

4.38 Bonds .......................................................................................... Error! Bookmark not defined.

4.39 Maryland Healthy Working Families Act Requirements

5 Bid Format

5.1 One Part Submission

5.2 Labeling

5.3 Bid Price Form

5.4 Required Bid Submission

IFB for the Department of General Services Page vi of 76

5.5 Delivery

5.6 Documents Required upon Notice of Recommendation for Contract Award

6 Bid Evaluation and Award

6.1 Bid Evaluation Criteria

6.2 Reciprocal Preference

6.3 Award Determination

6.4 Documents Required upon Notice of Recommendation for Contract Award

7 IFB ATTACHMENTS AND APPENDICES

Attachment A. Pre-Bid Conference Response Form

Attachment B. Bid Instructions & Form

Attachment C. Bid/Proposal Affidavit

Attachment D. Minority Business Enterprise (MBE) Forms

Attachment E. Veteran-Owned Small Business Enterprise (VSBE) Forms

Attachment F. Maryland Living Wage Affidavit of Agreement for Service Contracts

Attachment G. Federal Funds Attachments

Attachment H. Conflict of Interest Affidavit and Disclosure

Attachment I. Non-Disclosure Agreement (Contractor)

Attachment J. HIPAA Business Associate Agreement

Attachment K. Mercury Affidavit

Attachment L. Location of the Performance of Services Disclosure

Attachment M. Contract

Attachment N. Contract Affidavit

Attachment O. DHS Hiring Agreement

Appendix 1. – Abbreviations and Definitions

Appendix <<#>>. – <<Title of Appendix>>

IFB for the Department of General Services Page 1 of 76

1 Minimum Qualifications

1.1 Bidder Minimum Qualifications

As part of the determination to be considered responsive, the Bidder must document in its Bid that it satisfies the following Minimum Qualifications:

1.1.1 The Bidder shall have at least three (3) years of driving experience, with at least one (1) year of experience with driving coach motor buses.

Required Documentation: As proof of meeting this requirement, the Bidder shall provide with its

Bid a copy of their resume/work history with professional references.

1.1.2 The Bidder shall have a clean driving history, with no more than one (1) point on their driver’s license.

Required Documentation: As proof of meeting this requirement, the Bidder shall provide with its Bid a copy of their driving record.

1.1.3 The Bidder shall be certified by the Maryland Department of Transportation

Required Documentation: As proof of meeting this requirement, the Bidder shall provide with its Bid their Maryland Class C License or CDL.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

IFB for the Department of General Services Page 2 of 76

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.1.1 The Department of General Services (DGS or the "The Department") is issuing this Invitation for

Bids (IFB) in order to procure bus and transportation services defined in this Section 2, as specified in this IFB, from a contract between the successful bidder(s) and the State of Maryland.

Major storms, catastrophic events, and other emergencies may quickly overwhelm the ability of the local government to transport the general population who do not have their own means of transportation, or who has lost their means of transportation during a catastrophic event. The general population includes citizens/non-citizens, and those requiring wheelchair and service animal support.

2.1.2 It is the State’s intention to obtain bus and transportation services, as specified in this IFB, from a

Contract between the selected Bidder and the State.

2.1.3 The Department intends to make multiple awards for the work under this IFB. See IFB Section

4.9 Award Basis for more Contract award information.

2.1.4 A Bidder, either directly or through its subcontractor(s), must be able to provide all services and meet all of the requirements requested in this solicitation and the successful Bidder (the

Contractor) shall remain responsible for Contract performance regardless of subcontractor participation in the work.

2.1.5 Maryland State and other local government entities as defined in Finance and Procurement §13-

110(a) and nonprofit entities within the State of Maryland may purchase from the Contractor services covered by the Contract at the same prices chargeable to the State. All such purchases by non-executive branch entities, non-State governments, government agencies or nonprofit entities:

Shall constitute Contracts between the Contractor and that entity;

Shall not constitute purchases by the State or State agencies under the Contract;

Shall not be binding or enforceable against the State; and

May be subject to other terms and conditions agreed to by the Contractor and the purchaser.

2.1.6 All Contract prices, terms, and conditions must be provided to any Maryland local government or nonprofit entity requesting services under the Contract. The Contractor bears the risk of determining whether or not a government, agency or organization with which the Contractor is dealing is a State entity.

2.2 Background and Purpose

The purpose of this Statewide Contract is to obtain a source of supply for bus and transportation services for the State of Maryland on an as-needed basis in response to an emergency in the State. The services procured will be set at a firm, fixed price for the term indicated within this Invitation for Bid (IFB). The

Department may award multiple contracts in response to this Invitation. Awarded vendors shall be responsible for ensuring that the transport and coach buses supplied in accordance with the specifications set forth in this Invitation meets all inspection guidelines. Inspections may be made by an authorized representative of the State at the source of supply, point of delivery, or both. The Bidder must provide services consistent with Federal and State Law.

2.2.1 Contractor Responsibilities

IFB for the Department of General Services Page 3 of 76

a) The Contractor shall provide recliner-type motor coach buses which have the capacity to transport adult passengers. A higher capacity motor coach bus is preferred, but not required.

Buses must have a heating/cooling system, have an operable restroom, and luggage compartments. All motor coach passenger comfort and related equipment must be fully operational. Buses capable of transporting wheelchair passengers must have appropriate lock-down hardware as well as lift-gate or vehicle leveling equipment.

b) Contracted buses must be inspected by the State or local inspection officials at the identified location. All motor coach buses deployed for use in response to an emergency must be roadworthy, safe, clean, compliant with all applicable State regulations, and have GPS capabilities.

c) During evacuation and transport operations, all motor coaches must be equipped with cell phone or satellite communication capabilities, which will allow contact with the Transportation

Coordinator from the requesting agency. The requesting government entity will be responsible for designating Transportation Coordinators.

d) The contracted buses will pick up passengers at a designated emergency embark station and transport them to another designated emergency embark station.

2.2.2 State Staff and Roles

In the event of an emergency, the State of Maryland is authorized to utilize this Contract.

In the event that a Using Agency utilizes this Contract, the Officer from the Using Agency must notify the Department of General Services and request a Contract Manager from DGS.

a) The DGS Contract Manager must be notified upon the utilization of this Emergency Statewide

Master Contract: STATEWIDE: ON-CALL BUS AND TRANSPORTATION SERVICES (For

Emergencies) immediately.

1) DGS will assign a representative who will be responsible for coordinating with the authorized Using Agency to utilize this Contract.

The Using Agency reserves the right to request financial and/or passenger reports from the Contractor(s) in the event that this Contract is utilized.

2) DGS reserves the right to request financial and/or passenger reports from the Using

Agency in the event that this Contract is utilized

2.2.3 Other State Responsibilities

a) The State may provide emergency office working facilities and equipment reasonably necessary for Contractor performance under the Contract and in the event of an emergency. Any special requirements shall be identified and accommodated.

b) The State is responsible for providing required information, data, documentation, and test data to facilitate the Contractor’s performance of the work and will provide such additional assistance and services as is specifically set forth in the event of an emergency.

IFB for the Department of General Services Page 4 of 76

c) The Using Agency in need of STATEWIDE: ON-CALL BUS AND TRANSPORTATION

SERVICES is responsible for managing and implementing a program to utilize these services.

The implementation and management plan for the utilizing of these services must be approved by the Department of General Services.

2.3 Responsibilities and Tasks

Services may be separated by deliverables within the contract and may include reporting requirements that include and are not limited to research, identification of passengers, planning/coordinating transport; MRE distribution, luggage carrying, and reporting.

2.3.1 Deliverables and Reporting Requirements

Aside from Bus Driver driver’s responsibilities set for by the Department of Transportation and the Motor Vehicle Administration, the Bus Drivers assigned work under this Contract must adhere to and agree to comply with the following Sub-Sections below:

2.3.2 Bus Driver Duties: The driver of each emergency on-call bus transport, the bus driver must prepare weekly reports. The weekly reports must include ensuring informed voluntary consent before relocation of passengers, providing language translation services, and document/record handling.

2.3.3 Bus Driver Duties: The driver of each emergency on-call bus transport must complete any and additional activities related to the transportation of unauthorized noncitizens, only.

2.3.4 Bus Driver Duties: The driver must report to the State and work with all emergency response officials when this Contract is utilized and in the event of an emergency.

2.3.5 *Bus Driver Duties: In the event of an emergency, the driver assigned to complete services under this Contract will be responsible for providing ground transportation services to assist in the voluntary relocation of unauthorized aliens that have agreed to be relocated from Florida, or another state, to another location or the District of Columbia.

2.3.6 Using Agency Requirements:

a) The Using Agency or other government entity is responsible for providing security measures to ensure the safety of the public and transported persons.

b) The Using Agency or other government entity is responsible for coordinating and arranging for

Social Services at the destination.

c) The Using Agency or other government entity is responsible for providing language translation services.

d) The Using Agency or other government entity is response for record-keeping and document handling.

e) The Using Agency or other government entity is responsible for obtaining necessities and personal hygiene products for transported persons.

f) The Using Agency or other government entity is responsible for any additional activities related to the transportation of persons in the event of an emergency or crisis.

IFB for the Department of General Services Page 5 of 76

3 Contractor Requirements: General

3.1 Contract Initiation Requirements

A. The State, Using Agency, or other government entity and the Contractor shall schedule and hold a kickoff meeting within 10 Business Days of NTP Date. At the kickoff, the State, Using Agency, or other government entity and Contractor shall furnish an Emergency

Contingency Plan Schedule to the Department of General Services describing the activities for the Contractor, the State, the Using Agency, or other government entity and any third parties in preparation for utilizing this Contract in the event of an emergency.

B. The Using Agency shall provide the Department of General Services with an up-to-date

Contact List in preparation of an Emergency and for utilization of the Contract.

C. The Contractor shall provide the Using Agency with an up-to-date Contact List of all key personnel who will be working under this Contract.

3.2 End of Contract Transition

3.2.1 The Contractor shall provide transition assistance as requested by the State to facilitate the orderly transfer of services to the State or a follow-on contractor, for a period up to 120 days prior to the Contract end date, or the termination thereof. Such transition efforts shall consist, not by way of limitation, of:

a) Provide additional services and support as requested to successfully complete the transition;

b) Maintain the services called for by the Contract at the required level of proficiency;

c) Provide updated System Documentation (see Appendix 1), as appropriate; and

d) Provide current operating procedures (as appropriate).

3.2.2 The Contractor shall work toward a prompt and timely transition, proceeding in accordance with the directions of the Contract Monitor. The Contract Monitor may provide the Contractor with additional instructions to meet specific transition requirements prior to the end of the Contract.

3.2.3 The Contractor shall ensure that all necessary knowledge and materials for the tasks completed are transferred to the custody of State personnel or a third party, as directed by the Contract

Monitor.

3.2.4 The Contractor shall support end-of-Contract transition efforts with technical and project support to include but not be limited to:

a) The Contractor shall provide a draft Transition-Out Plan 120 Business Days in advance of the

Contract end date.

The Transition-Out Plan shall address at a minimum the following areas:

1) Any staffing concerns/issues related to the closeout of the Contract;

2) Communications and reporting process between the Contractor, The Department and the

Contract Monitor;

3) Security and system access review and closeout;

4) Any hardware/software inventory or licensing including transfer of any point of contact for required software licenses to The Department or a designee;

5) Any final training/orientation of The Department staff;

IFB for the Department of General Services Page 6 of 76

6) Connectivity services provided, activities and approximate timelines required for

Transition-Out;

7) Knowledge transfer, to include:

a) A working knowledge of the current system environments;

b) Review with The State and Using Agency the procedures and practices that support the business process and current system environments;

c) Working knowledge of all technical and functional matters associated with the solution, its architecture, data file structure, interfaces, any batch programs, and any hardware or software tools utilized in the performance of the Contract;

d) Documentation that lists and describes all hardware and software tools utilized in the performance of the Contract;

8) Plans to complete tasks and any unfinished work items including transported passengers;

and

9) Any risk factors with the timing and the Transition-Out schedule and transition process.

The Contractor shall document any risk factors and suggested solutions.

The Contractor and Using Agency shall ensure all documentation and data including, but not limited to, System Documentation and current operating procedures, is current and complete with a hard and soft copy in a format prescribed by the Contract Monitor.

The Contractor shall provide copies of any current daily and weekly back-ups to the Using Agency, the

State, or a third party as directed by the Contract Monitor as of the final date of transition, but no later than the final date of the Contract.

Access to any data or configurations of the furnished product and services shall be available after the expiration of the Contract as described in Section 3.2.5.

3.2.5 Return and Maintenance of State Data

a) Upon termination or the expiration of the Contract Term, the Contractor shall: (a) return to the

State all State data in either the form it was provided to the Contractor or in a mutually agreed format along with the schema necessary to read such data; (b) preserve, maintain, and protect all

State data until the earlier of a direction by the State to delete such data or the expiration of 90 days (“the retention period”) from the date of termination or expiration of the Contract term; (c) after the retention period, the Contractor shall securely dispose of and permanently delete all

State data in all of its forms, such as disk, CD/DVD, backup tape and paper such that it is not recoverable, according to National Institute of Standards and Technology (NIST)-approved methods with certificates of destruction to be provided to the State; and (d) prepare an accurate accounting from which the State may reconcile all outstanding accounts. The final monthly invoice for the services provided hereunder shall include all charges for the 90-day data retention period.

b) During any period of service suspension, the Contractor shall maintain all State data in its then existing form, unless otherwise directed in writing by the Contract Monitor.

c) In addition to the foregoing, the State shall be entitled to any post-termination/expiration assistance generally made available by the Contractor with respect to the services.

3.3 Invoicing

3.3.1 General

IFB for the Department of General Services Page 7 of 76

a) The Contractor shall send the original of each invoice and signed authorization to invoice to the

State, Using Agency, or other government entity. In the event of an emergency, please contact the Contract Monitor, Beth Malane directly at: beth.malane@maryland.gov.

All invoices for services shall be verified by the Contractor as accurate at the time of submission.

An invoice not satisfying the requirements of a Proper Invoice (as defined in COMAR 21.06.09) cannot be processed for payment. To be considered a Proper Invoice, invoices must include the following information, without error:

1) Contractor name and address;

2) Remittance address;

3) Federal taxpayer identification (FEIN) number, social security number, as appropriate;

4) Invoice period (i.e. time period during which services covered by invoice were performed);

5) Invoice date;

6) Invoice number;

7) State assigned Contract number;

8) State assigned (Blanket) Purchase Order number(s);

9) Services provided;

10) Amount due; and

11) Any additional documentation required by regulation or the Contract.

Invoices that contain both fixed price and time and material items shall clearly identify each item as either fixed price or time and material billing.

The State reserves the right to reduce or withhold Contract payment in the event the Contractor does not provide the State with all required deliverables within the time frame specified in the Contract or otherwise breaches the terms and conditions of the Contract until such time as the Contractor brings itself into full compliance with the Contract.

Any action on the part of the State, or dispute of action by the Contractor, shall be in accordance with the provisions of Md. Code Ann., State Finance and Procurement Article §§ 15-215 through 15-223 and with

COMAR 21.10.04.

The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of

Columbia sales taxes and transportation taxes. The Contractor, however, is not exempt from such sales and use taxes and may be liable for the same.

Invoices for final payment shall be clearly marked as “FINAL” and submitted when all work requirements have been completed and no further charges are to be incurred under the Contract. In no event shall any invoice be submitted later than 60 calendar days from the Contract termination date.

Invoices must include monthly reports of transportation services.

3.3.2 Invoice Submission Schedule

The Contractor shall submit invoices in accordance with the following schedule:

a) For items of work for which there is one-time pricing (see Attachment B –Bid Form) those items shall be billed in the month following the acceptance of the work by The Department.

mailto:beth.malane@maryland.gov

IFB for the Department of General Services Page 8 of 76

b) For items of work for which there is annual pricing, see Attachment B–Bid Form, those items shall be billed in equal monthly installments for the applicable Contract year in the month following the performance of the services.

3.3.3 Deliverable Invoicing

a) Deliverable invoices shall be accompanied by notice(s) of acceptance issued by the Using

Agency for all invoices submitted for payment. Payment of invoices will be withheld if a signed

DPAF is not submitted (see online example at http://doit.maryland.gov/contracts/Documents/_procurementForms/DeliverableProductAcceptan ceForm-DPAFsample.pdf).

b) Deliverable invoices for items of work completed successfully, those reports shall be submitted along with the invoice.

Payment for deliverables will only be made upon completion and acceptance of the deliverables as defined in Section 2.

3.3.4 Time and Materials Invoicing

a) For Emergency On-Call Bus Drivers, all time and material invoices shall be accompanied by a signed timesheet as described below and notice(s) of acceptance issued by the State: DPAF for each time period invoiced (see online example at http://doit.maryland.gov/contracts/Documents/_procurementForms/DeliverableProductAcceptan ceForm-DPAFsample.pdf). Include for each person covered by the invoice the following, individually listed per person: name, hours worked, hourly labor rate, invoice amount and a copy of each person’s timesheet for the period signed by the Using Agency’s Contract Monitor.

Time Sheet Reporting

Within three (3) Business Days after the 15th and last day of the month, the Contractor shall submit a semi-monthly timesheet for the preceding half month providing data for all Contractor

Personnel / employees / resources working under the Contract.

At a minimum, each semi-monthly timesheet shall show:

1) Title: “Time Sheet for the time period completed

2) Issuing company name, address, and telephone number;

3) For each Contractor employee /resource:

a) Contractor employee / resource name, and

b) For each period ending date, e.g., “Period Ending: mm/dd/yyyy” (Periods run 1st through 15th, and 16th through last day of the month.):

i) Tasks completed that week and the associated deliverable names and

ID#s;

ii) Number of hours worked each day;

iii) Total number of hours worked that Period;

iv) Period variance above or below 40 hours;

v) Annual number of hours planned under the Task Order;

vi) Annual number of hours worked to date; and

vii) Balance of hours remaining;

http://doit.maryland.gov/contracts/Documents/_procurementForms/DeliverableProductAcceptanceForm-DPAFsample.pdf http://doit.maryland.gov/contracts/Documents/_procurementForms/DeliverableProductAcceptanceForm-DPAFsample.pdf

IFB for the Department of General Services Page 9 of 76

4) Annual variance to date (Sum of periodic variances); and

5) Signature and date lines for the Contract Monitor.

Time sheets shall be submitted to the Contract Monitor prior to invoicing. The Contract Monitor shall sign the timesheet to indicate authorization to invoice.

3.3.5 For the purposes of the Contract an amount will not be deemed due and payable if:

a) The amount invoiced is inconsistent with the Contract;

b) The proper invoice has not been received by the party or office specified in the Contract;

c) The invoice or performance is in dispute or the Contractor has failed to otherwise comply with the provisions of the Contract;

d) The item or services have not been accepted;

e) The quantity of items delivered is less than the quantity ordered;

f) The items or services do not meet the quality requirements of the Contract;

g) If the Contract provides for progress payments, the proper invoice for the progress payment has not been submitted pursuant to the schedule;

h) If the Contract provides for withholding a retainage and the invoice is for the retainage, all stipulated conditions for release of the retainage have not been met; or

i) The Contractor has not submitted satisfactory documentation or other evidence reasonably required by the Procurement Officer or by the Contract concerning performance under the

Contract and compliance with its provisions.

3.3.6 Travel Reimbursement

Travel will not be reimbursed under this IFB.

3.4 Liquidated Damages

3.4.1 MBE Liquidated Damages

MBE liquidated damages are identified in Attachment M.

3.4.2 Liquidated Damages other than MBE

THIS SECTION IS INAPPLICABLE TO THIS IFB.

3.5 Disaster Recovery and Data

The following requirements apply to the Contract:

3.5.1 Redundancy, Data Backup and Disaster Recovery

a) Unless specified otherwise in the IFB, Contractor shall maintain or cause to be maintained disaster avoidance procedures designed to safeguard State data and other confidential information, Contractor’s processing capability and the availability of hosted services, in each case throughout the Contract term. Any force majeure provisions of the Contract do not limit the

Contractor’s obligations under this provision.

b) The Using Agency shall have robust contingency and disaster recovery (DR) plans in place to ensure that the services provided under the Contract will be maintained in the event of disruption

IFB for the Department of General Services Page 10 of 76 to the Contractor/subcontractor’s operations (including, but not limited to, disruption to information technology systems), however caused.

c) The contingency and DR plans must be designed to ensure that services under the Contract are restored after a disruption within twenty-four (24) hours from notification and a recovery point objective of one (1) hour or less prior to the outage in order to avoid unacceptable consequences due to the unavailability of services.

d) The Contractor shall test the contingency/DR plans at least twice annually to identify any changes that need to be made to the plan(s) to ensure a minimum interruption of service.

Coordination shall be made with the State to ensure limited system downtime when testing is conducted. At least one (1) annual test shall include backup media restoration and failover/fallback operations at the DR location. The Contractor shall send the Contract Monitor a notice of completion following completion of DR testing.

e) Such contingency and DR plans shall be available for The Department to inspect and practically test at any reasonable time, and subject to regular updating, revising, and testing throughout the term of the Contract.

3.5.2 Data Export/Import

a) The Contractor shall, at no additional cost or charge to the State, in an industry standard/non-proprietary format:

1) perform a full or partial import/export of State data within 24 hours of a request; or

2) provide the State with the ability to import/export data at will and provide the State with any access and instructions which are needed for the State to import or export data.

b) Any import or export shall be in a secure format per the Security Requirements.

3.5.3 Data Ownership and Access

a) Data, databases and derived data products created, collected, manipulated, or directly purchased as part of an IFB are the property of the State. The purchasing State agency is considered the custodian of the data and shall determine the use, access, distribution and other conditions based on appropriate State statutes and regulations.

Public jurisdiction user accounts and public jurisdiction data shall not be accessed, except (1) in the course of data center operations, (2) in response to service or technical issues, (3) as required by the express terms of the Contract, including as necessary to perform the services hereunder or (4) at the

State’s written request.

The Contractor shall limit access to and possession of State data to only Contractor Personnel whose responsibilities reasonably require such access or possession and shall train such Contractor Personnel on the confidentiality obligations set forth herein.

At no time shall any data or processes – that either belong to or are intended for the use of the State or its officers, agents or employees – be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the State.

The Contractor shall not use any information collected in connection with the services furnished under the

Contract for any purpose other than fulfilling such services.

3.5.4 Provisions in Sections 3.5.1 – 3.5.3 shall survive expiration or termination of the Contract.

Additionally, the Contractor shall flow down the provisions of Sections 3.5.1-3.5.3 (or the substance thereof) in all subcontracts.

IFB for the Department of General Services Page 11 of 76

3.6 Insurance Requirements

The Contractor shall maintain, at a minimum, the insurance coverages outlined below, or any minimum requirements established by law if higher, for the duration of the Contract, including option periods, if exercised:

3.6.1 The following type(s) of insurance and minimum amount(s) of coverage are required:

a) Commercial General Liability - of $1,000,000 combined single limit per occurrence for bodily injury, property damage, and personal and advertising injury and $3,000,000 annual aggregate.

The minimum limits required herein may be satisfied through any combination of primary and umbrella/excess liability policies.

b) Errors and Omissions/Professional Liability - $1,000,000 per combined single limit per claim and $3,000,000 annual aggregate.

c) Crime Insurance/Employee Theft Insurance - to cover employee theft with a minimum single loss limit of $1,000,000 per loss, and a minimum single loss retention not to exceed $10,000.

The State of Maryland and The Department should be added as a “loss payee.”

d) Cyber Security / Data Breach Insurance – (For any service offering hosted by the Contractor) ten million dollars ($10,000,000) per occurrence. The coverage must be valid at all locations where work is performed or data or other information concerning the State’s claimants or employers is processed or stored.

e) Worker’s Compensation - The Contractor shall maintain such insurance as necessary or as required under Workers’ Compensation Acts, the Longshore and Harbor Workers’

Compensation Act, and the Federal Employers’ Liability Act, to not be less than. one million dollars ($1,000,000) per occurrence (unless a state’s law requires a greater amount of coverage).

Coverage must be valid in all states where work is performed.

f) Automobile or Commercial Truck Insurance - The Contractor shall maintain Automobile or

Commercial Truck Insurance (including owned, leased, hired, and non-owned vehicles) as appropriate with Liability, Collision, and PIP limits no less than those required by the State where the vehicle(s) is registered, but in no case less than those required by the State of

Maryland.

3.6.2 The State shall be listed as an additional insured on the faces of the certificates associated with the coverages listed above, including umbrella policies, excluding Workers’ Compensation

Insurance and professional liability.

3.6.3 All insurance policies shall be endorsed to include a clause requiring the insurance carrier to provide the Procurement Officer, by certified mail, not less than 30 days’ advance notice of any non-renewal, cancellation, or expiration. The Contractor shall notify the Procurement Officer in writing if policies are cancelled or not renewed within five (5) days of learning of such cancellation or nonrenewal. The Contractor shall provide evidence of replacement insurance coverage to the Procurement Officer at least 15 days prior to the expiration of the insurance policy then in effect.

3.6.4 Any insurance furnished as a condition of the Contract shall be issued by a company authorized to do business in the State.

3.6.5 The recommended awardee(s) must provide current certificate(s) of insurance with the prescribed coverages, limits and requirements set forth in this section within five (5) Business Days from notice of recommended award. During the period of performance for multi-year contracts, the

IFB for the Department of General Services Page 12 of 76

Contractor shall provide certificates of insurance annually, or as otherwise directed by the

Contract Monitor.

3.6.6 The Contractor shall require any subcontractors to obtain and maintain comparable levels of coverage and shall provide the Contract Monitor with the same documentation as is required of the Contractor.

3.7 Security Requirements

The following requirements are applicable to the Contract:

3.7.1 Employee Identification

a) Contractor Personnel shall display his or her company ID badge in a visible location at all times while on State premises. Upon request of authorized State personnel, each Contractor Personnel shall provide additional photo identification.

b) Contractor Personnel shall cooperate with State site requirements, including but not limited to, being prepared to be escorted at all times, and providing information for State badge issuance.

c) Contractor shall remove any Contractor Personnel from working on the Contract where the State determines, in its sole discretion, that Contractor Personnel has not adhered to the Security requirements specified herein.

d) The State reserves the right to request that the Contractor submit proof of employment authorization of non-United States Citizens, prior to commencement of work under the Contract.

3.7.2 Security Clearance / Criminal Background Check

a) A criminal background check for any Contractor Personnel providing specific services shall be completed prior to each Contractor Personnel providing any services under the Contract.

b) The Contractor shall obtain at its own expense a Criminal Justice Information System (CJIS)

State and federal criminal background check, including fingerprinting, for all Contractor

Personnel listed in sub-paragraph A. This check may be performed by a public or private entity.

c) Persons with a criminal record may not perform services under the Contract unless prior written approval is obtained from the Contract Monitor. The Contract Monitor reserves the right to reject any individual based upon the results of the background check. Decisions of the Contract

Monitor as to acceptability of a candidate are final. The State reserves the right to refuse any individual Contractor Personnel to work on State premises, based upon certain specified criminal convictions, as specified by the State.

d) The CJIS criminal record check of each Contractor Personnel who will work on State premises shall be reviewed by the Contractor for convictions of any of the following crimes described in the Annotated Code of Maryland, Criminal Law Article:

1) §§ 6-101 through 6-104, 6-201 through 6-205, 6-409 (various crimes against property);

2) any crime within Title 7, Subtitle 1 (various crimes involving theft);

3) §§ 7-301 through 7-303, 7-313 through 7-317 (various crimes involving telecommunications and electronics);

4) §§ 8-201 through 8-302, 8-501 through 8-523 (various crimes involving fraud);

5) §§9-101 through 9-417, 9-601 through 9-604, 9-701 through 9-706.1 (various crimes against public administration); or

IFB for the Department of General Services Page 13 of 76

6) a crime of violence as defined in CL § 14-101(a).

3.7.3 On-Site Security Requirement(s)

THIS SECTION IS INAPPLICABLE TO THIS IFB.

3.7.4 Information Technology

(a) Contractors shall comply with and adhere to the State IT Security Policy and Standards.

These policies may be revised from time to time and the Contractor shall comply with all such revisions. Updated and revised versions of the State IT Policy and Standards are available online at: www.doit.maryland.gov – keyword: Security Policy.

(b) The Contractor shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State. The Contractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the

State to connect Contractor-owned equipment to a State LAN/WAN.

The Contractor shall:

1) Implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security such as those listed below (see Section 3.7.5);

2) Ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of the Contract; and

3) The Contractor, and Contractor Personnel, shall (i) abide by all applicable federal, State and local laws, rules and regulations concerning security of Information Systems and

Information Technology and (ii) comply with and adhere to the State IT Security Policy and Standards as each may be amended or revised from time to time. Updated and revised versions of the State IT Policy and Standards are available online at:

www.doit.maryland.gov – keyword: Security Policy.

3.7.5 Data Protection and Controls

A. To ensure appropriate data protection safeguards are in place, the Contractor shall implement and maintain the following controls at all times throughout the Term of the Contract (the

Contractor may augment this list with additional controls):

1) Establish separate production, test, and training environments for systems supporting the services provided under the Contract and ensure that production data is not replicated in test or training environment(s) unless it has been previously anonymized or otherwise modified to protect the confidentiality of Sensitive Data elements. The Contractor shall ensure the appropriate separation of production and non-production environments by applying the data protection and control requirements listed in Section 3.7.5.

2) Apply hardware and software hardening procedures as recommended by Center for

Internet Security (CIS) guides https://www.cisecurity.org/ Security Technical

Implementation Guides (STIG) https://public.cyber.mil/stigs/, or similar industry best practices to reduce the systems’ surface of vulnerability, eliminating as many security risks as possible and documenting what is not feasible or not performed according to best practices. Any hardening practices not implemented shall be http://www.doit.maryland.gov/ https://www.cisecurity.org/ https://public.cyber.mil/stigs/

IFB for the Department of General Services Page 14 of 76 documented with a plan of action and milestones including any compensating control. These procedures may include but are not limited to removal of unnecessary software, disabling or removing unnecessary services, removal of unnecessary usernames or logins, and the deactivation of unneeded features in the

Contractor’s system configuration files.

3) Ensure that State data is not co-mingled with non-State data through the proper application of compartmentalization Security Measures.

4) Apply data encryption to protect Sensitive Data at all times, including in transit, at rest, and also when archived for backup purposes. Unless otherwise directed, the

Contractor is responsible for the encryption of all Sensitive Data.

5) For all State data the Contractor manages or controls, data encryption shall be applied to such data in transit over untrusted networks.

6) Encryption algorithms which are utilized for encrypting data shall comply with current Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules”, FIPS PUB 140-2:

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm

7) Enable appropriate logging parameters to monitor user access activities, authorized and failed access attempts, system exceptions, and critical information security events as recommended by the operating system and application manufacturers and information security standards, including Maryland Department of Information

Technology’s Information Security Policy.

8) Retain the aforementioned logs and review them at least daily to identify suspicious or questionable activity for investigation and documentation as to their cause and remediation, if required. The Department shall have the right to inspect these policies and procedures and the Contractor or subcontractor’s performance to confirm the effectiveness of these measures for the services being provided under the Contract.

9) Ensure system and network environments are separated by properly configured and updated firewalls.

10) Restrict network connections between trusted and untrusted networks by physically or logically isolating systems from unsolicited and unauthenticated network traffic.

11) By default “deny all” and only allow access by exception.

12) Review, at least annually, the aforementioned network connections, documenting and confirming the business justification for the use of all service, protocols, and ports allowed, including the rationale or compensating controls implemented for those protocols considered insecure but necessary.

13) Perform regular vulnerability testing of operating system, application, and network devices. Such testing is expected to identify outdated software versions; missing software patches; device or software misconfigurations; and to validate compliance with or deviations from the security policies applicable to the Contract. Contractor shall evaluate all identified vulnerabilities for potential adverse effect on security and integrity and remediate the vulnerability no later than 30 days following the earlier of vulnerability’s identification or public disclosure or document the reason http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm

IFB for the Department of General Services Page 15 of 76 remediation action is unnecessary or unsuitable. The Department shall have the right to inspect the Contractor’s policies and procedures and the results of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

14) Enforce strong user authentication and password control measures to minimize the opportunity for unauthorized access through compromise of the user access controls. At a minimum, the implemented measures should be consistent with the most current Maryland Department of Information Technology’s Information

Security Policy (https://doit.maryland.gov/policies/Pages/default.aspx), including specific requirements for password length, complexity, history, and account lockout.

15) Ensure State data is not processed, transferred, or stored outside of the United States

(“U.S.”). The Contractor shall provide its services to the State and the State’s end users solely from data centers in the U.S. Unless granted an exception in writing by the State, the Contractor shall not allow Contractor Personnel to store State data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The Contractor shall permit its Contractor

Personnel to access State data remotely only as required to provide technical support.

16) Ensure Contractor’s Personnel shall not connect any of its own equipment to a State

LAN/WAN without prior written approval by the State, which may be revoked at any time for any reason. The Contractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the State to connect Contractor -owned equipment to a State LAN/WAN.

17) Ensure that anti-virus and anti-malware software is installed and maintained on all systems supporting the services provided under the Contract; that the anti-virus and anti-malware software is automatically updated; and that the software is configured to actively scan and detect threats to the system for remediation. The Contractor shall perform routine vulnerability scans and take corrective actions for any findings.

18) Conduct regular external vulnerability testing designed to…