Request for Proposal. South Dakota Department of Transportation - Office of Air, Rail, and Transit

Transcription

1 Request for Proposal South Dakota Department of Transportation - Office of Air, Rail, and Transit Asset Management Software Specifications and Appendix A, B, C, and D 1.0 GENERAL INFORMATION June 20, PURPOSE OF REQUEST FOR PROPOSAL The purpose of this Request for Proposal ( RFP ) is to solicit software vendors that have Transit Asset Management (TAM) compliant software programs. The ultimate objective is for the software program to collect various categories of data pertaining to our vehicles, facilities, and equipment; be able to prioritize the vehicles, facilities, and equipment in an order of replacement; and to develop a replacement plan based on various data and established criteria. 1.2 ISSUING OFFICE AND RFP REFERENCE NUMBERS The SDDOT is the issuing office for this document and all subsequent addenda relating to it on behalf of the State of South Dakota, Department of Transportation. Unless the names of specific agencies are needed for clarity, the term State will be used in this RFP to refer to the SDDOT, the Bureau of Information and Telecommunications ( BIT ), other selected State of South Dakota agencies or South Dakota state government as a whole. However, SDDOT will be the coordinating agency for all matters related to any agreement resulting from this RFP. The reference number for the transaction is RFP# This number must be referred to on all proposals, correspondence, and documentation relating to the RFP. 1.3 SCHEDULE OF ACTIVITIES (SUBJECT TO CHANGE) RFP Publication: June 20, 2017 Deadline for Submission of Written Inquiries: July 07, 2017 Responses to Offer or Questions: July 11, 2017 Proposal Submission: 2 PM CT July 18, 2017 Oral Presentations/discussions (if required): July 25, 2017 Proposal Revisions (if required): July 27, 2017 Anticipated Award Decision/Contract Negotiation: July 31, SUBMITTING YOUR PROPOSAL All proposals must be completed and received at the SDDOT by the date and time indicated in the Schedule of Activities. Proposals received after the deadline will be late and ineligible for consideration. An original and (1) identical copy of the proposal must be submitted. The cost proposal must be in a separate sealed envelope and labeled Cost Proposal. All proposals must be signed, in ink, by an officer of the Vendor, legally authorized to bind the Vendor to the proposal, and sealed in the form described in this RFP. Proposals that are not properly signed may be rejected. The sealed envelope must be marked with the 1

2 appropriate RFP number and title. The words Sealed Proposal Enclosed must be prominently denoted on the outside of the shipping container. Proposals must be addressed and labeled as follows: REQUEST FOR PROPOSAL #1057 PROPOSAL DUE: 2PM July 18, 2017 BUYER: JACK DOKKEN PROGRAM MANAGER SOUTH DAKOTA DEPARTMENT OF TRANSPORTATION 700 E BROADWAY AVE PIERRE SOUTH DAKOTA All capital letters and no punctuation are used in the address. The address as displayed should be the only information in the address field. No proposal will be accepted from, or no contract or purchase order will be awarded to any person, firm, or corporation that is in arrears upon any obligations to the State of South Dakota, or that otherwise may be deemed irresponsible or unreliable by the State of South Dakota. 1.5 Certification Regarding Debarment, Suspension, Ineligibility and Voluntary Exclusion Lower Tier Covered Transactions By signing and submitting a proposal or two (2) proposals, the Vendor certifies that neither it nor its principals is presently debarred, suspended, proposed for debarment, declared ineligible or voluntarily excluded from participation, by any federal department or agency, from transactions involving the use of federal funds. Where the Vendor is unable to certify to any of the statements in this certification, the Vendor will attach an explanation to its proposal(s). 1.6 Prior Obligations No proposal may be accepted from and no contract or purchase order may be awarded to any person, firm or corporation that is in arrears upon any obligations to the State, or that otherwise may be deemed irresponsible or unreliable by the State Director of Procurement Management. 1.7 Nondiscrimination Statement The State requires that all contractors, vendors, and suppliers doing business with the State to provide a statement of nondiscrimination. By signing and submitting its proposal(s), the Vendor certifies it does not discriminate in its employment practices with regard to race, color, creed, religion, age, sex, ancestry, national origin, or disability. 1.8 Modification or Withdrawal of Proposals Proposals may be modified or withdrawn by the Vendor prior to the established due date and time. No oral, telephonic, or facsimile responses or modifications to informal bids, formal bids or RFPs will be considered. 1.9 Vendor Inquiries Vendors and their agents (including subcontractors, employees, consultants, or anyone acting on their behalf) may inquiries concerning this RFP to obtain clarification of requirements. No inquiries will be accepted after the date and time indicated in 1.3, 2

3 Schedule of Activities. inquiries must be sent to Doug Gorham with the subject line RFP #1057. The SDDOT prefers to respond to Vendors inquiries (if required) via . Vendors will be notified in the same manner as indicated above regarding any modifications to this RFP. Vendors may not rely on any other statements, either of a written or verbal nature, that alter any specification or other term or condition of this RFP. Vendors may request notification of all inquiries and responses by sending an to Doug Gorham with the subject line RFP #1057. The source of all inquiries will remain confidential. Vendors and their agents may not contact the SDDOT regarding any of these matters during the solicitation and evaluation process. Inappropriate contacts are grounds for suspension or exclusion from specific procurements. Vendors and their agents who have questions regarding this matter should send an to Doug.Gorham@state.sd.us Proprietary Information The proposal of the successful Vendor becomes public information. Proprietary information can be protected under limited circumstances, such as client lists and nonpublic financial statements. Pricing and service elements are not considered proprietary. An entire proposal may not be marked as proprietary. Vendors must clearly identify in the executive summary and the body of the proposal any specific proprietary information they want to protect, and the executive summary must contain specific justification explaining why the information is to be protected. Proposals may be reviewed and evaluated by any person at the discretion of the SDDOT. All materials submitted become the property of the State and may be returned only at the State s option Governing Law Venue for any and all legal action regarding or arising out of the transaction covered under this RFP will be solely in the State of South Dakota. The laws of South Dakota will govern this transaction Discussions with Vendors (Oral Presentation/Negotiations) An oral presentation by a Vendor to clarify a proposal may be required at the sole discretion of the SDDOT. However, the SDDOT may award a contract based on the initial proposals received without discussion with the Vendor. If oral presentations are required, they will be scheduled after the submission of proposals. Oral presentations will be made at the Vendor s expense. This process is a Request for Proposal/Competitive Negotiation process. Each proposal will be evaluated, and each Vendor will be available for negotiation discussions and meetings at the SDDOT s request. The SDDOT reserves the right to negotiate on any components of every proposal submitted. From the time the proposals are submitted until the formal award of a contract, each proposal is considered a working document and as such, will be kept confidential. The negotiation discussions also will be held as confidential until the award is completed Financial Statements A Vendor may be required to submit a copy of its most recent audited financial statement if deemed necessary by the State s Office of Procurement Management Best Interest of South Dakota 3

4 The SDDOT reserves the right to reject any or all proposals and may waive any immaterial deviation or defect in a proposal and make award(s) as deemed to be in the best interest of the State. The SDDOT s waiver of an immaterial deviation or defect will in no way modify the RFP or excuse the proposing Vendor from full compliance with the RFP requirements This RFP Is Not a Final Agreement or Contract 2.0 Scope of Work This RFP should not be understood to be an agreement or contract to purchase goods or services. It will not necessarily result in a future agreement or contract. Nonetheless, responses to the RFP should be as detailed and complete as possible, so that if the SDDOT decides to pursue an agreement, responses to this RFP can be used to draft an agreement. The system will be cloud solution based software system with web interface to assist in asset management, analysis, and reporting. This must be a secure system with user name and password functionality. Software must be Federal Transit Administration (FTA) Transit Asset Management compliant and provide: (1) Asset inventory (rolling stock, facilities, and equipment) (2) Condition assessment of assets (3) Decision support tools (4) Prioritization of assets based on established criteria (5) National Transit Database compliant Website references: NTD: Transit Assist Management: Software must be capable of importing data from third party software system programs such as Excel, Access, Routing Software, or maintenance software to import maintenance records and inspections. The system must have the capability to allow a minimum of at least external users, with individual log in credentials. The system will have the capability of providing administrator the authority to define user rights and roles. The system must have the capability to store and analyze data for at least 800 vehicles, 45 buildings, 200 individual pieces of equipment and provide the flexibility to handle additional assets as the South Dakota Department of Transportation s ( SDDOT ) assets increase. The system must be easily capable of being updated as technology, as well as program requirements, change over the intended life of the system. The system should have functioning standardized reports and queries and have the capability for users to customize reports using system data. Vendor will be required to supply a data dictionary. Planning and prioritization functions will include the following; Asset Registry Listing of all asset with identifying data Asset Maintenance Data Preventive, routine, or emergency maintenance records Vendor name Invoice date 4

5 Invoice number Cost payment date Amount Check number Description of work performed Odometer or hours reading Customizable fields that can be defined by SDDOT Asset Condition Data Customizable asset scorecard criteria consisting of 5 to 7 categories for vehicle, facilities, and equipment based on SDDOT s Asset Management Plan. Proposed Investment Priority List Develop replacement plan based on pertinent asset information, maintenance records, and scorecard criteria. The system will have a task scheduling function to allow users to schedule tasks based on their asset inventory maintenance and inspection data. The system will also have the capabilities to enable the SDDOT to assign tasks to the external users. The system will allow users to develop preventive maintenance schedules or inspection forms for each asset based on manufacture recommendation and requirements. The functionality of the system will also capture inspection completed dates, future inspection, and preventive maintenance dates. The Vendor will provide an implementation schedule and plan. The Vendor will provide ongoing technical support through various means of communication as appropriate to the situation. The Vendor will identify the costs for this service in the cost proposal. The Vendor will provide detailed and comprehensive training sessions to the SDDOT personnel and external users. The Vendor will identify the costs for this service in the cost proposal. The Vendor will provide a one-year warranty service following final system acceptance. After the initial one-year warranty expires, the maintenance agreement will begin. The SDDOT requires that the Vendor provide upgrades to ensure the most recent technology is being utilized and new requirements are implemented as required. Costs for this service will be identified in the proposal. The SDDOT wants to understand the capabilities of the system and any enhancements that are readily built in or could be added in the future. One particular area of interest is the system s capability of calculating the future useful life and condition of the equipment. The Vendor will provide a narrative explaining deviations from the specification listed in the RFP. The Vendor is also required to provide a demonstration to showcase the software functionality beyond minimum required specifications. 3.0 PROPOSAL RESPONSE FORMAT 3.1 Copies The Vendor must submit an original and (1) identical copy of each proposal The Vendor must number the proposal pages and include a table of contents. 3.2 Proposal Organization All proposals must be organized and tabbed with labels with these headings: 5

6 3.2.1 RFP form: The SDDOT Request for Proposal form, on page 1 of the RFP, completed and signed Executive summary: The one- or two-page executive summary will briefly describe the Vendor s proposal. It must identify any requirements that cannot be met by the Vendor. A reader should be able to ascertain the essence of the proposal by reading the executive summary. Proprietary information requests should be stated here Detailed responses: This section should constitute the major portion of the proposal Assessment of work: a complete narrative of the Vendor s assessment of the work to be performed, the Vendor s ability and approach, and the resources necessary to fulfill the requirements; demonstrating the Vendor s understanding of the desired overall performance expectations. This assessment should include answers to the questions in the three tables, in section 2 Scope of Work, and any explanations of No responses Project plan: the responsibilities and schedule for performing the work. The Vendor will provide a project plan that indicated how the Vendor will complete the required deliverables and services and addresses the following: Proposed project management techniques; Number of Vendor s staff needed; Tasks to be performed (within phase as applicable); Number of hours each task will require; Deliverables created by each task; Dates by which each task will be completed (dates should be indicated in terms of elapsed time from project inception); Resources assigned to each task; Required State agency support; Show task dependencies; and Training (if applicable) The schedule should be a separate document, provided in Microsoft Project of Microsoft Excel and submitted as an attachment to the Vendor s proposal. If, as part of the project, the Vendor plans to set-up or configure the software or hardware and plans to do this outside of South Dakota, even in part, then the Vendor needs to provide a complete and detailed project plan on how the Vendor plans on migrating to the State s site. Failure to do so is sufficient grounds to disregard the Vendor s submission, as it demonstrates that the Vendor fundamentally does not understand the project. Providing a work plan for the steps identified in this section that is complete and detailed may be sufficient Cost proposal: a detailed description of: any one-time charges, annual fees, any per-user fees for technical requirements listed in this RFP, and additional options offered by the Vendor. A sample cost proposal is attached to this RFP as Appendix E. The Vendor may be expected to perform additional work as required by any of the State signatories to the agreement. This work can be made a requirement 6

7 by the State for allowing the application to go into production. This additional work will not be considered a project change chargeable to the State if it is for reasons of correcting security deficiencies, meeting the functional requirements established for the application, unsupported third party technologies, or excessive resource consumption. The Vendor should include the cost for additional work in the Vendor s proposal Professional references: information related to recent or current contracts performed by the Vendor s organization, similar to the requirements of this RFP, including: Client/Company name, Client/Company address, Client/Company Name of contact(s) and title(s), address and telephone number of the client contacts who can be contacted for all information submitted; Statement of permission for the SDDOT to contact the clients and for the clients contact(s) to release information to the SDDOT; Contract dates; and A brief written description of the services performed and the solutions provided for the clients, including timelines of project start dates and production dates of each fully operational module of EPSS software Contract terms acceptability: The Vendor will comply with BIT s standard contract terms and conditions attached to this RFP as Appendix A and incorporated into this RFP by reference. The Vendor will submit a statement indicating the acceptability of BIT s technology-specific standard contract terms and conditions, attached to this RFP as Appendix A. Include explanations of any unacceptable provisions; The Vendor will comply and sign BIT s Security Acknowledgment Form attached to this RFP as Appendix B; The Vendor will comply with the State s standard contract terms and conditions attached to this RFP as Appendix C and incorporated into this RFP by reference. A statement indicating the acceptability of State s standard contract terms and conditions, attached to this RFP as Appendix C. Include explanations of any unacceptable provisions; and Any agreement resulting from this RFP will include BIT s terms and conditions listed in Appendices A and B, along with any additional contract terms as negotiated by the parties. As part of the negotiation process, the contract terms listed in Appendices A or B may be altered or deleted with the approval of the State. The Vendor should indicate in the Vendor s response, any issues the Vendor may have with specific contract terms. If the Vendor does not indicate there are any issues with any contact term, then the State will assume those terms are acceptable to the Vendor BIT Security and Vendor Questions form, attached to this RFP as Appendix D. The Vendor will answer and complete the BIT security and vendor questions form attached to this RFP as Appendix D and incorporated into this RFP by reference. 7

8 4.0 PROPOSAL EVALUATION AND AWARD PROGRESS 4.1 After determining that a proposal satisfies the mandatory requirements stated in the Request for Proposal, the evaluator(s) will use subjective judgment in conducting a comparative assessment of the proposal by considering each of the following criteria: Specialized expertise, capabilities, and technical competence as demonstrated by the proposed approach and methodology to meet the project requirements; Resources available to perform the work, including any specialized services, within the specified time limits for the project; Record of past performance, including price and cost data from previous projects, quality of work, ability to meet schedules, cost control, and contract administration; Availability to the project locale; Familiarity with the project locale; Proposed project management techniques; and Ability and proven history in handling special project constraints. The proposals will be evaluated using a qualified criteria system. An objective scoring procedure will be used in rating the RFPs. The scoring is based on the following: Software meets the required minimum specifications Additional transit related modules Functions beyond minimum specifications BIT evaluation and testing results Cost: Initial software costs Implementation associated costs Training associated costs Breakdown of User fees Maintenance fees Technical support fees Enhancement costs 4.2 Experience and reliability of the responder s organization are considered subjectively in the evaluation process. Therefore, the responder is advised to submit any information which documents successful and reliable experience in past performances, especially those performances related to the requirements of this RFP. 4.3 The qualifications of the personnel proposed by the responder to perform the requirements of this RFP, whether from the responder s organization or from a proposed subcontractor, will be subjectively evaluated. Therefore, the responder should submit detailed information related to the experience and qualifications, including education and training, of proposed personnel. 4.4 The State reserves the right to reject any or all proposals, waive technicalities, and make award(s) as deemed to be in the best interest of the State of South Dakota. 4.5 Award: The requesting agency and the highest ranked responder will mutually discuss and refine the scope of services for the project and will negotiate terms, including compensation and performance schedule. 8

9 4.5.1 If the agency and the highest ranked responder are unable for any reason to negotiate a contract at a compensation level that is reasonable and fair to the agency, the agency shall, either orally or in writing, terminate negotiations with the responder. The agency may then negotiate with the next highest ranked responder The negotiation process may continue through successive offerors, according to agency ranking, until an agreement is reached or the agency terminates the contracting process. 9

10 APPENDIX A STATE OF SOUTH DAKOTA BUREAU OF INFORMATION AND TELECOMMUNICATIONS (BIT) STANDARD CONTRACT TERMS AND CONDITIONS Any contract or Agreement resulting from this RFP will include BIT s standard terms and conditions, along with any additional terms and conditions as negotiated by the parties. As part of the negotiation process the terms and conditions listed may be altered. The Offeror should indicate in their response any issues they have with specific contract terms if the Offeror does not indicate that there are any issues with any contract terms then the State will assume those terms are acceptable to the Offeror. There is also a list of technical questions, Security and Vendor Questions which is attached as Appendix D. These questions must be answered and may be used in the proposal evaluation. Data Privacy The Contractor will use State data and end-user data only for the purpose of fulfilling its duties under this Agreement and for the SDDOT s and its end user s sole benefit, and will not share such data with, or disclose it to, any third party, without the prior written consent of the SDDOT or as otherwise required by law. By way of illustration and not of limitation, the Contractor will not use such data for the Contractor s own benefit and, in particular, will not engage in data mining of State or end user data or communications, whether through automated or human means, except as specifically and expressly required by law or authorized in writing by the SDDOT through an SDDOT employee or officer specifically authorized to grant such use of State data. The Contractor will provide access to State and end-user data only to those Contractor employees and subcontractors who need to access the data to fulfill the Contractor s obligations under this Agreement. Confidentiality of Information For purposes of this paragraph, State Proprietary Information shall include all information disclosed to the Consultant by the State as well as information collected by the Cameras systems. The Consultant, and Consultant s Subcontractors, Agents, Assigns and/or Affiliated Entities shall not disclose any State Proprietary Information to any third person for any reason without the express written permission of a State officer or employee with authority to authorize the disclosure. The Consultant, and Consultant s Subcontractors, Agents, Assigns and/or Affiliated Entities shall not: (i) disclose any State Proprietary Information to any third person unless otherwise specifically allowed under this agreement; (ii) make any use of State Proprietary Information except to exercise rights and perform obligations under this agreement; (iii) make State Proprietary Information available to any of its employees, officers, agents or third party Consultants except those who have a need to access such information and who have agreed to obligations of confidentiality at least as strict as those set out in this agreement. The Consultant, and Consultant s Subcontractors, Agents, Assigns and/or Affiliated Entities is held to the same standard of care in guarding State Proprietary Information as it applies to its own confidential or proprietary information and materials of a similar nature, and no less than holding State Proprietary Information in the strictest confidence. The Consultant, and Consultant s Subcontractors, Agents, Assigns and/or Affiliated Entities shall protect the confidentiality of the State s information from the time of receipt to the time that such information is either returned to the State or destroyed to the extent that it cannot be recalled or reproduced. The Consultant, and Consultant s Subcontractors, Agents, Assigns and/or Affiliated Entities agree to return all information received from the State to State s custody upon the end of the term of this agreement, unless otherwise agreed in a writing signed by both parties. State Proprietary Information shall not include 10

11 information that (i) was in the public domain at the time it was disclosed to the Consultant, and Consultant s Subcontractors, Agents, Assigns and/or Affiliated Entities ; (ii) was known to the Consultant, and Consultant s Subcontractors, Agents, Assigns and/or Affiliated Entities without restriction at the time of disclosure from the State; (iii) that was disclosed with the prior written approval of State s officers or employees having authority to disclose such information; (iv) was independently developed by the Consultant, and Consultant s Subcontractors, Agents, Assigns and/or Affiliated Entities without the benefit or influence of the State s information; (v) becomes known to the Consultant, and Consultant s Subcontractors, Agents, Assigns and/or Affiliated Entities without restriction from a source not connected to the State of South Dakota. State s Proprietary Information can include names, social security numbers, employer numbers, addresses and other data about applicants, employers or other clients to whom the State provides services of any kind. Consultant understands that this information is confidential and protected under State law. The parties mutually agree that neither of them nor any Consultant, and Consultant s Subcontractors, Agents, Assigns and/or Affiliated Entities shall disclose the contents of this agreement except as required by applicable law or as necessary to carry out the terms of the agreement or to enforce that party s rights under this agreement. Consultant acknowledges that the State and its agencies are public entities and thus may be bound by South Dakota open meetings and open records laws. It is therefore not a breach of this agreement for the State to take any action that the State reasonably believes is necessary to comply with South Dakota open records or open meetings laws. Data exchange and Encrypted Data Storage All facilities used to store and process State s data will employ commercial best practices, including appropriate administrative, physical, and technical safeguards, to secure such data from unauthorized access, disclosure, alteration, and use. Such measures will be no less protective than those used to secure the Consultant s own data of a similar type, and in no event less than reasonable in view of the type and nature of the data involved. Without limiting the foregoing, the Consultant warrants that all State s data will be encrypted in transmission (including via web interface) at no less than SHA256 level encryption with SHA256 or SHA2 hashing. Disposal of State Data The Consultant, and Consultant s Subcontractors, Agents, Assigns and/or Affiliated Entities shall securely dispose of all data in all forms, such as disk, CD/ DVD, backup tape and paper, when requested by the State. Data shall be permanently deleted and shall not be recoverable, according to National Institute of Standards and Technology (NIST) approved methods. Certificates of Destruction shall be provided to the State upon request. Handling of Data Breaches The Contractor will implement, maintain and update security incident and data breach procedures that comply with all State and federal requirements. A data breach is the disclosure of unauthorized access to, use of, modification of, or destruction of State data or the interference with system operations in an information system containing State data. The Contractor also will: 1. Fully investigate the incident; 2. Cooperate fully with the State s investigation of, analysis of, and response to the incident; 3. Promptly implement necessary remedial measures; and, 4. Document responsive actions taken related to the data breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services. The Contractor will use a Forensics Company, advisors and public relations firm that are acceptable to the State, preserve all evidence including but not limited to communications, documents, and logs, and the State will have the authority to set the scope of the investigation. In addition, the Contractor shall 11

12 inform the SDDOT and BIT of the actions it is taking or will take to reduce the risk of further loss to the State. Except as otherwise required by law, the Contractor shall only provide notice of the incident to BIT and the SDDOT. The SDDOT and BIT will determine whether notification to the affected parties will jeopardize the SDDOT s interests and whether it would be more appropriate for the Contractor to provide notification. The method and content of the notification of the affected parties must be coordinated with, and is subject to, approval by the State. If the Contractor is required by federal law or regulation to conduct a security incident or data breach investigation, the results of the investigation must be reported to the SDDOT and BIT. If the Contractor is required by federal law or regulation to notify the affected parties, the SDDOT and BIT must also be notified. Notwithstanding any other provision of this Agreement, and in addition to any other remedies available to the State under law or equity, the Contractor will reimburse the State in full for all costs incurred by the State in investigation and remediation of such data breach including, but not limited, to providing notification to third parties whose data were compromised and to regulatory agencies or other entities as required by law or contract. The Contractor shall pay any and all legal fees, audit costs, fines, and other fees also imposed by regulatory agencies or contracting partners as a result of the data breach. Security Incident and Breach Responsibilities The Contractor, unless stipulated otherwise, shall notify the BIT State Contact and SDDOT within 12 hours if the Contractor reasonably believes there has been a security incident. If notification of a security incident or data breach to the BIT State Contact and SDDOT is delayed because it may impede a criminal investigation or jeopardize homeland or federal security, notification must be given to the SDDOT and BIT within twelve (12) hours after law enforcement provides permission for the release of information on the security incident or data breach. Notification to the SDDOT and BIT should include at a minimum: 1. Name of and contact information for the Contractor s Point of Contact for the security incident or data breach; 2. Date and time of the security incident or data breach; 3. Date and time the security incident or data breach was discovered; 4. Description of the security incident or data breach including the data involved, being as specific as possible; 5. Potential number of records known, and if unknown the range of records; 6. Address where the security incident or data breach occurred; and, 7. The nature of the technologies involved. Notifications must be sent electronically and encrypted via federally approved encryption techniques. If there are none, use 128-bit encryption. The Contractor shall use the term data incident report in the subject line of the . If all of the information is not available for the notification within the specified period of time, the Contractor shall provide the SDDOT and BIT with all of the available information. 12

13 Handling of Security Incident At the State s discretion the Consultant will preserve all evidence including but not limited to communications, documents, and logs. The Consultant will also (i) fully investigate the incident, (ii) cooperate fully with the State s investigation of, analysis of, and response to the incident, (iii.) make a best effort to implement necessary remedial measures as soon as it is possible and (iv) document responsive actions taken related to the Security Incident, including any post-incident review of events and actions taken to implement changes in business practices in providing the services covered by this agreement. The State will set the scope of any investigation. The State can require a risk assessment of the Consultant, the State mandating the methodology to be used as well as the scope. At the State s discretion a risk assessment may be performed by a third party at the Consultant s expense. If the Consultant is required by federal law or regulation to conduct a Security Incident or data breach investigation, the results of the investigation must be reported to the State within twelve (12) hours of the investigation report being completed. If the Consultant is required by federal law or regulation to notify the affected parties, the State must also be notified, unless otherwise required by legal requirements. Notwithstanding any other provision of this agreement, and in addition to any other remedies available to the State under law or equity, the Consultant will reimburse the State in full for all costs incurred by the State in investigation and remediation of the Security Incident including, but not limited, to providing notification to regulatory agencies or other entities as required by law or contract. The Consultant shall also pay any and all legal fees, audit costs, fines, and other fees imposed by regulatory agencies or contracting partners as a result of the Security Incident. Work Products The Contractor shall be responsible for the professional quality, technical accuracy, timely completion, and coordination of all services furnished by the Contractor and any subcontractors, if applicable, under this Agreement. It shall be the duty of the Contractor to assure that the services and the system are technically sound and in conformance with all pertinent federal, State of South Dakota and local statutes, codes, ordinances, resolutions and other regulations. The Contractor shall, without additional compensation, correct or revise any errors or omissions in its work products. The Contractor hereby acknowledges and agrees that all State proprietary information, end-user data, personal or protected health information (PHI), Family Educational Rights and Privacy Act (FERPA), PII or federal tax information (FTI), and information considered confidential under State of South Dakota law, and all information contained therein provided to the State in connection with its performance under this Agreement shall belong to and is the property of the SDDOT and will not be used in any way by the Contractor without the written consent of the State. 13

14 Product Conformity The SDDOT has twelve (12) months following final acceptance of the product(s) delivered by the Contractor pursuant to this Agreement to verify that the product(s) conform to the requirements of this Agreement and perform according to the Contractor s system design specifications. Upon the SDDOT s recognition of an error, deficiency, or defect, the Contractor shall be notified by the SDDOT. The notification shall cite any specific deficiency (deficiency being defined as the Contractor having performed incorrectly with the information previously provided by the State, not the Contractor having to modify a previous action due to additional and/or corrected information from the State. The Contractor at no additional charge to the SDDOT shall provide a correction or provide a mutually acceptable plan for correction within thirty (30) days following the receipt of the SDDOT s notice to the Contractor. If the Contractor s correction is inadequate to correct the deficiency, or defect, or if error recurs, the SDDOT may, at its option, act to correct the problem. The Contractor shall be required to reimburse the State for any such costs incurred or the SDDOT may consider this to be a breach of the Agreement. Information Technology Standards Any software or hardware provided under this Agreement will comply with BIT standards found at Browser The system, site, and/or application must be compatible with the State s current browser standard which can be found at BIT standards are inclusive Explorer 11 and Microsoft Edge. QuickTime, PHP, and Adobe ColdFusion, Adobe Flash or Adobe Animate CC will not be used in the system, site, and/or application. Use of Subcontractors The Contractor may not use subcontractors or agents to perform the services described herein without the express prior written consent of the SDDOT. The Contractor will include provisions in its subcontracts requiring any subcontractors or agents to comply with the applicable provisions of this Agreement; any code developed by a subcontractor or agent must be as secure as code developed by the Contractor, to indemnify the State, and to provide insurance coverage for the benefit of the State in a manner consistent with this Agreement. The Contractor will cause its subcontractors, agents, and employees to comply with applicable federal, State of South Dakota and local laws, regulations, ordinances, guidelines, permits and requirements and will adopt such review and inspection procedures as are necessary to assure such compliance. The Contractor also agrees to take reasonable steps including, but not limited to, all steps explicitly required elsewhere in this Agreement and all other steps as are reasonable under the circumstances to ensure that its employee s or agent s actions or omissions do not cause a breach of the terms of this Agreement. Application of Contract Terms to Subcontractors All of the following terms and provisions are applicable to each and every entity hosting State data. If the Contractor subcontracts any hosting of State data to another entity, the relationship between the Contractor and any such subcontracting entity must be that of principal and agent. No such agent may act as an independent contractor for the Contractor. The Contractor must include in its contract with any such agent explicit terms providing for this principal and agent relationship, and the Contractor must further supervise such agent so as to insure that such agent complies with all of the following terms. 14

15 Rejection or Ejection of Vendor or Subcontractor Employee The State at its option may require the vetting of any subcontractors and or agents. The Contractor is required to assist in this process as needed. The State reserves the right to reject any person from the project who the State believes would be detrimental to the project or is considered by the State to be a security risk. The State reserves the right to require the Contractor to remove from the project any person the State believes is detrimental to the project or is considered by the State to be a security risk. The SDDOT and BIT will provide the Contractor with notice of its determination, and the reasons it requires the removal. If the State signifies that a potential security violation exists with respect to the request, the Contractor shall immediately remove the individual from the project. Background checks The State requires all employee(s) of the Contractor, subcontractors and agent(s) who write or modify State-owned software, alter hardware, configure software of State-owned technology resources, have access to source code and/or protected PII or other confidential information or have access to secure areas to have fingerprint-based background checks. These background checks must be performed by the State with support from State law enforcement resources. The State will supply the fingerprint cards and the procedure that is to be used to process the fingerprint cards. Project plans should allow two to four weeks to complete this process. If work assignments change after the initiation of the project covered by this Agreement so that employee(s) of the Contractor, subcontractor(s) and or agent(s) will be writing or modifying State-owned software, altering hardware, configuring software of technology resources, have access to source code and/or protected PII or other confidential information or have access to secure areas then, background checks must be performed on any employees who will complete any of the referenced tasks. The State reserves the right to require the Contractor to prohibit any employee, subcontractor or agent from performing work under this Agreement that the State, in its sole discretion, believe is detrimental to the project or is considered by the State to be a security risk, based on the results of the background check. The State will provide the Contractor with notice of their determination. Security Acknowledgement Form Contractor employees and any subcontractors as well as the subcontractors employees, participating in the work covered by this Agreement will be required to sign the Security Acknowledgement form attached to this Agreement as Appendix B. The signed Security Acknowledgement form(s) must be given to BIT and approved by BIT before work under the Agreement may begin. This form commits the Contractor to abide by the terms of the Information Technology User s Security Guide (ITUSG). Failure to abide by requirements of the ITUSG or the Security Acknowledgement form is a breach of this Agreement. It is also a breach of this Agreement if the Contractor does not obtain the signature on the Security Acknowledgement from any employees and any subcontractors as well as the subcontractors employees, any of whom are participating in the work covered by this Agreement, and who begin working under this Agreement after the project has begun. Any disciplining of the Contractor s or subcontractor s employees due to a failure of an employee to abide by the terms of the Security Acknowledgement Form will be done at the discretion of the Contractor or subcontractor and in accordance with the Contractor s or subcontractor s personnel policies. Regardless of the actions taken by the Contractor or subcontractor, the State shall retain the right to require at its discretion the removal of the employee from the project covered by this Agreement. 15

16 Product Installation and Operation The State will install and operate the Contractor s product on BIT s computing infrastructure. The State s installation process and operation of the product will follow current BIT standards. Those standards can be found at It is the Contractor s responsibility to review these standards and alert the SDDOT and BIT if the costs enumerated in the Agreement will change based on BIT standards. The SDDOT will not be responsible for added licensing or processing costs if the Contractor determines at a later date that by following the standards in effect at the time of installation, the SDDOT is or would be obligated to pay fines, additional rates, fees, license costs or charges of any type, additional charges of any type or character for the Contractor s or a third party s intellectual property, or added support costs. Security The Contractor shall take all actions necessary to protect State information from exploits, inappropriate alterations, access or release, and malicious attacks. By signing this Agreement, the Contractor warrants that: 1. All known security issues are resolved; 2. Assistance will be provided to the State by the Contractor in performing an investigation to determine the nature of any security issues that are discovered or are reasonably suspected after acceptance. This investigation can include security scans made at the State s discretion. Failure by the Contractor to remedy any security issues discovered can be considered a breach of this Agreement by the SDDOT. 3. The Contractor will fully support and maintain the Contractor s application on platforms and code bases (including but not limited to: operating systems, hypervisors, web presentation layers, communication protocols, security products, report writers and any other technologies on which the application depends) that are still being supported, maintained, and patched by the applicable third parties owning them. The Contractor may not withhold support from the State for this application nor charge the State additional fees as a result of the State moving the Contractor s application to a new release of third-party technology if: a. The previous version of the third-party code base or platform is no longer being maintained, patched, and supported; and b. The new version to which the State moved the application is actively maintained, patched, and supported. If there are multiple versions of the applicable code base or platform(s) supported by the third party in question, the Contractor may limit their support and maintenance to any one or all of the applicable third-party code bases or platforms. If a code base or platform on which the Contractor s application depends is no longer supported, maintained or patched by a qualified third party, the Contractor commits to migrate its application from that code base and/or platform to one that is supported, maintained, and patched after BIT has performed a risk assessment using industry standard tools and methods. Based on that assessment, the Contractor will fix or mitigate the risk based on the following schedule: high risk, within seven (7) days, medium risk within fourteen (14) days, low risk, within thirty (30) days. Failure on the part of the Contractor to work in good faith with the State toward a timely move to supported, maintained, and patched technology shall constitute a breach of this Agreement and shall allow the SDDOT to cancel this Agreement without penalty. 16

17 The State routinely applies security patches and security updates as needed to maintain compliance with industry best practices as well as State and federal audit requirements. Contractors who do business with the State must also subscribe to industry security practices and requirements. Contractors must include costs and time needs in their proposals and project plans to assure they can maintain currency with all security needs throughout the lifecycle of a project. BIT will collaborate in good faith with Contractors to help them understand and support State security requirements during all phases of a project s lifecycle but will not assume the costs to mitigate applications or processes that fail to meet then-current security requirements. At the State s discretion, security scanning will be performed and or security settings put in place or altered during -production review for new or updated code. These scans and tests, can be time consuming and should be accounted for in project planning documents and schedules. Products not meeting the State s security and performance requirements will not be allowed into production until all issues are addressed to the State s satisfaction. The State urges the use of industry scanning/testing tools and recommends secure development methods are employed to avoid unexpected costs and project delays. Costs to produce and deliver secure and reliable applications are the responsibility of the Consultant producing or delivering an application to the State. Unless expressly indicated in writing, the State assumes all price estimates and bids are for the delivery and support of applications and systems that will pass security and performance testing. The Consultant will provide the state, at a time and for duration agreeable to both parties, access to the application and underlying hardware referenced in this agreement for Security Scanning activities. Any scanning performed by the State will not be considered a violation of any licensure agreements the State has with the Consultant or the Consultant has with a third-party. Scanning by the State or any third-party acting for the State will not be considered reverse engineering. If the State Security Scanning efforts discover security issues the State may collaborate with, at the State discretion, the Consultant on remediation efforts, these remediation efforts will not be considered a violation of any licensure agreements the State has with the Consultant. The State while engaged, and after, with the Consultant on remediation will be indemnified and held harmless by the Consultant from all actions, lawsuits, damages (including all ordinary, incidental, consequential, and exemplary damages) or other proceedings that arise from security scanning, remediation efforts, or any after effects of security scanning or remediation. This indemnification includes all defense costs as well as reasonable attorneys fees the State of South Dakota is required to pay in any such proceedings. The State will not be charged for any costs incurred by Consultant in these remediation efforts unless agreed to by the State in advance in writing. In the event of conflicting language this clause to supersede any other language in this or any other agreement made between the State and the Consultant. By signing this Agreement, the Contractor agrees to provide the following information to the State: 1. Name of the person responsible for certifying that all deliverables are secure; 2. Documentation detailing the Contractor s version upgrading process (for those applications where there is or will be a maintenance agreement); 3. Notification of application patches and updates (for those applications where there is/will be a maintenance agreement); and, 4. Based on a risk assessment, provide BIT with the secure configuration guidelines, specifications and requirements that describe security relevant configuration options and their implications for the overall security of the software. The guidelines, specifications and requirements must include descriptions of dependencies on the supporting platform, including operating system, web server, application server and how they should be configured for security. The default configuration of the software shall be secure. At BIT s discretion, BIT will discuss the security controls it uses with the Contractor upon the Contractor signing a nondisclosure Agreement. 17

18 Malicious Code The Contractor warrants that: 1. The service contains no code that does not support an application requirement; 2. The Contractor will not insert into the service or any media on which the service is delivered any malicious or intentionally destructive code; 3. The Contractor will use commercially reasonable efforts consistent with industry standards to scan for and remove any malicious code from the service before installation. In the event any malicious code is discovered in the service delivered by the Contractor, the Contractor shall provide the State at no charge with a copy of the applicable service that contains no malicious code or otherwise correct the affected portion of the services provided to the State The remedies in this paragraph are in addition to other additional remedies available to the SDDOT; and, 4. Will resolve all known security issues. Denial of Access or Removal of an Application from Production During the life of this Agreement the application can be denied access to or removed from production at the State s discretion. The reasons for the denial of access or removal of the application from the production system may include security, functionality, unsupported third-party technologies, or excessive resource consumption of resources. At the discretion of the SDDOT, contractual payments may be suspended while the application is denied access to or removed from production if the problem is caused by the Contractor s actions or inactions. Access to production and any updates to production will be made only with BIT s prior approval. It is expected that any fixes will be tested on the test system provided by the Contractor, as stated in the RFP, and not on the production system. It is expected that the Contractor shall provide BIT with proof of the remedy proposed before BIT provides access to production. The State shall sign a nondisclosure agreement with the Contractor if revealing the remedy will put the Contractor s intellectual property at risk. If the Contractor is unable to produce the project deliverables due to Contractor actions or inactions within thirty (30) days of the application s denial of access or removal from production and the Contractor does not employ the change management process to alter the project schedule or deliverables within the same thirty (30) days, then at the SDDOT s discretion the Agreement may be terminated and the Contractor is required to refund to the SDDOT the prorated amount already paid. Backup Copies The State may make and keep backup copies of the licensed product without additional cost or obligation on the condition that: The State maintains possession of the backup copies, and, The backup copies are used only as bona fide backups. License Agreements The Contractor warrants that it has provided to the SDDOT and incorporated into this Agreement all license agreements, end-user license agreements, and terms of use regarding its software or any software incorporated into its software before execution of this Agreement. The parties agree that neither the SDDOT nor its end-users shall be bound by the terms of any such agreements not timely provided pursuant to this paragraph and incorporated into this Agreement. This paragraph shall control and supersede the language of any such agreements to the contrary. Web and Mobile Applications The Contractor s application is required to: 18

19 1. Have no code and or services included in or called by the application unless they provide direct, functional requirements that support the SDDOT s business goals for the application; 2. Encrypt data in transport and at rest using a mutually agreed upon encryption format; 3. Close all connections and close the application at the end of processing; 4. The documentation will be in grammatically complete text for each call and defined variables (No abbreviations and use complete sentences, for example)sufficient for a native speaker of English with average programming skills to determine the meaning and or intent of what is written without having prior knowledge of the application. 5. Have no code not required for the functioning of application; 6. Have no back doors, a back door being a means of accessing a computer program that bypasses security mechanisms, or other entries into the application other than those approved by the State; 7. Permit no tracking of device user s activities without providing a clear notice to the device user and requiring the device user s active approval before the application captures tracking data; 8. Have no connections to any service not required by the functional requirements of the application or defined in the project requirements documentation; 9. Fully disclose in the about information that is the listing of version information and legal notices, of the connections made, permission(s) required, and the purpose of those connections and permission(s); 10. Ask only for those permissions and access rights on the user s device that are required for the defined requirements of the Contractor s application; and, 11. Access no data outside that which is defined in the About information for the Contractor s application. The Vendor is required to disclose all the following: 1. Functionality; 2. Device and functional dependencies; 3. Third-party libraries used; 4. Methods by which users data is being stored, processed or transmitted; 5. Methods used to secure the data in storage, processing or transmission; 6. Forms of authentication required for a user to access the application or any data it gathers stores, processes and or transmits; 7. Formats the data and information use. 8. The State reserves the right of approval or refusal before agreeing to the Agreement terms based on disclosure under this section. Migration Capability If data is stored in a proprietary format upon termination or expiration of this Agreement, the Contractor will ensure that all State and end-user data is transferred to the State or a third party designated by the State securely, within a reasonable period of time, and without significant interruption in service, all as further specified in the Technical Specifications provided in the RFP. The Contractor will ensure that such migration uses facilities and methods that are compatible with the 19

20 relevant systems of the transferee, and to the extent technologically feasible, that the State will have reasonable access to State and end-user data during the transition. The Contractor will notify the SDDOT and BIT of impending cessation of its business or that of a tiered provider and any contingency plans in the event of notice of such an event. This includes immediate transfer of any previously escrowed assets and data and State access to the Contractor s facilities to remove or destroy any State-owned assets and data. The Contractor shall implement its exit plan and take all necessary actions to ensure a smooth transition of service with minimal disruption to the State. The Contractor will provide a fully documented service description and perform and document a gap analysis by examining any differences between its services and those to be provided by its successor. The Contractor will also provide a full inventory and configuration of servers, routers, other hardware and software involved in service delivery along with supporting documentation, indicating which if any of these are owned by or dedicated to the State. The Contractor will work closely with its successor to ensure a successful transition to the new equipment, with minimal downtime and impact on the State, all such work to be coordinated and performed in advance of the formal, final transition date. Disaster Recovery The Contractor will maintain a disaster recovery plan (the Disaster Recovery Plan ) with respect to the services provided to the State. For purposes of this Agreement, a Disaster shall mean any unplanned interruption of the operation of or inaccessibility to the Contractor s service in which the State, using reasonable judgment, requires relocation of processing to a recovery location. The State shall notify the Contractor as soon as possible after the State deems a service outage to be a Disaster. The Contractor shall move the processing of the State s services to a recovery location as expeditiously as possible and shall coordinate the cut-over. System Upgrades Advance notice of days (to be determined at contract time) shall be given to the SDDOT and BIT of any major upgrades or system changes that the Contractor will be implementing. A major upgrade is a replacement of hardware, software or firmware with a newer or better version, in order to bring the system up to date or to improve its characteristics. The State reserves the right to postpone these changes. Provision of Services The Contractor shall be responsible for the acquisition and operation of all hardware, software and network support related to the services being provided. 20

21 APPENDIX B 21

22 STATE OF SOUTH DAKOTA STANDARD CONTRACT TERMS AND CONDITIONS APPENDIX C Any contract or agreement resulting from this RFP will include the State s standard terms and conditions, listed below, along with any additional terms and conditions as negotiated by the parties: 1.1 The Contractor will provide the equipment, services and other items described in the Scope of Work and Specifications. 1.2 The term of this Agreement will commence on and end on, unless sooner terminated pursuant to the terms of the Agreement. 1.3 The Contractor will provide the State with its Employer Identification Number, Federal Tax Identification Number, or Social Security Number upon execution of this Agreement. 1.4 The State will make payment upon satisfactory performance in accordance with the Scope of Work and Specifications. The total contract amount is an amount not to exceed $. The State will not pay the Contractor's expenses as a separate item. Payment will be made pursuant to itemized invoices submitted with a signed State voucher. Payment will be made consistent with SDCL ch The Contractor will indemnify the State, its officers, agents, and employees against any and all actions, suits, damages, liability, or other proceedings that may arise as the result of performance under the Agreement. This section does not require the Contractor to be responsible for or defend against claims or damages arising solely from errors or omissions of the State, its officers, agents, or employees. 1.6 Before the Contractor begins performance under the Contract, the Contractor will furnish to the State the following certificates of insurance and assure the insurance is in effect for the life of the Agreement: Commercial General Liability Insurance: The Contractor will maintain occurrence based commercial general liability insurance or equivalent form with a limit of not less than $1,000, for each occurrence. If such insurance contains a general aggregate limit it will apply separately to this Agreement or be no less than $2,000, Business Automobile Liability Insurance: The Contractor will maintain business automobile liability insurance or equivalent form with a limit of not less than $1,000, for each accident. Such insurance will include coverage for owned, hired, and non-owned vehicles Workers Compensation Insurance: The Contractor will procure and maintain workers compensation and employers liability insurance as required by South Dakota law. 22

23 In the event a substantial change in insurance, issuance of a new policy, cancellation or nonrenewal of the policy, the Contractor will provide immediate notice to the State and will provide a new certificate of insurance showing continuous coverage in the amounts required. The Contractor will furnish copies of insurance policies if requested by the State. 1.7 While performing services under this Agreement, the Contractor is an independent contractor and not an officer, agent, or employee of the State. No employee of the Contractor engaged in the performance of services required under this Agreement will be considered an employee of the State. No claim under the South Dakota Workers Compensation Act on behalf of said employee or other person while so engaged and no claim made by any third party as a consequence of any act or omission of the part of the work or service provided or to be rendered under this Agreement by the Contractor will be the State s obligation or responsibility. 1.8 The Contractor will report to the State any event encountered in the course of performance of this Agreement which results in injury to the person or property of third parties, or which may otherwise subject the Contractor or the State to liability. The Contractor will report any such event to the State immediately upon discovery. The Contractor's obligation under this section is only to report the occurrence of any event to the State and to make any other report provided for by the Contractor s duties or applicable law. The Contractor's obligation to report will not require disclosure of any information subject to privilege or confidentiality under law (such as attorney-client communications). Reporting to the State under this section will not excuse or satisfy any obligation of the Contractor to report any event to law enforcement or other entities under the requirements of any applicable law. 1.9 Either party may terminate this Agreement by giving thirty (30) days written notice to the other. If the Contractor breaches any term or condition of this Agreement, the Agreement may be terminated by the State at any time with or without notice. If termination for such a default is effected by the State, any payments due to the Contractor at the time of termination may be adjusted to cover any additional costs to the State because of the Contractor's default. Upon termination the State may take over the work and may award another party an agreement to complete the work under this Agreement. If after the State terminates for a default by the Contractor it is determined the Contractor was not at fault, the Contractor will be paid for eligible services rendered and expenses incurred up to the date of termination This Agreement depends upon the continued availability of appropriated funds and expenditure authority from the Legislature for this purpose. If for any reason the Legislature fails to appropriate funds or grant expenditure authority, or funds become unavailable by operation of law or federal funds reductions, this Agreement may be terminated by the State. Termination for any of these reasons is not a default by the State nor does it give rise to a claim against the State This Agreement may not be assigned without the express prior written consent of the State. This Agreement may not be amended except in writing, which writing will be expressly identified as a part of this Agreement, and be signed by an authorized representative of each of the parties This Agreement will be governed by and construed in accordance with the laws of the State of South Dakota. Any lawsuit pertaining to or affecting this Agreement will be venued in Circuit Court, Sixth Judicial Circuit, Hughes County, South Dakota The Contractor will comply with all federal, state, and local laws, rules, regulations, ordinances, guidelines, permits, and requirements applicable to providing services pursuant to this Agreement, and will be solely responsible for obtaining current information on such requirements. 23

24 1.14 The Contractor may not use subcontractors to perform the services described in this Agreement without the State s express prior written consent. The Contractor will include provisions in its subcontracts requiring its subcontractors to comply with the applicable provisions of this Agreement, to indemnify the State, and to provide insurance coverage for the benefit of the State in a manner consistent with this Agreement. The Contractor will cause its subcontractors, agents, and employees to comply, with applicable federal, state, and local laws, rules, regulations, ordinances, guidelines, permits, and requirements and will adopt such review and inspection procedures as are necessary to assure such compliance The Contractor certifies that neither the Contractor nor its principals are presently debarred, suspended, proposed for debarment or suspension, or declared ineligible from participating in transactions by the federal government or any state or local government department or agency. The Contractor further agrees that it will immediately notify the State if, during the term of this Agreement, the Contractor or its principals become subject to debarment, suspension or ineligibility from participating in transactions by the federal government, or by any state or local government department or agency Any notice or other communication required under this Agreement will be in writing and sent to the address set forth above. Notices will be given by and to on behalf of the State, and by and to, on behalf of the Contractor, or such authorized designees as either party may from time to time designate in writing. Notices or communications to or between the parties will be deemed to have been delivered when mailed by first class mail, provided that notice of default or termination will be sent by registered or certified mail, or, if personally delivered, when received by such party If any court of competent jurisdiction holds any provision of this Agreement unenforceable or invalid, such holding will not invalidate or render unenforceable any other provision of this Agreement All other prior discussions, communications, and representations concerning the subject matter of this Agreement are superseded by the terms of this Agreement, and except as specifically provided in this Agreement, this Agreement constitutes the entire agreement with respect to the subject matter. 24

25 State of South Dakota Appendix D Security and Vendor Questions The following questions were produced by the South Dakota Bureau of Information and Telecommunications (BIT). The purpose is to provide BIT enough information that we can determine if a vendor s product will work successfully in the computer infrastructure of the State of South Dakota. A = Data Center B = Development C = PMO Office D = Telecommunications Add text as required use BIT Owner Question Response NA when appropriate 1. C Typically the State of South Dakota prefers to host all systems. In the event that the State decides that it would be preferable for the vendor to host the system, is this an option? 2. D Is there a workstation install requirement? 3. A/D Is this a browser based User Interface? 4. B/C What is the development technologies used for this system? ASP VB.Net C#.Net.NET Framework Java/JSP MS SQL 5. A Will the system support authentication? Does the system give clues about valid username or password content or structure, for example when a user forgets their username or after a failed login attempt? Are usernames and passwords generated by the system using user-specific information such as last name or birthdate? If 25