PORFP SAS Renewal

The State of Maryland is soliciting bids through a Purchase Order Request for Proposal (PORFP) for SAS Software Maintenance Renewal, with proposals due November 10, 2025. This secondary competition is restricted to Master Contractors currently awarded under the Commercial Off-the-Shelf Software (COTS 2012) contract 060B2490021 — a hard eligibility gate that excludes all other vendors.

Only current Master Contractors holding active COTS 2012 awards may submit bids. Eligible contractors may include a Letter of Authorization (LOA) with their proposal to demonstrate authorization to participate in the renewal.

The procurement covers SAS software maintenance renewal services, with pricing terms and detailed cost structure specified in Attachment A.xlsx (a 12KB pricing spreadsheet). The exact scope, licensing quantities, contract duration, and renewal options are contained within the attached procurement documents.

The source materials establish significant compliance obligations that apply regardless of award. Contractors must ensure all digital products, services, documents, and deliverables comply with Education Article 7-910 of the Annotated Code of Maryland, Title II of the Americans with Disabilities Act, the Federal Rehabilitation Act of 1973, and Web Content Accessibility Guidelines (WCAG) 2.1, Level AA standards. Contractors are responsible for annual accessibility compliance audits using Voluntary Product Accessibility Templates (VPAT) and must remediate non-compliance within thirty days at no additional cost. Contractors must also comply with Maryland's System Development Life Cycle (SDLC) methodology, IT Security Policies and Standards, FIPS 140-3 cryptographic requirements, and federal privacy standards including the Protection of Information by Government Agencies (PIGA) statute. All State data must be processed and stored exclusively within the continental United States. Contractors must maintain separate production, test, and training environments; implement encryption for sensitive data in transit and at rest; perform daily incremental and weekly full backups; maintain disaster recovery sites at least 100 miles from primary operations with one-hour recovery point objectives; provide 24/7 technical support; conduct criminal background checks on all personnel accessing State premises or data; submit annual SOC 2 Type 2 Audit Reports at their own expense; and notify the State of security incidents within 24 hours and data breaches within one business day. All deliverables must be compatible with Microsoft Office, Microsoft Project, or Microsoft Visio within two versions of the current release.