TORFP No. E00B6600011 - Revision 2.pdf

Approved for legal sufficiency 1/8/2026 /s/Murray Singerman, Assistant Attorney General

CONSULTING AND TECHNICAL SERVICES+ (CATS+)

TASK ORDER REQUEST FOR PROPOSALS (TORFP)

COMPTROLLER OF MARYLAND (COM)

SOLICITATION NUMBER E00B6600011

IT SYSTEM MODERNIZATION TECHNICAL

SUPPORT SERVICES

ISSUE DATE: 01/09/2026

NOTICE TO OFFERORS

SMALL BUSINESS RESERVE

Technical Operational Storage Area Network (SAN) Professional Services, Solicitation #: E00B6600011 CATS+ TORFP

TORFP for The Comptroller of Maryland Page ii of 67

COMPTROLLER OF MARYLAND (COM)

KEY INFORMATION SUMMARY SHEET

Solicitation Title: IT SYSTEM MODERNIZATION TECHNICAL SUPPORT

SERVICES

Solicitation Number (TORFP#): E00B6600011

Functional Area: Functional Area 6 - Systems/Facilities Management and Maintenance

TORFP Issue Date: 01/09/2026

TORFP Issuing Office: Comptroller of Maryland (COM)

COM Location: Annapolis Maryland

TO Procurement Officer: Tracy Cain P.O. Box 466 Annapolis, MD 21404 e-mail:

Office Phone:

tcain@marylandtaxes.gov 410-260-7436

TO Manager: Bill O’Leary P.O. Box 466 Annapolis, MD 21404 e-mail:

Office Phone:

woleary@marylandtaxes.gov 410-260-6252

TO Proposals are to be sent to: tcain@marylandtaxes.gov

TO Pre-proposal Conference: 01/14/2026, 10:00 AM Local Time Meeting will be conducted virtually See Attachment A for instructions

TO Proposals Due (Closing) Date and Time:

02/9/2026, 10AM Local Time Offerors are reminded that a completed Feedback Form is required if a no-bid decision is made (see Section 5).

TO Oral Presentations: To be scheduled between 02/09/2026 and 02/11/2026

MBE Subcontracting Goal: 3%, with no subgoals.

VSBE Subcontracting Goal: 0%

Task Order Type: Time and Materials

Task Order Duration: Five (5) base years, with no option periods, commencing on the effective date

SBR Designation: Yes

Primary Place of Performance: TO Contractor’s location &

108 Carroll Street, Annapolis, MD 21404

Questions Due Date and Time 01/20/2026, 10AM Local Time mailto:woleary@marylandtaxes.gov

TORFP for The Comptroller of Maryland Page iii of 67

TABLE OF CONTENTS – TORFP

1 Qualifications

1.1 Offeror Minimum Qualifications

1.2 Offeror Preferred Qualifications

1.3 Offeror Key Personnel Minimum Qualifications

1.4 Offeror Key Personnel Preferred Qualifications

2 TO Contractor Requirements: Scope of Work

2.1 Summary Statement

2.2 Background and Purpose

2.3 Current Environment

2.4 Responsibilities and Tasks

2.5 Service Level Agreement (SLA)

3 TO Contractor Requirements: General

3.1 Task Order Initiation Requirements

3.2 End of Task Order Transition

3.3 Invoicing

3.4 Liquidated Damages

3.5 Disaster Recovery and Data

3.6 Insurance Requirements

3.7 Security Requirements

3.8 Security Incident Response

3.9 Confidentiality of IRS and State Tax Information

3.10 SOC 2 Type 2 Audit Report

3.11 Non-Visual Access

3.12 Performance and Personnel

3.13 Substitution of Personnel

3.14 Minority Business Enterprise (MBE) Reports

3.15 Veteran Small Business Enterprise (VSBE) Reports

3.16 Work Orders

3.17 Additional Clauses

4 TORFP Instructions

4.1 TO Pre-Proposal Conference

TORFP for The Comptroller of Maryland Page iv of 67

4.2 Questions

4.3 TO Proposal Due (Closing) Date and Time

4.4 Award Basis

4.5 Oral Presentation

4.6 Limitation of Liability

4.7 MBE Participation Goal

4.8 VSBE Goal

4.9 Living Wage Requirements

4.10 Federal Funding Acknowledgement

4.11 Conflict of Interest Affidavit and Disclosure

4.12 Non-Disclosure Agreement

4.13 HIPAA - Business Associate Agreement

4.14 Iranian Non-Investment

4.15 Mercury and Products That Contain Mercury

4.16 Location of the Performance of Services Disclosure

4.17 Department of Human Services (DHS) Hiring Agreement

4.18 Small Business Reserve (SBR) Set-Aside

4.19 Bonds

5 TO Proposal Format

5.1 Required Response

5.2 Three Part Submission

5.3 TO Proposal Packaging and Delivery

5.4 Volume I - TO Technical Proposal

5.5 Volume II – TO Oral Presentation

5.6 Volume III – TO Financial Proposal

6 Evaluation and Selection Process

6.1 Evaluation Committee

6.2 TO Technical Proposal Evaluation Criteria

6.3 TO Oral Presentation Evaluation Criteria

6.4 TO Financial Proposal Evaluation Criteria

6.5 Selection Procedures

6.6 Documents Required upon Notice of Recommendation for Task Order Award

7 TORFP ATTACHMENTS AND APPENDICES

TORFP for The Comptroller of Maryland Page v of 67

Attachment A. TO Pre-Proposal Conference Response Form

Attachment B. TO Financial Proposal Instructions & Form

Attachment C. RESERVED

Attachment D. Minority Business Enterprise (MBE) Forms

Attachment E. Veteran-Owned Small Business Enterprise (VSBE) Forms

Attachment F. Maryland Living Wage Affidavit of Agreement for Service Contracts

Attachment G. Federal Funds Attachments

Attachment H. Conflict of Interest Affidavit and Disclosure

Attachment I. Non-Disclosure Agreement (TO Contractor)

Attachment J. HIPAA Business Associate Agreement

Attachment K. Mercury Affidavit

Attachment L. Location of the Performance of Services Disclosure

Attachment M. Task Order

Attachment N. RESERVED

Attachment O. RESERVED

Attachment P. Certification Regarding Investments in Iran

Appendix 1. – Abbreviations and Definitions

Appendix 2. – Offeror Information Sheet

Appendix 3. Criminal Background Check Affidavit

Appendix 4. Labor Classification Personnel Resume Summary

Appendix 5. CATS+ Labor Categories and Qualifications

TORFP for The Comptroller of Maryland Page 1 of 67

1 Qualifications

1.1 Offeror Minimum Qualifications

As part of the determination to be considered reasonably susceptible to be selected for award, the offeror’s proposal shall make it obvious that it meets the following minimum requirements:

1.1.1 The Offeror shall have at least ten (10) years of experience providing IT modernization expertise to U.S.-based commercial or government entities with at least 2,000 end users.

1.1.2 The Offeror shall submit 3 references for projects of similar size and scope. The references provided should demonstrate the Offeror’s breadth of knowledge and IT modernization expertise with U.S.-based commercial or government entities that have at least 2,000 end users. Each engagement must have lasted at least four (4) years, and all engagements must have been within the last ten (10) years.

The offeror’s proposal and references will be used to verify minimum qualifications. Only the Master Contractor’s qualifications may be used to validate that the company meets the minimum qualifications.

Subcontractor qualifications may not be used to meet minimum qualifications.

1.2 Offeror Preferred Qualifications

Demonstrating the following preferred qualifications in the offerors’ proposal will increase the possibility of award:

1.2.1 Fifteen (15) years of experience providing IT modernization expertise to U.S.-based commercial or government entities with at least 2,000 end users.

1.2.2 Demonstrated experience providing strategic direction for future IT infrastructure and system modernization activities that resulted in successful system modernization.

1.2.3 Registered with IBM as a Gold Level Partner.

1.2.4 Registered with Nutanix as a Champion Reseller Level 3 or higher.

1.2.5 Registered with Cohesity as a Preferred Partner Level 2 or higher.

1.2.6 Registered with Tanium as an Authorized Partner Level 1 or higher.

1.2.7 Registered with Zscaler as a Copper Partner Level 1 or higher.

1.2.8 Registered with Palo Alto and an Innovator Partner Level 2 or higher.

1.2.9 Registered with CISCO as a Select Integrator Level 1 or higher.

1.2.10 Registered with Service Now as a Certified Technical Architect.

1.2.11 International Organization for Standardization (ISO) 9001:2015 Certification

1.2.12 Capability Maturity Model Integration (CMMI) for Services, Maturity Level (ML) 3 Certification.

1.3 Offeror Key Personnel Minimum Qualifications

Offeror Personnel shall meet the following minimum qualification criteria to be eligible for consideration in the evaluation of this TORFP. Proposed Personnel experience starting dates and ending dates must be clearly identified for each applicable minimum requirement. Key personnel should be clearly available as part of the offeror’s or offeror’s subcontractor team.

TORFP for The Comptroller of Maryland Page 2 of 67

1.3.1 Subject Matter Expert – Tax Processing Systems – Available within 15 days of Notice to Proceed.

Meets the identified labor category description as described in CATS + RFP Section 2.10.102

1.3.2 Subject Matter Expert – Mainframe System Programmer

Meets the identified labor category description as described in CATS + RFP Section 2.10.102

1.3.3 Engineer, Systems – Desktop Engineering – Available within 15 days of Notice to Proceed.

Meets the identified labor category description as described in CATS + RFP Section 2.10.58

1.3.4 Engineer, Systems (Senior) – Hyper Converged Infrastructure – Available within 15 days of Notice to Proceed.

Meets the identified labor category description as described in CATS + RFP Section 2.10.57

1.3.5 Engineer, Systems (Senior) – Microsoft M365

Meets the identified labor category description as described in CATS + RFP Section 2.10.57

1.3.6 Engineer, Systems (Senior) – Job Automation

Meets the identified labor category description as described in CATS + RFP Section 2.10.57

1.3.7 Engineer, Network (Senior) – Palo Alto

Meets the identified labor category description as described in CATS + RFP Section 2.10.52

1.3.8 Project Manager

Meets the identified labor category description as described in CATS + RFP Section 2.10.95

1.4 Offeror Key Personnel Preferred Qualifications

Clearly demonstrating the following preferred qualifications in the offerors’ proposal will increase the possibility of award.

1.4.1 Subject Matter Expert – Tax Processing Systems – Available within 15 days of Notice to Proceed.

Meets the identified labor category description as described in TORFP Section 1.3.1 CATS + RFP Section 2.10.102, plus the following:

A. Twenty (20) Years experience as a senior system engineer supporting tax processing systems.

B. Ten (10) Years of system engineering experience in tax processing systems for state or local governments.

C. Five (5) years of experience with the Revenue/Government Premier integrated tax processing platform.

D. Twenty (20) years of experience using mainframe technologies, to include IBM DB2, DML, COBOL, CICS, Spufi, QMF, and IBM Job Control Language (JCL) and related utilities.

E. Twenty (20) years of experience using distributed technologies such as SQL, Global Scape, and Electronic Data Interchange standards.

F. Fifteen (15) years of experience transitioning applications from mainframe systems to enterprise integrated systems.

G. Fifteen (15) Years of experience in tax-related business processes analysis.

TORFP for The Comptroller of Maryland Page 3 of 67

H. Ten (10) Years of experience in tax-related business processes analysis for state or local governments.

1.4.2 Subject Matter Expert- Mainframe Systems Programmer

Meets the identified labor category description as described in TORFP Section 1.3.2 CATS + RFP Section 2.10.102, plus the following:

A. Fifteen (15) years of experience with mainframe systems (IBM z16 2932-A02 and above, DS8950 5341-996 and above, TS7770 3948-VED and above).

B. Fifteen (15) years of experience in the operation and maintenance of the zOS v2.5 and above, IBM DB2 v12 and above, CICS TS v6.0 and above.

C. Ten (10) years of experience with DASD replication product IBM Copy Services Manager v6.3.15.0 and above, and the implementation of Safeguard Copy.

D. Ten (10) years of experience in disaster recovery, business continuity, and capacity optimization.

1.4.3 Engineer, Systems – Desktop Engineering

Meets the identified labor category description as described in TORFP Section 1.3.3 CATS + RFP Section 2.10.58, plus the following:

A. Five (5) years of experience administering and maintaining Windows environments

B. Manage and support enterprise print solutions, including PaperCut MF and multifunction printers (HP MFPs and Canon copiers).

C. Provide AV support for conference rooms and event spaces, including AVoIP systems and control interfaces.

D. Deliver Tier 2 support for Microsoft 365 applications and services (Power Automate, Office Apps, Teams, SharePoint, OneDrive).

E. Deploy and manage endpoints using Tanium and PDQ for software distribution, patching, and asset inventory.

F. Collaborate with cross-functional teams to troubleshoot and resolve technical issues.

G. Document procedures, configurations, and troubleshooting steps in an IT knowledge base.

H. Current certifications in the following:

1. Relevant certifications from Q-SYS and/or Microsoft.

1.4.4 Engineer, Systems (Senior) – Hyper Converged Infrastructure – Available within 15 days of Notice to Proceed.

Meets the identified labor category description as described in TORFP Section 1.3.4 CATS + RFP Section 2.10.57 plus the following:

A. Ten (10) years of experience administering hyper-converged environments.

B. Current certifications in the following:

1. Nutanix Certified Professional (NCP)

2. Nutanix Certified Professional - Multicloud Infrastructure (NCP-MCI)

TORFP for The Comptroller of Maryland Page 4 of 67

1.4.5 Engineer, Systems (Senior) – Microsoft M365 - Meets the identified labor category description as described in TORFP Section 1.3.5 CATS + RFP Section 2.10.57

A. Fifteen (15) years of experience administering Microsoft applications to include Microsoft M365 administration from launch.

B. Five (5) years’ experience administering hyper-converged environments.

C. Current certifications in the following

1. Microsoft Certified Professional (MCP)

2. Nutanix Certified Professional (NCP)

1.4.6 Engineer, Systems (Senior) – Job Automation

Meets the identified labor category description as described in TORFP Section 1.3.6 CATS + RFP Section 2.10.57 A. Fifteen (15) years of experience in job automation, including the following tools:

HelpSystems, JAMS, Globalscape EFT, SQL Agent Jobs, and PowerShell.

1.4.7 Engineer, Network (Senior) - Palo Alto - Meets the identified labor category description as described in TORFP Section 1.3.7 CATS + RFP Section 2.10.52 plus the following:

A. Ten (10) years of experience in network administration

B. Current certifications in the following:

1. Palo Alto Networks Accredited Systems Engineer

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK

TORFP for The Comptroller of Maryland Page 5 of 67

2 TO Contractor Requirements: Scope of Work

2.1 Summary Statement

The Comptroller of Maryland (COM) is issuing this CATS+ TORFP to obtain Information Technology System Modernization Technical Support Services from a professional experienced IT services company.

COM intends to award this Task Order to one (1) Master Contractor that proposes a team of resources and a Staffing Plan that can best satisfy the Task Order requirements.

Master Contractors are advised that, should a solicitation or other competitive award be initiated as a result of activity or recommendations arising from this Task Order, the Offeror awarded this Task Order may not be eligible to compete if such activity constitutes assisting in the drafting of specifications, requirements, or design thereof.

A Task Order award does not assure a TO Contractor that it will receive all State business under the Task Order.

2.2 Background and Purpose

Through a hyper converged infrastructure the COM provides revenue services to millions of individuals, businesses, and organizations each year. There are 1,500-1,900 end users (internal, seasonal, contractors, and third-party service providers) located on-site and remote. The COM also provides support to the payroll system for the entire State and 60+ state agencies that leverage mainframe systems.

The IT infrastructure is a complex environment composed of data centers, field offices, IBM mainframes, 350+ Windows and Linux servers, a 1.5 petabyte capacity SAN, 200+ network devices, 2400+ desktops and related peripheral devices, and 128 custom web applications.

The COM is currently modernizing several critical IT systems that support a wide range of business processes, including tax processing, payroll processing, and statewide financial transactions. The COM requires a professional IT services company to augment our staff by providing targeted technical support for both our IT infrastructure and system modernization activities. Day-to-day operations will be conducted by COM staff. The desired targeted technical support will be performed remotely and on-site as the situation allows.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK

TORFP for The Comptroller of Maryland Page 6 of 67

2.3 Current Environment

Figure 1: Current Environment

2.3.1 State Staff and Roles

In addition to the Procurement Officer and TO Manager, the COM will provide a Project Manager to facilitate access to systems and facilities, as well as coordinate interactions with the COM staff.

2.4 Responsibilities and Tasks

The TO Contractor shall provide targeted technical support for both our IT infrastructure and system modernization activities. At times, full-time, this support may require staff to be full-time for a period, such as when replacing a significant amount of networking equipment or providing technical support for a full system migration away from mainframe technologies. At other times, support may be for a number of hours, days, or weeks to assist with technical planning, troubleshooting technical issues, or restoring an outage. Therefore, responsibilities and tasks shall include, but are not limited to:

A. Targeted technical administrative support by either securely connecting to systems remotely via COM approved methods or through on-premises support to include:

1. Providing administration, maintenance, and operational support for our hyper-converged infrastructure (HCI);

2. Performing problem determination and resolution of our HCI;

3. Responding to HCI-related help desk tickets when escalated to the TO Contractor;

4. Monitoring HCI performance to prevent performance bottlenecks as well as to ensure best resource utilization and optimum performance;

5. Planning, coordinating, upgrading, and installing components of the HCI as needed to include software upgrades/patching, hardware, and code upgrades; and

TORFP for The Comptroller of Maryland Page 7 of 67

6. Configuring, implementing, troubleshooting, and maintaining backup and restore, disaster recovery, storage consolidation, replication, and data protection.

B. Providing technical direction and hands-on support to current mainframe application modernization projects;

C. Providing technical direction and support for mainframe infrastructure upgrade projects to include hardware, software, and security applications;

D. Providing desktop engineering support to key projects and product implementations;

E. Providing audiovisual support to implement new technologies, support agency conference centers, and individual users;

F. Providing support to online workflow-based forms in products such as MSFORMS or ServiceNow;

G. Providing technical direction and hands-on support to ServiceNow;

H. Providing strategic direction for future IT infrastructure and system modernization activities;

I. Developing long-term performance planning and capacity roadmap and future planning for hardware/software lifecycle management;

J. Providing technical administrative support for systems integration and system interoperability for current and future system modernization projects;

K. Developing and documenting operational procedures;

L. Participating in monthly status meetings to include providing a monthly status report;

M. Provision storage based on standardized procedures according to storage vendor best practices to facilitate existing applications’ growth, database growth, and the establishment of new projects;

N. The Contractor shall be available to provide 24x7x365(6) technical support with a minimum one-hour on-site and remote response time for SERVICE LEVEL AGREEMENT (SLA) Emergency Service Priority Problems; and

O. Developing a Transition-Out Plan.

2.4.1 TO Contractor-Supplied Hardware, Software, and Materials

A. By responding to this TORFP and accepting a Task Order award, an Offeror specifically agrees that for any software that it proposes for use by the State in response to this TORFP, the State will have the right to purchase from another source, instead of from the selected Offeror.

B. Any materials provided by the contractor shall be passed through with no additional cost markup, with prior written approval from the COM.

2.4.2 Required Project Policies, Guidelines, and Methodologies

The TO Contractor shall be required to comply with all applicable laws, regulations, policies, standards, and guidelines affecting Information Technology projects, which may be created or changed periodically.

The Offeror is required to review all applicable links provided below and state compliance in its response.

It is the responsibility of the TO Contractor to ensure adherence and to remain abreast of new or revised laws, regulations, policies, standards, and guidelines affecting project execution. These include, but are not limited to:

TORFP for The Comptroller of Maryland Page 8 of 67

A. The State of Maryland System Development Life Cycle (SDLC) methodology at:

https://doit.maryland.gov/MITDP-Oversight/Pages/SDLC.aspx;

B. The State of Maryland Cybersecurity Directives, Policies and Standards to include the following:

1. Emergency Directives,

2. IT Security Policy

3. IT Security Manual

4. Communication Recordings

C. Data Classification Policy D. The State of Maryland Information Technology Non-Visual Standards at: Nonvisual

Access Regulatory Standards - Accessibility - Policies & Guidance - Department of Information Technology;

E. The State of Maryland Information Technology Project Oversight at:

www.DoIT.maryland.gov - keyword: IT Project Oversight;

F. The TO Contractor shall follow project management methodologies consistent with the most recent edition of the Project Management Institute’s Project Management Body of Knowledge Guide; and

G. Hardware and Software hardening procedures by:

1. Center for Internet Security (CIS) guides https://www.cisecurity.org/ or

2. Security Requirements Guides (SRG) http://www.nist.gov.

H. Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules”, FIPS PUB 140-3:

1. https://csrc.nist.gov/publications/detail/fips/140/3/final

2. https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-standards

I. FedRAMP Certification at appropriate risk level for any cloud computing environment storing, transmitting, processing or protecting Federal Tax Information (FTI)

1. https://www.fedramp.gov/

J. IRS Publication 1075 Tax Information Security Guidelines For Federal, State and Local Agencies

1. https://www.irs.gov/pub/irs-pdf/p1075.pdf

K. Purchasing and Recycling Electronic Products

1. https://dgs.maryland.gov/Pages/GreenPurchasing/Resources/Electronics.aspx

L. Any Comptroller of Maryland policies provided by the Contract Monitor.

2.4.3 Work Products

In addition to the items identified in the table below, the TO Contractor may suggest other subtasks, artifacts, or work products to improve the quality and success of the assigned tasks.

https://doit.maryland.gov/policies/ci/Pages/vendor-risk-assessment-questionnaire-form-offshore-resource-utilization.aspx https://doit.maryland.gov/policies/ci/Pages/IT-Security-Policy.aspx https://doit.maryland.gov/policies/ci/Documents/Maryland-IT-Security-Manual-v1-2.pdf https://doit.maryland.gov/policies/ci/Pages/Communication-Recordings.aspx https://doit.maryland.gov/policies/ci/Pages/data-classification-policy.aspx https://doit.maryland.gov/policies/Accessibility/Pages/Nonvisual-Access-Regulatory-Standards.aspx https://doit.maryland.gov/policies/Accessibility/Pages/Nonvisual-Access-Regulatory-Standards.aspx https://doit.maryland.gov/policies/Accessibility/Pages/Nonvisual-Access-Regulatory-Standards.aspx https://www.doit.maryland.gov/ https://www.cisecurity.org/ http://www.nist.gov/ https://csrc.nist.gov/publications/detail/fips/140/3/final https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-standards https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-standards https://www.fedramp.gov/ https://www.irs.gov/pub/irs-pdf/p1075.pdf https://dgs.maryland.gov/Pages/GreenPurchasing/Resources/Electronics.aspx

TORFP for The Comptroller of Maryland Page 9 of 67

Figure 2: List of Work Products

Description Criteria Due Date / Frequency

Transition-In Plan Format: Microsoft Word

Draft due fifteen (15) Business days after NTP date.

Final due thirty (30) Business days after NTP date

Monthly Status Report

Format: Microsoft Word

The TO Contractor shall provide a monthly progress report after the last day of the month. At a minimum, the monthly progress report shall contain:

• TO Agreement number;

• Work accomplished during the month;

• HCI Health and Status;

• Issues (log of identified issues with status and root cause analysis);

• SLA response statistics;

• COM Help desk ticket response summary;

• Work Product Status (submitted, due, overdue, approval status, and payment status);

• Staffing (planned labor hours and actual labor hours per resource);

• Project Risks (including mitigation status);

• Planned Activities for the next reporting period; and

• Accounting Status (burn hours by labor category and remaining balance) for the current reporting period.

Initial Delivery: Ten

(10) Business Days after the last day of the month.

Updates: Monthly

Transition-Out Plan Format: Microsoft Word (following COM format) Thirty (30) days prior to the end of the TO Agreement

2.4.4 Change Orders

A. If the TO Contractor is required to perform work beyond the scope of this TORFP, or there is a work reduction due to unforeseen scope changes, a TO Change Order is required. The TO Contractor and TO Manager shall negotiate a mutually acceptable price modification based on the TO Contractor’s proposed rates in the Master Contract and the scope of the work change.

B. No scope of work changes shall be performed until a change order is approved by DoIT and executed by the TO Procurement Officer.

2.5 Service Level Agreement (SLA)

2.5.1 Definitions

A. A “Problem” is defined as any situation or issue reported via a help desk ticket that is related to the system operation that is not an enhancement request.

TORFP for The Comptroller of Maryland Page 10 of 67

B. “Problem resolution time” is defined as the period of time from when the help desk ticket is opened to when it is resolved.

2.5.2 SLA Requirements

The TO Contractor shall:

A. Be responsible for complying with all performance measurements and ensuring compliance by all subcontractors.

B. Meet the Problem response time and resolution requirements as defined in Section 2.5.7.

C. Provide a monthly report to monitor and detail response times and resolution times.

D. Respond to and update all Problems, including recording when a Problem is resolved and its resolution. Appropriate COM personnel shall be notified when a Problem is resolved.

E. The COM shall make the final determination regarding Problem severity.

F. TO Contractor shall review any Problem with COM to establish the remediation plan and relevant target dates.

2.5.3 SLA Effective Date (SLA Activation Date)

SLAs set forth herein shall be in effect beginning with the commencement of monthly services as of the completion of the Transition-In Period.

Beginning on the SLA Activation Date, for any performance measurement not met during the monthly reporting period, the SLA credit for that individual measurement shall be applied to the Monthly Charges.

2.5.4 Service Level Reporting

The TO Contractor shall provide detailed monthly reports evidencing the attained level for each SLA set forth herein. Monthly reports shall be included in the monthly status report.

The TO Manager or designee will monitor and review TO Contractor performance standards on a quarterly basis, based on TO Contractor-provided reports for this Task Order. If any of the performance measurements are not met during the monthly reporting period, the TO Manager or designee will notify the TO Contractor of the standard that is not in compliance.

2.5.5 Service Level Measurements Table (System performance)

The TO Contractor shall comply with the service level measurements in the following table:

Figure 3: Service Level Measurements Table

No. Service Requirement Measurement Service Level Agreement

1 Problem Response Time – Emergency

Average Response Time for Critical Problems 98% < 1 hour

2 Problem Response Time - Medium

Average Response Time for Normal Problems 98% < 4 hours

3 Problem Response Time – Low Priority

Average Response Time for Low Priority Problems 98% < 24 hours

TORFP for The Comptroller of Maryland Page 11 of 67

No. Service Requirement Measurement Service Level Agreement

4 Problem Resolution Time - High

Resolution Time for each Critical Problems 98% < 4 hours

5 Problem Resolution Time - Medium

Resolution Time for each Normal Problems 98% < 24 hours

6 Problem Resolution Time - Low

Resolution Time for Low Priority Problems 98% <72 hours

7 Scheduled Downtime/ Maintenance

Scheduled maintenance and downtime shall only occur during non-business hours*. The TO Contractor shall provide 14 calendar days’ notice prior to any scheduled downtime.

<6 hours each month

8 Security Incident Reporting

Security incident reporting requirement is immediately after discovery

Immediately after discovery

*See definition of Normal State Business Hours.

2.5.6 Problem Response Definitions and Times

The TO Contractor shall meet the Problem response time and resolution requirements.

The TO Contractor shall provide a status update in the monthly report to monitor response times and resolution times.

Figure 4: Problem Response Definitions and Times Table

Service Priority

Response Time

Resolution Time

Response Availability

Work Outage Users Affected

Emergency Less than 1 hour

Within 4 hours after the first report

24 hours per day, seven days per week

Major portions of the System are inaccessible Systems or users are unable to work, or to perform some portion of their job.

Affects the majority of users to include public facing users Affects high profile users (i.e. executive management)

Medium Within 4 hours

Within 1 day (24 hours) after the first report. If the outage is not resolved a resolution plan must be in place.

Mon-Fri, 7AM-7PM

Specific non-critical features are not operating as specified Systems or users are unable to perform a small portion of their job, but are able to complete most tasks.

Affects a number of users

Low Within 24 hours

Within 3 days (72 hours) after first report. If the outage is not resolved a resolution

Mon-Fri, 7AM-7PM

Lower priority features that can be done manually are not operating as specified Often a request for service with ample lead time.

Affects a number of users or have the potential to affect a number of users.

TORFP for The Comptroller of Maryland Page 12 of 67

Service Priority

Response Time

Resolution Time

Response Availability

Work Outage Users Affected plan must be in place.

Information Security Incident

Immediatel y upon discovery

Within 1 day (24 hours) after first report. If the outage is not resolved a resolution plan must be in place.

24 hours per day, seven days per week

All Information Security incidents are considered critical until an assessment is made by COM

Affects a number of users or have the potential to affect a number of users.

[THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK]

TORFP for The Comptroller of Maryland Page 13 of 67

3 TO Contractor Requirements: General

3.1 Task Order Initiation Requirements

TO Contractor shall schedule and hold a kickoff meeting within 15 Business Days of NTP Date. At the kickoff, the TO Contractor shall furnish a draft Transition-In Plan to discuss at the meeting to determine how the TO Contractor will transition into our environment.

3.2 End of Task Order Transition

3.2.1 The TO Contractor shall provide transition assistance as requested by the State to facilitate the orderly transfer of services to the State or a follow-on contractor, for a period up to 60 days prior to Task Order end date, or the termination thereof. Such transition efforts shall consist, not by way of limitation, of:

A. Provide additional services and/or support as requested to successfully complete the transition;

B. Maintain the services called for by the Task Order at the required level of proficiency;

C. Provide any documentation, as appropriate; and

D. Provide current operating procedures (as appropriate).

3.2.2 The TO Contractor shall work toward a prompt and timely transition, proceeding in accordance with the directions of the TO Manager. The TO Manager may provide the TO Contractor with additional instructions to meet specific transition requirements prior to the end of Task Order.

3.2.3 The TO Contractor shall ensure that all necessary knowledge and materials for the tasks completed are transferred to the custody of State personnel or a third party, as directed by the TO Manager.

3.2.4 The TO Contractor shall support end-of-Task Order transition efforts with technical and project support to include but not be limited to:

A. The TO Contractor shall provide a draft Transition-Out Plan 30 days in advance of Task Order end date.

B. The Transition-Out Plan shall address at a minimum the following areas:

1. Any staffing concerns/issues related to the closeout of the Task Order;

2. Communications and reporting process between the TO Contractor, the COM and the TO Manager;

3. Security and system access review and closeout;

4. Any hardware/software inventory or licensing including transfer of any point of contact for required software licenses to the COM or a designee;

5. Any final training/orientation of COM staff;

6. Connectivity services provided, activities and approximate timelines required for Transition-Out;

7. Knowledge transfer, to include:

TORFP for The Comptroller of Maryland Page 14 of 67

A working knowledge of the current system environments as well as the general business practices of the

COM;

Review with the COM the procedures and practices that support the business process and current system environments;

Working knowledge of all technical and functional matters associated with the Solution, its architecture, data file structure, interfaces, any batch programs, and any hardware or software tools utilized in the performance of this Task Order;

Documentation that lists and describes all hardware and software tools utilized in the performance of this Task Order;

A working knowledge of various utilities and corollary software products used in support and operation of the Solution;

8. Plans to complete tasks and any unfinished work items (including open change requests, and known bug/issues); and

9. Any risk factors with the timing and the Transition-Out schedule and transition process.

The TO Contractor shall document any risk factors and suggested solutions.

C. The TO Contractor shall ensure all documentation and data including, but not limited to, System Documentation and current operating procedures, is current and complete with a hard and soft copy in a format prescribed by the TO Manager.

3.3 Invoicing

3.3.1 Definitions

A. “Proper Invoice” means a bill, written document, or electronic transmission, readable by the agency, provided by a vendor requesting an amount that is due and payable by law under a written procurement contract for property received or services rendered that meets the requirements of COMAR 21.06.09.02.

B. “Late Payment” means any amount that is due and payable by law under a written procurement contract, without deferral, delay, or set-off under COMAR 21.02.07.03, and remains unpaid more than 45 days after an agency receives a Proper Invoice.

C. “Payment” includes all required processing and authorization by the Comptroller of the Treasury, as provided under COMAR 21.02.07, and may be deferred, delayed, or set-off as applicable under COMAR 21.02.07.03.

3.3.2 General

A. Invoice payments to the TO Contractor shall be governed by the terms and conditions defined in the CATS+ Master Contract.

B. The TO Contractor shall e-mail an original, signed invoice to itinvoices@marylandtaxes.gov and cc the TO Manager at woleary@marylandtaxes.gov.

C. All invoices for services shall be verified by the TO Contractor as accurate at the time of submission.

D. Invoices submitted without the required information cannot be processed for payment. A Proper Invoice, required as Payment documentation, must include the following information, without error:

mailto:itinvoices@marylandtaxes.gov mailto:woleary@marylandtaxes.gov

TORFP for The Comptroller of Maryland Page 15 of 67

1. TO Contractor name and address;

2. Remittance address;

3. Federal taxpayer identification (FEIN) number, social security number, as appropriate;

4. Invoice period (i.e. time period during which services covered by invoice were performed);

5. Invoice date;

6. Invoice number;

7. State assigned TO Agreement number;

8. State assigned (Blanket) Purchase Order number(s);

9. Goods or services provided;

10. Amount due; and

11. Any additional documentation required by regulation or the Task Order.

E. Invoices that contain time and material items shall clearly identify the items as time and material billing.

F. The COM reserves the right to reduce or withhold Task Order payment in the event the TO Contractor does not provide the COM with all required deliverables within the time frame specified in the Task Order or otherwise breaches the terms and conditions of the Task Order until such time as the TO Contractor brings itself into full compliance with the Task Order.

G. Any action on the part of the COM, or dispute of action by the TO Contractor, shall be in accordance with the provisions of Md. Code Ann., State Finance and Procurement Article §§ 15-215 through 15-223 and with COMAR 21.10.04.

H. The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of Columbia sales taxes and transportation taxes. The TO Contractor; however, is not exempt from such sales and use taxes and may be liable for the same.

I. Invoices for final payment shall be clearly marked as “FINAL” and submitted when all work requirements have been completed and no further charges are to be incurred under the TO Agreement. In no event shall any invoice be submitted later than 60 calendar days from the TO Agreement termination date.

3.3.3 Invoice Submission Schedule

Invoices shall be submitted monthly and within 30 days of delivery of goods and services unless otherwise accepted in the TO Proposal or Work Order response.

3.3.4 Time and Materials Invoicing

A. Time and Material invoices shall be accompanied by notice(s) of acceptance issued by the State for all invoices submitted for payment: signed timesheet as described below. Include for each person covered by the invoice the following, individually listed per person: name, TORFP for The Comptroller of Maryland Page 16 of 67 hours worked, hourly labor rate, invoice amount and a copy of each person’s timesheet for the period signed by the TO Manager.

B. Time Sheet Reporting

Within three (3) business days after the 15th and last day of the month, the TO Contractor shall submit a semi-monthly timesheet for the preceding half month providing data for all resources provided under the Task Order.

At a minimum, each semi-monthly timesheet shall show:

1. Title: “Time Sheet for <<xxxxx>>”

2. Issuing company name, address, and telephone number

3. For each employee /resource:

a. Employee / resource name

b. For each Period ending date, e.g., “Period Ending: mm/dd/yyyy” (Periods run 1st through 15th and 16th through last day of the month.

a. Tasks completed that week and the associated deliverable names and ID#s;

b. Number of hours worked each day;

c. Total number of hours worked that Period;

d. Period variance above or below 40 hours;

e. Annual number of hours planned under the Task Order;

f. Annual number of hours worked to date;

g. Balance of hours remaining; and

h. Annual variance to date (Sum of periodic variances).

4. Signature and date lines for the TO Manager

5. Time sheets shall be submitted to the TO Manager prior to invoicing. The TO Manager shall sign the timesheet to indicate authorization to invoice.

3.3.5 For the purposes of this Task Order an amount will not be deemed due and payable if:

A. The amount invoiced is inconsistent with the Task Order.

B. The proper invoice has not been received by the party or office specified in the Task Order.

C. The invoice or performance is in dispute or the TO Contractor has failed to otherwise comply with the provisions of the Task Order.

D. The item or services have not been accepted.

E. The quantity of items delivered is less than the quantity ordered.

F. The items or services do not meet the quality requirements of the Task Order

G. If the Task Order provides for progress payments, the proper invoice for the progress payment has not been submitted pursuant to the schedule.

TORFP for The Comptroller of Maryland Page 17 of 67

H. If the Task Order provides for withholding a retainage and the invoice is for the retainage, all stipulated conditions for release of the retainage have not been met.

I. The TO Contractor has not submitted satisfactory documentation or other evidence reasonably required by the TO Procurement Officer or by the contract concerning performance under the contract and compliance with its provisions.

3.3.6 Travel Reimbursement

A. There shall be no reimbursement for Routine Travel. TO Contractor shall not be reimbursed for Non-Routine Travel without prior TO Manager’s approval.

B. Routine Travel is defined as travel within a 50-mile radius of the COM’s base location, as identified in the TORFP, or the TO Contractor’s facility, whichever is closer to the consulting site. There will be no payment for labor hours for travel time or reimbursement for any travel expenses for work performed within these radiuses or at the TO Contractor’s facility.

C. Non-routine Travel is defined as travel beyond the 50-mile radius of COM’s base location, as identified in the TORFP, or the TO Contractor’s facility, whichever is closer to the consulting site. Non-routine travel will be reimbursed according to the State’s travel regulations and reimbursement rates, which can be found at: www.DBM.maryland.gov -search: Fleet Management. If non-routine travel is conducted by automobile, the first 50 miles of such travel will be treated as routine travel and as described in Section 3.3.6 and will not be reimbursed. The TO Contractor may bill for labor hours expended in non-routine traveling beyond the identified 50-mile radius, only if so specified in the TORFP or Work Order.

3.3.7 Retainage

This solicitation does not require retainage.

3.4 Liquidated Damages

MBE Liquidated damages are identified in Attachment L.

3.5 Disaster Recovery and Data

This section is not applicable to this solicitation.

3.6 Insurance Requirements

3.6.1 Offeror shall confirm that, as of the date of its proposal, the insurance policies incorporated into its Master Contract are still current and effective at the required levels (See Master Contract Section 2.7).

3.6.2 The Offeror shall also confirm that any insurance policies intended to satisfy the requirements of this TORFP are issued by a company that is licensed to do business in the State of Maryland.

3.6.3 The recommended awardee must provide a certificate(s) of insurance with the prescribed coverages, limits and requirements set forth in this Section 3.6 “Insurance Requirements” within five (5) Business Days from notice of recommended award. During the period of performance for multi-year contracts the TO Contractor shall update certificates of insurance annually, or as otherwise directed by the TO Manager.

TORFP for The Comptroller of Maryland Page 18 of 67

3.6.4 CYBER SECURITY / DATA BREACH INSURANCE

The Contractor shall possess and maintain throughout the term of the awarded contract and for three (3) years thereafter, Cyber Risk/ Data Breach insurance (either separately or as part of a broad Professional Liability or Errors and Omissions Insurance) with limits of at least US Ten million dollars ($10,000,000) per claim. Any “insured vs. insured” exclusions will be modified accordingly to allow the State additional insured status without prejudicing the State’s rights under the policy (ies). Coverage shall be sufficiently broad to respond to the Contractor’s duties and obligations under the Contract and shall include, but not be limited to, claims involving privacy violations, information theft, damage to or destruction of electronic information, release of Sensitive Data, and alteration of electronic information, extortion and network security. The policy shall provide coverage for, not by way of limitation, breach response costs as well as regulatory fines and penalties as well as credit monitoring expenses with limits sufficient to respond to these obligations. Security Requirements

3.7 Security Requirements

3.7.1 Employee Identification

A. TO Contractor Personnel shall display his or her company ID badge in a visible location at all times while on State premises. Upon request of authorized State personnel, each such TO Contractor Personnel shall provide additional photo identification.

B. TO Contractor Personnel shall cooperate with State site requirements, including but not limited to, being prepared to be escorted at all times, and providing information for State badge issuance.

C. TO Contractor shall remove any TO Contractor Personnel from working on the Task Order where the State determines, in its sole discretion, that said TO Contractor Personnel has not adhered to the Security requirements specified herein.

D. The State reserves the right to request that the TO Contractor submit proof of employment authorization of non-United States Citizens, prior to commencement of work under the Task Order.

E. Unless otherwise specified, the cost of complying with all security requirements specified herein are the sole responsibility and obligation of the TO Contractor and no such costs shall be passed through to or reimbursed by the State or any of its agencies or units.

3.7.2 Criminal Background Checks

A. The TO Contractor shall obtain from all Contractor Personnel assigned to work on the Task Order a signed statement permitting a criminal background check. Prior to commencement of work, the TO Contractor shall secure at its own expense the following type of national criminal history record check and provide the TO Contract Manager with completed checks on such Contractor Personnel prior to assignment:

1. A national criminal history record check. This check may be performed by a public or private entity; and

2. A Maryland and/or FBI Criminal Justice Information System criminal history record check.

B. At a minimum, these background checks must include all convictions and probation before judgment (PBJ) dispositions. The TO Contractor may not assign an individual whose

TORFP for The Comptroller of Maryland Page 19 of 67 background check reflects any criminal activity to work under this Task Order unless prior written approval is obtained from the TO Contract Manager.

C. TO Contractor shall be responsible for ensuring that TO Contractor Personnel background check certifications are renewed annually, and at the sole expense to the TO Contractor.

D. Further, TO Contractor Personnel may be subject to random security checks during entry and exit of State secured areas. The State reserves the right to require TO Contractor Personnel to be accompanied while on secured premises.

3.7.3 On-Site Security Requirement(s)

A. For the conditions noted below, TO Contractor Personnel may be barred from entrance or leaving any site until such time that the State’s conditions and queries are satisfied.

1. TO Contractor Personnel may be subject to random security checks when entering and leaving State secured areas. The State reserves the right to require TO Contractor Personnel to be accompanied while in secured premises.

2. Some State sites, especially those premises of the Department of Public Safety and Correctional Services, require each person entering the premises to document and inventory items (such as tools and equipment) being brought onto the site, and to submit to a physical search of his or her person. Therefore, TO Contractor Personnel shall always have available an inventory list of tools being brought onto a site and be prepared to present the inventory list to the State staff or an officer upon arrival for review, as well as present the tools or equipment for inspection. Before leaving the site, the TO Contractor Personnel will again present the inventory list and the tools or equipment for inspection. Upon both entering the site and leaving the site, State staff or a correctional or police officer may search TO Contractor Personnel. Depending upon facility rules, specific tools or personal items may be prohibited from being brought into the facility.

B. Any TO Contractor Personnel who enters the premises of a facility under the jurisdiction of the COM may be searched, fingerprinted (for the purpose of a criminal history background check), photographed and required to wear an identification card issued by the COM.

C. Further, TO Contractor Personnel shall not violate Md. Code Ann., Criminal Law Art.

Section 9-410 through 9-417 and such other security policies of the agency that controls the facility to which the TO Contractor Personnel seeks access. The failure of any of the TO Contractor Personnel to comply with any provision of the TO Agreement is sufficient grounds for the State to immediately terminate the TO Agreement for default.

3.7.4 Information Technology

THIS SECTION IS NOT APPLICABLE TO THIS TORFP.

3.8 Security Incident Response

The TO Contractor and TO Contractor Personnel shall comply with and adhere to the COM’s Data Incident Response Policy and Procedures.

TORFP for The Comptroller of Maryland Page 20 of 67

3.9 Confidentiality of IRS and State Tax Information

A. In performance of this TO Agreement, the TO Contractor agrees to comply with and assume responsibility for compliance by Contractor Personnel with the following requirements:

1. All work will be performed under the supervision of the TO Contractor or the TO Contractor…