Alt DR site RFP take 1 mq v4 - Washington Technology ...watech.wa.gov/.../files/public/procurements/A17-RFP-030.docx · Web view“Business Associate,” as used in this Contract,

Request for Proposal

A17-RFP-030

for

Colocation, Connectivity and Professional Services

by the

Washington State

Consolidated Technology Services

Released

January 22, 2018

Table of Contents1. INTRODUCTION...............................................................................................................................1

1.1. Background...................................................................................................................................1

1.2. Acquisition Authority...................................................................................................................1

1.3. Purpose.........................................................................................................................................2

1.4. Contract Term...............................................................................................................................2

1.5. Definitions....................................................................................................................................2

1.6. Overview of Solicitation Process.................................................................................................4

1.7. Award of Contract........................................................................................................................4

1.8. Funding.........................................................................................................................................4

2. SCHEDULE.........................................................................................................................................5

3. INSTRUCTIONS TO RESPONDING VENDORS.........................................................................6

3.1. RFP Coordinator (Proper Communication).................................................................................6

3.2. Vendor Questions.........................................................................................................................6

3.3. Vendor Complaints Regarding Requirements and Specifications...............................................6

3.4. Response Contents.......................................................................................................................6

3.5. Response Requirements...............................................................................................................7

3.6. Delivery of Responses..................................................................................................................7

3.7. Proprietary or Confidential Information.......................................................................................7

3.8. Waive Minor Administrative Irregularities..................................................................................8

3.9. Mandatory Requirements.............................................................................................................8

3.10. Errors in Response........................................................................................................................8

3.11. Administrative Clarifications.......................................................................................................8

3.12. Amendments/Addenda.................................................................................................................8

3.13. Right to Cancel.............................................................................................................................8

3.14. Contract Requirements.................................................................................................................9

3.15. Incorporation of Documents into Contract...................................................................................9

3.16. Minority and Women’s Business Enterprises (MWBE)..............................................................9

3.17. No Obligation to Contract/Buy....................................................................................................9

3.18. Non-Endorsement and Publicity..................................................................................................9

3.19. Optional Vendor Debriefing.......................................................................................................10

3.20. Protest Procedures......................................................................................................................10

3.21. Vendor Assumption and Dependencies......................................................................................10i

3.22. Selection of Apparently Successful Vendor...............................................................................10

4. VENDOR REQUIREMENTS..........................................................................................................11

4.1. (M) Vendor Profile(s).................................................................................................................11

4.2. (M) Vendor’s Proposed Data Center Facilities Profile(s)..........................................................11

4.3. (M) Account Manager Role........................................................................................................11

4.4. (M) Subject Matter Expert (SME) – Data Center Facilities.......................................................11

4.5. (M) Vendor Contact List............................................................................................................11

4.6. (M) Vendor Licensed to do Business in Washington.................................................................11

4.7. (M) Use of Subcontractors.........................................................................................................12

4.8. (M) Prior Contract Performance.................................................................................................12

4.9. (MS - 50 Points) Optional Stage 2 - Customer References (CTS’ Option)...............................12

4.10. (MS - 200 Points) Optional Stage 2 – Site Visit (CTS’ Option)................................................13

4.11. (M) Vendor Staff Background Checks.......................................................................................13

4.12. (M) Vendor Staff Confidentiality Agreements..........................................................................14

4.13. (M) Health Insurance Portability and Accountability Act (HIPAA) Compliance.....................14

4.14. Vendor Invoicing........................................................................................................................14

5. TECHNICAL REQUIREMENTS...................................................................................................15

5.1. (M) Designated Locations..........................................................................................................15

5.2. Network Requirements...............................................................................................................15

5.3. Physical Site Requirements........................................................................................................17

5.4. Data Center Requirements..........................................................................................................17

5.5. Infrastructure..............................................................................................................................18

5.6. CTS Leased Enclosure Space.....................................................................................................19

5.7. Space Reservation, Growth Options and Rights of First Refusal..............................................20

5.8. Power..........................................................................................................................................20

5.9. Telecommunications...................................................................................................................21

5.10. Fire Protection/Suppression.......................................................................................................22

5.11. Physical Security........................................................................................................................22

5.12. Regulatory Compliance Requirements.......................................................................................24

5.13. Maintenance and Operations......................................................................................................25

5.14. Service Impacting Maintenance.................................................................................................27

5.15. Incident Management.................................................................................................................28

5.16. Service Levels............................................................................................................................29

ii

5.17. Business Continuity and Disaster Recovery..............................................................................30

5.18. Additional Services....................................................................................................................30

6. FINANCIAL PROPOSAL...............................................................................................................31

6.1. Overview....................................................................................................................................31

6.2. Financial Grounds for Disqualification......................................................................................31

6.3. Taxes...........................................................................................................................................31

6.4. (M) Presentation of All Cost Components.................................................................................31

6.5. Miscellaneous Expenses.............................................................................................................31

6.6. (M) Price Protection...................................................................................................................31

6.7. (M) Price Decrease Guarantee....................................................................................................31

6.8. (M) Costs Not Specified.............................................................................................................31

6.9. (MS 500) Cost Model.................................................................................................................32

6.10. (M) Price List.............................................................................................................................32

7. EVALUATION PROCESS..............................................................................................................33

7.1. Overview....................................................................................................................................33

7.2. Administrative Screening...........................................................................................................33

7.3. Requirements..............................................................................................................................33

7.4. Vendor Scoring...........................................................................................................................33

7.5. Allocation of Points....................................................................................................................34

7.6. Vendor Total Score.....................................................................................................................35

7.7. Selection of Apparently Successful Vendor...............................................................................35

APPENDICES

Appendix A: Certifications and Assurances

Appendix B: Model [Master] Contract

Appendix C: MWBE Participation Form [if applicable]

Appendix D: Protest Procedures

Appendix E: COST MODEL

Appendix F: NDA for Procurement Documents

Appendix G: Data Center Tours NDA

iii

SECTION 1

State of Washington A18-RFP-030

Consolidated Technology Services Page 1

1. INTRODUCTION

1.1. BackgroundThe Washington State Consolidated Technology Services (CTS) provides telecommunications, computing and digital government services to more than 700 state agencies, boards and commissions, local governments, tribal organizations and qualifying non-profits. CTS provides a secure, statewide standards-based telecommunications network delivering reliable, economical voice, data and video communications.

CTS also operates the State Data Center in Olympia Washington. This is one the largest data centers in the Northwest, combining both client server and mainframe computing in a secure, controlled environment. For more information, visit the CTS Web site at www.cts.wa.gov.

CTS functions as a provider of technology services to the above customers. CTS is planning on enhancing the services we offer by procuring colocation, connectivity and professional services to enable the State of Washington to physically integrate state networks through connectivity with various third-party Ethernet, Internet and associated cloud services such as Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS). CTS customers may have access to the resulting, CTS managed, colocation services provided to CTS by the Vendor who is successfully awarded a contract.

CTS will consider all solutions proposed by the Vendors in their Response.

1.2. Acquisition AuthorityThe Department of Enterprise Services (DES) has authority over goods and services under RCW 39.26 and sets processes for procuring information technology based on the policies and standards set by the Technology Services Board. Chapter 43.41A of the Revised Code of Washington (RCW) as amended establishes the Washington State Technology Services Board (TSB). While the TSB does not purchase for agencies, it establishes policies and standards addressing how the manner in which state agencies may acquire information technology equipment, software, and services.

RCW 39.26.100(2) provides CTS with an exemption from the Department of Enterprise Services procurement rules and requirements. Specifically, the competitive procurement rules stated by Department of Enterprise Services do not apply to CTS it is contracting for the following:

1. Services and activities that are necessary to establish, operate, or manage the state data center, including architecture, design, engineering, installation, and operation of the vendor, that are approved by the technology services board or

2. The acquisition of proprietary software for or part of the provision of services offered by the consolidated technology services agency; or

3. The acquisition of information technology equipment necessary for or part of the provision of services offered by the consolidated technology services agency; or

4. The acquisition of information technology services necessary for or part of the provision of services offered by the consolidated technology services agency.

This procurement is within the exemption and is performed consistent with CTS’ internal Exempt Procurement Policy. CTS Procurement activities should embody the following values:



http://www.cts.wa.gov/

1. Equity: to provide open competition and fair access to qualified Vendors in competing for CTS business. Open competition means equal access/opportunity for those qualified Vendors.

2. Economy and Efficiency: to procure goods/services at the best value and assure the processes are streamlined and fit the level of risk anticipated in each transaction.

3. Integrity: to enable a full and open competition in order to reduce any chances for corruption or bias in a procurement process.

This RFP is issued in good faith but it does not guarantee an award of contract, nor does it represent any commitment to purchase whatsoever.

1.3. PurposeCTS seeks to create a secure, reliable enterprise private network (a.k.a. “Highway to the Cloud”) to extend the State’s internal network routing and security, provide end-to-end visibility, and be managed and monitored by WaTech. The Highway to the cloud will be secure and compliant, meeting state standards, resilient and provide the best performance potential for its users, as compared to basic internet connectivity.

The purpose of this Request for Proposal (RFP) is to establish a contract for colocation, connectivity, and professional services to enable the State of Washington to physically integrate state networks through connectivity with various third-party Ethernet, Internet and associated cloud services such as Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS). Additionally, data center connectivity (Ethernet) between the two selected data centers as part of this RFP.

CTS is procuring a primary site in Seattle with a secondary site from the same provider in the Eastern United States. (See Requirement 5.1.1) The secondary site must meet all of the same requirements as the primary site and met in the same way. A response to a requirement below is applicable to both Data Center Facilities.

Ethernet circuits (excluding of data center interconnectivity), Internet, or cloud provider circuits are expressly not in scope.

1.4. Contract TermIt is anticipated that the initial term of the resulting purchasing Contract will be four (4) years commencing on the effective date of the Contract. CTS, at its sole discretion, may initiate extending the Contract for up to six (6) additional years.

1.5. Definitions“Access Provider Space” shall mean the area used for housing the installation and termination of telecommunications equipment and cable by an operator of any facility that is used to convey telecommunications signals to and from a customer premises.

“Account Manager” shall mean a Vendor’s employee with sufficient authority to handle potential issues that may arise during the installation, implementation, or on-going use of the Vendor’s Data Center Facilities. This includes responsibilities around invoicing, contracting, and Statement of Work management.

“Apparently Successful Vendor” (ASV) shall mean the Vendor(s) who: (1) meets all the requirements of this RFP, and (2) receives the highest number of total points.



“Business Days” or “Business Hours” shall mean Monday through Friday, 8 AM to 5 PM, local time in Olympia, Washington, excluding Washington State holidays.

“Camera” shall mean any device capable of capturing and storing still or moving images.

“Colocation” shall mean a type of data center where equipment and space are available for rental. Colocation facilities provide space, power, cooling, and physical security for the server, storage, and networking equipment of other organizations and may offer additional services to procure, install, and manage the equipment and network connections.

“Consolidated Technology Services” (CTS) shall mean Washington State Consolidated Technology Services which is the State of Washington’s utility technology provider for more than 700 state agencies, boards and commissions, local governments, tribal organizations and qualifying non-profits.

“Contract” shall mean the resulting purchasing vehicle that is entered into between the parties as a result of successful negotiations with the ASV.

“CTS Data Center” shall mean the data center managed by CTS.

“CTS Leased Enclosure Space” shall mean any and all space that CTS leases from the Vendor.

“Data Center Facilities” shall mean both of the Vendor’s Colocation data center’s submitted under this RFP.

“Desirable Scored” (DS) shall mean the requirement is important but not mandatory, and the Response will be scored.

“Disaster Declaration” shall mean a formal notification by Purchaser to the Vendor that a disaster has occurred.

“Disaster Recovery” shall mean the process, policies, and procedures to recover or continue technology infrastructure that is vital to an organization after a natural or human-created disaster. Disaster Recovery focuses on the information technology systems that support business functions, rather than business continuity, that involves planning for keeping all aspects of a business functioning during a natural or human-created disaster.

“Disaster” shall mean an unplanned event or condition, which has rendered CTS or Data Center Facilities, infrastructure, services, systems, and/or applications non-operational in whole or in part for an extended period of time.

“Incidents” shall mean any unplanned event to an operation that may cause reduction/degradation, loss of redundancy or a disruption, which has or can negatively impact CTS or the Vendor’s ability to provide services to CTS.

“Layer 1 Cross-Connectivity”shall mean the transmission of bits across cabling infrastructure without passing through a switch, router, bridge, or any other non-Layer 1 infrastructure that uses a MAC address & IP address to (re)direct traffic.

“Major Incident” Shall mean the highest category of Incident that has caused a significant disruption, which has or can negatively impact CTS or the Vendor’s ability to provide services to CTS.

“Maintenance Notifications” shall mean notifications provided by Vendor to CTS for all maintenance occurring that could have an impact to Vendor services purchased by CTS. The notification at a minimum contains description, timeframe, reason for maintenance, and problem reporting procedure.



http://apps.leg.wa.gov/WAC/default.aspx?cite=357-31-005

“Mandatory Scored” (MS) shall mean the Vendor must comply with the requirement and the Response will be scored.

“Mandatory” (M) shall mean the Vendor must comply with the requirement and the Response will be evaluated on a pass/fail basis.

“Remote Hands” shall mean a service provided by Vendor that enables CTS to utilize Vendor to provide basic IT maintenance tasks to technicians employed by the data center as set forth more fully herein.

“Response” shall mean the written proposal submitted by Vendor to CTS in accordance with this RFP. The Response shall include all written material submitted by Vendor as of the date set forth in the RFP schedule or as further requested by CTS.

“Services” shall mean the products, equipment, colocation space and other items purchased by CTS that are within scope of this RFP and are available to purchase under the resulting contract.

“Service Organization Control 2 Report” (SOC 2) shall mean a report on a service organization’s controls over its system relevant to security, availability, processing integrity, confidentiality, or privacy.

“Statement of Work” (SOW) shall mean the statement of work included in, or attached to, the resulting Contract between Vendor and CTS for Vendor’s services to be accomplished under the terms and conditions of the resulting contract.

“Telecommunications Infrastructure Standard for Data Centers” (ANSI/TIA-942) refers to ANSI/TIA-942 with A-1 update published in April 2013 as a guideline for planning and building data centers, including a standard nomenclature, failsafe operation, protection against natural or human-caused disasters, and the long-term reliability, expandability, and scalability of the data center.

“Uninterruptible Power Supply (UPS)” shall mean a device that allows a computer to keep running for at least a short time when the primary power source is lost. It also provides protection from power surges.

“Vendor” shall mean a company, organization, or entity submitting a Response to this RFP, its subcontractors and affiliates.

1.6. Overview of Solicitation Process The solicitation process will comprise of:

1. A preliminary examination of the completeness and validity of Responses.

2. A technical evaluation to determine compliance with requirements, which may require a site visit.

3. A commercial risk and cost analysis of all pricing, project schedules, terms and conditions contained within the Response.

1.7. Award of ContractAfter completing the evaluation phase of the process, CTS hopes to enter into contractual negotiations with one Apparently Successful Vendor (ASV) with a view to finalizing a contract. Award of contract will depend on a satisfactory outcome to these negotiations.

1.8. FundingAny contract awarded as a result of this procurement is contingent upon the availability of funding.



SECTION 2

2. SCHEDULEThis RFP is being issued under the following Schedule. The Response deadlines are mandatory and non-negotiable. Failure to meet any of the required deadlines will result in disqualification from participation. All items that are due on a specific date must be received in Olympia, WA by noon local time, Olympia, WA.

DATE & TIME EVENTJanuary 22, 2018 RFP Issued

February 7, 2018 Final Vendor Questions and Comments due

February 12, 2018 State’s Final Written Answers issued

February 26, 2017 Responses due

February 27th- March 5, 2018

Evaluation period begins

March 6, 2017 ASV announcement

March 7, 2018 Vendor Request for Optional Debriefing due

March 12, 2018 Optional Vendor Debriefings

March 6, 2017 Begin Contract Negotiations

March 20, 2018 **Contract Effective and made available for purchases

CTS reserves the right to revise the above schedule.



SECTION 3

3. INSTRUCTIONS TO RESPONDING VENDORSCOMPLIANCE WITH ALL SECTIONS OF SECTION 3 IS REQUIRED. FAILURE TO FOLLOW THESE ADMINISTRATIVE REQUIREMENTS MAY RESULT IN IMMEDIATE DISQUALIFICATION

3.1. RFP Coordinator (Proper Communication)All communications relevant to this RFP must be addressed in writing to the RFP Coordinator at the contact information below:

Contact Name: Rebekah O’Hara

E-mail Address: [email protected]

Phone: 360-407-8818

All oral communications will be considered unofficial and non-binding on the State. Any other direct or indirect communication with employees or (sub) contractors of our organization regarding this RFP will be treated as misconduct and may result in your response being disqualified.

3.2. Vendor QuestionsIt is the Vendor’s responsibility to remedy any ambiguity, inconsistency, error or omission within this document it discovers before submitting their Response. Vendors shall submit all requests to the contact above no later than noon on the closing date stated in Section 2. An official written CTS response will be provided for Vendor questions received by this deadline. Written responses to Vendor questions will be posted on the CTS web site at: www.cts.wa.gov.

3.3. Vendor Complaints Regarding Requirements and SpecificationsVendors may submit specific complaints in writing to the RFP Coordinator, if Vendor believes requirements exist that unduly constrain competition. The complaint must be made in writing to the RFP Coordinator before the Response due date. The complaint must state how the requirement unduly constrains competition and provide the relevant facts, circumstances and documentation. The solicitation process may continue.

Except as otherwise stated below, the Chief Legal Services Officer will review protests on behalf of the agency. Vendors may appeal the Chief Legal Service Officer’s determination, on purchases over $100,000, by submitting an appeal in writing to the Director. An appeal shall be filed no later than five (5) Business Days after Chief Legal Service Officer’s decision. Decisions made by the Director or designee are final.

3.4. Response ContentsThe Response must contain information responding to all mandatory requirements, a signed certification and assurances, and must include the signature of an authorized Vendor representative on all documents required in the appendices.

The Response should be submitted in two (2) separate files containing what is listed below. This separation of documentation protects the integrity of the State’s evaluation process. No mention of the cost response may be made in Volume 1.



http://www.cts.wa.gov/

File entitled --Volume 1:

a) Vendor’s cover letter explicitly acknowledging receipt of all RFP revisions issued, if any; andb) The Response to the Vendor requirements.

File entitled--- Volume 2:

a) The Responses to the financial requirements b) The cost response in a completed Cost Model c) Vendor’s signed and completed Certifications and Assurancesd) Vendor’s exceptions and/or proposed revisions to the Contract e) Vendor’s MWBE Certification (Appendix C), if applicablef) Failure to provide any requested information in the prescribed format may result in

disqualification of the Vendor.

3.5. Response RequirementsThe signature block in Appendix A, Certifications and Assurances, must be signed by a representative authorized to bind the company to the offer.

Vendor must respond to each requirement. Failure to comply with any applicable item may result in the Response being disqualified. In each requirement title is a designation indicating how the Response will be evaluated, as set forth in Section 5.

3.6. Delivery of ResponsesAll proposals must arrive via an attachment to e-mail to the RFP Coordinator at the email address above, on the proposal due date and time stated in Section 2. Responses arriving in in the RFP Coordinator’s in-box after the time stated in Section 2 will be disqualified. The "receive date/time" posted by CTS’ email system will be used as the official time stamp but may not reflect the exact time received.

Vendors should allow sufficient time to ensure timely receipt of the proposal by the RFP Coordinator. Late Responses will not be accepted and will be automatically disqualified from further consideration.

CTS assumes no responsibility for delays caused by Vendor’s e-mail, network problems or any other party. All Responses must strictly adhere to the format and file naming conventions set forth herein. Zipped files cannot be received by CTS and cannot be used for submission of Responses.

3.7. Proprietary or Confidential InformationAny information contained in the Response that is proprietary or confidential must be clearly designated. Marking of the entire Response or entire sections of the Response as proprietary or confidential will not be accepted nor honored. CTS will not accept Responses where pricing is marked proprietary or confidential, and the Response will be rejected.

To the extent consistent with chapter 42.56 RCW, the Public Disclosure Act, CTS shall maintain the confidentiality of Vendor’s information marked confidential or proprietary. If a request is made to view Vendor’s proprietary information, CTS will notify Vendor of the request and of the date that the records will be released to the requester unless Vendor obtains a court order enjoining that disclosure. If Vendor fails to obtain the court order enjoining disclosure, CTS will release the requested information on the date specified.



The State’s sole responsibility shall be limited to maintaining the above data in a secure area and to notify Vendor of any request(s) for disclosure for so long as CTS retains Vendor’s information in CTS records. Failure to so label such materials or failure to timely respond after notice of request for public disclosure has been given shall be deemed a waiver by Vendor of any claim that such materials are exempt from disclosure.

3.8. Waive Minor Administrative IrregularitiesCTS reserves the right to waive minor administrative irregularities contained in any Response. Additionally, CTS reserves the right, at its sole option, to make corrections to Vendors’ Responses when an obvious arithmetical error has been made in the price quotation.

3.9. Mandatory RequirementsItems marked with an (M) or (MS) are Mandatory Requirements.

a. For Mandatory requirements (M), the Response must always indicate explicitly whether the Vendor’s proposed Services meet the requirement. A statement, “(Vendor Name) has read, understands, and fully complies with this requirement” is acceptable, along with any additional information requested.

b. For Mandatory Scored (MS) and Desirable Scored (DS) items, the Response must always indicate explicitly whether or not the Vendor's proposed Services meet the requirement, and describe how the proposed Vendor’s Services will accomplish each requirement or are desirable as it relates to the service(s) proposed.

Responses meeting all of the administrative requirements will then be reviewed on a pass/fail basis to determine if the Response meets the Mandatory requirements. Only Responses meeting all Mandatory requirements will be further evaluated.

The State reserves the right to determine at its sole discretion whether Vendor’s response to Mandatory requirement is sufficient to pass. If, however, all responding Vendors fail to meet any single Mandatory item, CTS reserves the following options: (1) cancel the procurement, or (2) revise or delete the Mandatory item.

3.10. Errors in ResponseVendors are liable for all errors or omissions contained in their Responses. Vendors will not be allowed to alter Response documents after the deadline for Response submission. CTS is not liable for any errors in Responses.

3.11. Administrative ClarificationsCTS reserves the right to contact Vendor for clarification of Response contents.

3.12. Amendments/AddendaCTS reserves the right to change the Schedule or other portions of this RFP at any time. Any changes or corrections will be by one or more written amendment(s), dated, and attached to or incorporated in and made a part of this solicitation document. If there is any conflict between amendments, or between an amendment and the RFP, whichever document was issued last in time shall be controlling.

3.13. Right to CancelState of Washington A18-RFP-030


With respect to all or part of this RFP, CTS reserves the right to cancel or reissue at any time without obligation or liability.

3.14. Contract RequirementsTo be responsive, Vendors must indicate a willingness to enter into a Contract substantially the same as the Contract in Appendix B, by signing the Certifications and Assurances located in Appendix A. Any specific areas of dispute with the attached terms and conditions must be identified in the Response and may, at the sole discretion of CTS, be grounds for disqualification from further consideration in the award of a Contract.

Vendor must explain why each item proposed as additional contract terms is in CTS’ best interest as a customer and how it will support CTS’ business objectives. Under no circumstances is a Vendor to submit their own standard contract terms and conditions as a response to this solicitation.

Instead, Vendor must review and identify the language in Appendix B that Vendor finds problematic, state the issue, and propose the language or contract modification Vendor is requesting. CTS expects the final Contract signed by the ASV to be substantially the same as the contract located in Appendix B.

Where terms and conditions cannot be changed and may have negative consequences on the quality of goods and services or their supply, Vendors are required to recommend methods of mitigating or limiting these negative consequences.

The final contract executed by the parties must satisfy CTS’ obligations with respect to performance-based contracting as directed in Executive Order 10-07. The parties may negotiate performance-based elements, in addition to those in Appendix B, for inclusion into the final contract.

The foregoing should not be interpreted to prohibit either party from proposing additional contract terms and conditions during negotiation of the final Contract.

The ASV will be expected to execute the Contract within ten (10) days of its receipt of the final Contract. If the selected Vendor fails to sign the Contract within the allotted ten (10) days’ time frame, CTS may elect to cancel the award, and award the Contract to the next ranked Vendor, or cancel or reissue this solicitation.

3.15. Incorporation of Documents into ContractThis solicitation document and the Response will be incorporated into any resulting Contract.

3.16. Minority and Women’s Business Enterprises (MWBE)CTS strongly encourages participation of minority and women businesses. Vendors who are MWBE certified or intend on using MWBE certified Subcontractors are encouraged to identify the participating firm on Appendix C. No minimum level of MWBE participation is required as a condition of receiving an award and no preference will be included in the evaluation of Responses in accordance with chapter 39 RCW. For questions regarding the above, contact Office of MWBE at (360) 753-9693.

3.17. No Obligation to Contract/BuyCTS reserves the right to refrain from Contracting with any and all Vendors. Neither the release of this solicitation document nor the execution of a resulting Contract obligates CTS to make any purchases. CTS reserves the right to cancel the procurement at any time during the procurement or resulting contract negotiation process.



3.18. Non-Endorsement and PublicityIn selecting a Vendor to supply Services to the state of Washington, the State is neither endorsing Vendor’s Services, nor suggesting that they are the best or only solution to the State’s needs. By submitting a Response, Vendor agrees to make no reference to CTS or the state of Washington in any literature, promotional material, brochures, sales presentation or the like, regardless of method of distribution, without the prior review and express written consent of CTS.

3.19. Optional Vendor DebriefingOnly Vendors who submit a response may request an optional debriefing conference to discuss the evaluation of their Response. The requested debriefing conference must occur on or before the date specified in the Schedule (Section 2). The request must be in writing (e-mail acceptable) addressed to the RFP Coordinator.

The optional debriefing will not include any comparison between the Response and any other Responses submitted. However, CTS will discuss the factors considered in the evaluation of the requesting the Response and address questions and concerns about Vendor’s performance with regard to the solicitation requirements.

3.20. Protest ProceduresVendors who have submitted a Response to this solicitation and have had a debriefing conference may make protests. Upon completion of the debriefing conference, a Vendor is allowed five (5) Business Days to file a formal protest of the solicitation with the RFP Coordinator. Further information regarding the grounds for, filing and resolution of protests is contained in Appendix D, Protest Procedures.

3.21. Vendor Assumption and DependenciesCTS will rely upon representations made in the Response. If the Vendor chooses to identify assumption or dependencies on which it has based its proposal, CTS retains the right to determine if the Vendor’s assumptions/dependencies render the Response non-responsive.

3.22. Selection of Apparently Successful VendorAll Vendors responding to this solicitation will be notified by mail or e-mail when CTS has determined the ASV. The ASV will be the respondent who: (1) meets all the requirements of this RFP; and (2) receives the highest number of total points at the end of Stage 2 as described herein.



SECTION 4

4. VENDOR REQUIREMENTSRespond to the following requirements per the instructions in Section 3. Additionally, please remember that for Mandatory (M), and Mandatory scored requirements (MS), always indicate explicitly whether its proposed Services meet the requirement.

4.1. (M) Vendor Profile(s)The following detail about the Vendor’s organization is required to ensure that it can meet CTS’ requirements. The Vendor working on its behalf shall each provide the following information:

1. The legal entity — for example, a private or public corporation — together with its name and registered address.

2. Is your company a subsidiary of another organization? If yes, what is the name of your parent company?

3. The total number of years the legal entity has been in business and, if appropriate, the number of years under the present business name.

4. Name and title of the person authorized to contractually bind the organization for any proposal against this RFP.

5. Describe the products and services offered by your company.

4.2. (M) Vendor’s Proposed Data Center Facilities Profile(s)The following detail about both of the Vendor’s proposed Data Center Facilities is required to ensure that they can meet CTS’ requirements. The Vendor working on its behalf shall each provide the following information:

1. Name and address of both Data Center Facilities the Vendor is proposing.

4.3. (M) Account Manager RoleThe Vendor shall designate a Vendor Account Manager within 30 days of contract signing with responsibility for the relationship with CTS and whose responsibilities include invoice, contract management.

4.4. (M) CommunicationsThe CTS Contract Manager shall be the Vendor’s sole point of contact unless otherwise amended in the subsequently awarded contract.

4.5. (M) Subject Matter Expert (SME) – Data Center FacilitiesThe Vendor shall designate a SME – Vendor within thirty (30) days of contract signing with responsibility for answering CTS’ questions regarding the Vendor’s Data Center Facilities environment at both site locations.

4.6. (M) Vendor Contact List



The Vendor agrees to include a detailed contact and escalation list in the resulting Contract at the time of Contract signing.

4.7. (M) Vendor Licensed to do Business in WashingtonWithin thirty (30) days of being identified as the ASV, Vendor must be licensed to conduct business in Washington, including registering with the Washington State Department of Revenue. The Vendor must collect and report all applicable taxes.

4.8. (M) Use of Subcontractors CTS will accept Responses that include third party involvement only if the Vendor submitting the Response agrees to take complete responsibility for all actions of such Subcontractors. Vendors must state whether Subcontractors are/are not being used, and if they are being used, Vendor must list them in response to this subsection. CTS reserves the right to approve or reject any and all Subcontractors that Vendor proposes. Any subcontractors engaged after award of the Contract must be pre-approved, in writing, by CTS.

Specific restrictions apply to contracting with current or former state employees pursuant to chapter 42.52 RCW. Vendors should familiarize themselves with the requirements prior to submitting a Response.

4.9. (M) Prior Contract PerformanceVendor must submit full details of all Terminations for Default for performance similar to the Services requested by this RFP experienced by the Vendor in the past five (5) years, including the other party’s name, address and telephone number. Vendor must describe the Vendor has experienced no such Terminations for Default in the past five years, so declare. If Vendor has been suspended or debarred by the Department of Enterprise Services, so declare and provide details surrounding the suspension/debarment.

CTS will evaluate the information and may, at its sole discretion, reject the Response if the information indicates that completion of a Contract resulting from this RFP may be jeopardized by selection of the Vendor.

4.10. (MS - 50 Points) Optional Stage 2 - Customer References (CTS’ Option)CTS, at its sole option, reserves the right to conduct customer reference checks as an Optional Stage 2 scored event during the time stated in Section 2.

Vendor shall provide details of three customers for reference as set forth below. Reference customers should have similar requirements. CTS’ in its sole discretion, may contact these references to discuss their satisfaction with the supplier and its services.

Site and Contact Details

1. The brand name of the organization

2. The address of the site from which procurement is managed

3. A descriptive work role or title indicating the contact's position within the organization

4. The contact's e-mail address by which they may be contacted

5. The contact's telephone number



CTS will use a Client Reference Form to check references. To the extent a Response may give rise to confidentiality obligations, CTS will not sign an NDA to receive the information. Instead, please respond with sufficient information to enable CTS to evaluate and contact the Client Reference.

In the event that one of the provided references is a member of the evaluation team, CTS will contact the Vendor for an alternate reference. The alternate reference shall be provided timely and must be available during the evaluation period.

CTS will make one (1) attempt to contact the client and obtain a reference, CTS will leave voicemail and it is acceptable if a return call is received within the timeframe set forth in Schedule – Section 2. If a contact cannot be made, the reference will be disallowed. It is the Vendor’s responsibility to provide CTS with references that will be timely and available during the evaluation period set forth in Schedule – Section 2. CTS reserves the right to eliminate from further consideration in this RFP process any Vendor who, in the opinion of CTS, receives an unfavorable report from a Vendor. CTS also reserves the right to contact other Vendors for additional references for consideration.

4.11. (M) Optional Stage 2 – Site Visit (CTS’ Option)

4.11.1.Site Visit

4.1.1.1 CTS, at its sole option, reserves the right to conduct a site visit as an Optional Stage 2 scored event during the time stated in Section 2. CTS may select the top scoring vendors’ facilities to tour.

4.1.1.2 Representations made by the Vendor during the site visit will be considered binding.

4.1.1.3 The site visit will give the vendor the opportunity to summarize their proposal to CTS and answer specific questions the evaluation team may have. The tour will be scripted in that CTS will provide the vendor with a list items it will be scored on during the Site visit. Detailed information regarding the site visit will be provided to the primary contact identified in the Vendor’s response upon notification to participate in Stage 2.

4.12. (M) Background ChecksThe Vendor shall ensure that its personnel, security guards, and subcontractors have successfully completed a background check pursuant to this section prior to providing Services.

Due to the nature of the services to be provided under the contract, CTS requires that the Vendor successfully complete a criminal background check prior to the start of their services. The criminal background investigation shall include a review of the Vendors and his/her employee’s records to include Social Security Number Search, Credit Report (if related to potential job duties), Criminal Records Search (any misdemeanor convictions and/or felony convictions are reported) in all states in which the employee has lived or worked over the past seven years, and the National Sex Offender Registry. In addition, the Global Watch list (maintained by the Office of Foreign Assets Control of the US Department of Treasury) should be reviewed.

Vendor understands and agrees that various governmental security statutes and regulations, and CTS policies relating to background investigations and authorized access to CTS facilities may change from time to time during the contract term, including any renewal period.



Accordingly, submission of a bid or proposal in response to this RFP shall constitute Vendor’s acceptance of any new statute and/or regulation, including Vendor’s acceptance of and compliance with any changes in the CTS background investigations and authorized vendor access protocols necessary to implement any such new statute or regulation.

Vendor shall be required to submit a signed statement confirming that each employee providing services to CTS has successfully completed the required background check. Vendor’s failure to comply in implementing changes to its background investigations and authorized vendor access protocols may, in the CTS’ sole discretion, be considered a breach of this contract and result in its cancellation.

Every thirty-six (36) months, or at the time of contract renewal, whichever is sooner, the Contractor is responsible for obtaining an updated basic level criminal background check for each employee and shall resubmit a signed statement confirming that each employee providing services to CTS has successfully completed the required background check.

4.13. (M) Vendor Staff Confidentiality AgreementsThe Vendor shall use the CTS-provided Confidentiality and Non-Disclosure Agreements for all Vendor personnel, including Subcontractors, or visitors, or anyone who would have access to CTS’ Data Center or Vendor infrastructure supporting CTS’ Data Center, as set forth in Appendix G.

4.14. Vendor Invoicing

4.14.1. (M) Invoices - Submission

Vendor shall submit electronic invoices to CTS no later than the last business day of the month following the month in which the Vendor provided services to CTS.

4.14.2. (M) Invoices – CTS Naming Conventions

The Vendor shall ensure that all invoices must include CTS provided naming conventions for each enclosure. Please describe your proposed solution.

4.14.3. (M) Invoices – Recurring Charges

The Vendor shall ensure that all invoices must include recurring charges with enumeration by item, dates of service, Statement of Work, Contract number, and additional relevant details.

4.14.4. (M) Invoices – One-Time Charges

The Vendor shall ensure that all invoices must include one-time charges with enumeration by item, dates of service, Statement of Work, Contract number, and additional relevant details.

4.14.5. (M) Invoices – Service Availability

The Vendor shall ensure that invoices include the service availability (uptime) for the month and with any applicable Service Level credits.

4.14.6. (M) Invoices – Other Details

The Vendor shall ensure that invoices include prices for each service, applicable taxes, subtotals, and a total invoice amount.



SECTION 5

5. (MS 750) TECHNICAL REQUIREMENTSRespond to the following requirements per the instructions in section 3. Additionally, please remember that for Mandatory (M) requirements, the response must always indicate explicitly whether or not its proposed Services meet the requirement. A statement, “(Vendor Name) has read, understands, and fully complies with this requirement” is acceptable.

For Mandatory Scored (MS) requirements, the response must always indicate explicitly whether or not its proposed Services meet the requirement. A statement, “(Vendor Name) has read, understands, and fully complies with this requirement” is acceptable, along with a description of how you meet the requirement, and any additional information requested.

For Desirable Scored (DS) requirements, the response must always indicate explicitly whether or not its proposed Services meet the requirement. A statement, “(Vendor Name) has read, understands, and fully complies with this requirement” is acceptable, along with a description of how you meet the requirement, and any additional information requested and/or supporting documentation.

5.1. General Requirements

5.1.1. (M) Designated Locations

Data Center Facilities must include both a primary facility and an secondary facility. It is required that the Vendor primary’s Data Center Facility is in Seattle, Washington and the secondary facility be on the East Coast. Please specify the addresses of both the primary and the secondary Data Center facilities you are proposing in your Response. Both locations must be vendor neutral.

5.2. Network Requirements

5.2.1. (M) The Microsoft Cloud for Government

The Vendor shall have connectivity to Microsoft Cloud for Government at both site locations.

5.2.2. (M) Layer 1 Network Services

The Vendor shall provide Layer 1 network services to connect the State of Washington’s networks/equipment through connectivity with various third-party Ethernet, Internet and associated cloud services such as Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

5.2.3. (M) Layer 1 Cross-Connectivity - Microsoft Azure Government

The Vendor shall provide Layer 1 cross-connectivity from the CTS network equipment, in the CTS Leased Enclosures, at both facilities to the Microsoft Azure Government (MAG) network edge.

5.2.4. (M) Layer 1 Cross-Connectivity - Amazon Web Services Commercial

The Vendor shall provide Layer 1 cross-connectivity from the CTS network equipment in the CTS Leased Enclosure Space at both facilities to Amazon Web Services (AWS) Commercial network edge.

5.2.5. (M) Layer 1 Cross-Connectivity- Other Providers



The Data Center Facilities shall have layer-1 cross connects to other vendors. Please list the number and type of cross connections available.

5.2.6. (M) Layer 1 Cross-Connectivity - Meet-Me-Room

The Vendor shall provide layer 1 cross-connectivity from the CTS network equipment in the CTS Leased Enclosures to the Meet-Me-Room (MMR) on the 19th floor of the Westin Tower located at 2001 6th Ave, Seattle, Washington, 98121

5.2.7. (M) Layer 1 Cross Connectivity – Single Vendor

All layer 1 cross-connectivity must be provided by a single Vendor at both facilities.

5.2.8. (M) Layer 1 Cross-Connectivity Request Response

The Vendor shall provide layer 1 cross-connectivity within twenty four (24) hours of CTS sending the Vendor its request.

5.2.9. (M) Accessible Carriers

The Vendor shall provide access to carriers. Please provide a complete list of carriers that are accessible at the Data Center Facilities.

5.2.10. (MS) Connecting To Carriers

The Vendor shall provide access to carriers. Describe the method of connecting to carriers not present in both facilities.

5.2.11. (MS) Data Center Interconnectivty

The Vendor shall be capable of providing data center interconnectivity between the primary and the secondary Data Center facilities.

5.3. Service Management

5.3.1. (MS) The Vendor must provide a remotely accessible aggregation portal that allows CTS to map connectivity to CTS separately purchased vendor cloud, Ethernet, and internet service providers.

5.3.2. (MS) The State of Washington requires IT administrative systems to implement secure authentication methods such as the examples below. Please describe the security methods deployed with the aggregation portal.

A. Single sign on using integration to customer’s Active Directory using Active Directory Federation Services (ADFS) and Security Assertion Markup Language (SAML)

B. Local Username/password with multi-factor authentication

C. Third party Username/password with multi-factor authentication



D. Username/password with internet protocol (IP) address restrictions

5.3.3. (M) Data transmission to and from the aggregation portal must be encrypted

5.3.4. (MS) Data at rest shall be encrypted. Describe how data at rest is secured in the aggregation portal via encryption or other methods.

5.3.5. (MS) Access to the aggregation portal shall have complex passwords. Describe the aggregation portals ability to enforce complex passwords.

5.3.6. (MS) The passwords stored in the aggregation portal shall be encrypted/hashed. Please describe how the aggregation portal stores passwords.

5.3.7. (MS) The aggregation portal shall have a service level commitment. Please state the SLA commitment for the aggregation portal.

5.3.8. (MS) Please describe the process for assigning aggregation portal access.

5.3.8.1. The aggregation portal data must only be viewed by the account holder and the Vendor. Describe how the vendor restricts customers from having access to other customer user accounts.

5.3.8.2. Describe what process would be followed to enable the vendor to see the customer configuration and other data, if required.

5.4. (M) Software OwnershipVendor’s Response must include a statement indicating whether the aggregation portal software is owned by manufacturer or a third party Vendor.

Vendor must identify the software owner and provide contact information; and

5.2.2 Vendor must provide the software owner’s licensing terms; and

5.2.3 Describe in detail the licensing model being proposed (for example, is it a site license with unlimited users, or a per user charge);

5.2.4 CTS must be able to use to Software consistent with RCW 43.105; and

5.2.5 Software owner must agree to participate in contract negotiations with CTS.



5.5. Physical Site Requirements

5.5.1. (M) Zoning Restrictions

The Vendor shall not have any local restrictions that impede its ability to operate the Data Center Facilities, for example, zoning laws, ability to run standby generators, ability to store generator fuel, etc.

5.6. Data Center Requirements

5.6.1. (M) Single Colocation Provider

The Vendor be the sole provider of Colocation Services at both Data Center Facilities as identified in this RFP.

5.6.2. (M) Telecommunication Infrastructure Standard Requirement

The Vendor shall ensure that both Data Center Facilities meet the Telecommunications Infrastructure Standard for Data Centers as defined in the latest current ANSI/TIA-942 standard.

5.6.3. (M) Concurrently Maintainable

The Vendor facilities must be concurrently maintainable (as defined in ANSI/TIA-942 with A-1 update published in April 2013, or latest version), by subsystem (Telecommunication, Architectural, Electrical, Mechanical.

5.6.4. (M) Cabling Pathways

The Vendor shall ensure that cabling pathways conform to the ANSI/TIA-569-C “Commercial Building Standard for Telecommunications Pathways and Spaces” or the then current industry equivalent.

5.6.5. (M) Bonding and Grounding

The Vendor shall follow bonding and grounding requirements for computer rooms, equipment cabinets, and enclosures requirements in ANSI/TIA-607-B or the then current industry equivalent.

5.6.6. (M) Heating, Ventilating, and Air Conditioning (HVAC)

The Vendor shall provide a monitored HVAC system that complies with the American Society of Heating, Refrigerating and Air Conditioning Engineers (ASHRAE Thermal Guidelines for Data Processing Environments refers to: Thermal Guidelines for Data Processing Environments, 3rd Ed. Published by American Society of Heating, Refrigerating and Air Conditioning Engineers (ASHRAE) in 2012 with September 2012 Errata, or the then current industry equivalent.

5.6.7. (MS) Building and Underlying Property Lease

CTS shall have uninterrupted interest in both Data Center Facilities, subject to the terms of the contract. Please detail whether the facilities are wholly owned or leased and whether the property is wholly owned or leased. In the case of the latter, please detail how long the lease has left to run upon service commencement for both Data Center Facilities and underlying property.

5.6.8. (MS) Past Events – Disruption to Service



Vendor shall not have a repeatable pattern of disrupted service. Please describe all past events (in the last 2 years) that have caused disruption to services similar to those being proposed under this RFP.

5.6.9. (MS) Parking

The Data Center Facilities shall provide parking. Please describe parking availability.

5.6.10. (MS) Meeting Rooms

The Data Center Facilities shall provide meeting rooms. Please describe any customer meeting rooms and its availability.

5.6.11. (DS) Vendor Regional Information

Describe in detail for both Data Center Facilities the surrounding ten-mile radius showing fuel or other hazardous material storage, airports, waterways, roadways, railways, and earthquake faults.

5.6.12. (DS) Office Space

Describe if Vendor has space available to reserve/rent in the Data Center Facilities, and the procedure for reserving or renting office space.

5.6.13. (DS) Cooling Water

Describe if Vendor provides on-site cooling capacity per the OEM equipment installation requirements when CTS’ has equipment that requires liquid cooling.

5.6.14. (DS) Water Supply

Describe if Vendor provides cooling water capability sized to support the CTS Leased Enclosure Space

load for 72 hours from an on-site or municipal water supply.

5.7. Infrastructure

5.7.1. (M) Shipping and Receiving

The Vendor must have shipping and receiving capabilities available during normal business hours.

5.7.2. (M) Movement of Equipment

The Vendor shall have policies and procedures for documenting the movement, staging and storage of CTS’ equipment into and out of the CTS Leased Enclosure Space and notifying CTS of receipt of equipment.

5.7.3. (M) Freight Elevator

The Vendor shall have a freight elevator for use in the event the loading dock is not on the same floor as the CTS Leased Enclosure Space.

5.7.4. (DS) Equipment Staging and Storage

Describe if Vendor provides an equipment staging and storage area for equipment moving from loading dock to data center.



5.7.5. (DS) Equipment Lift

Describe if Vendor provides equipment lifts for the CTS’ use to move and lift heavy equipment that weighs over 50 pounds.

5.7.6. (DS) Loading Dock

Describe what size semi-truck trailer vehicle the Vendor loading dock can accommodate.

5.8. CTS Leased Enclosure Space

5.8.1. (M) Enclosure Dual Cable Access

The Vendor shall provide at both Data Center Facilities dual power and telecommunication cable access to each CTS Leased Enclosure Space.

5.8.2. (M) Enclosure Doors

All Vendor provided enclosures shall have metal doors at the front and rear of each CTS Leased Enclosure Space to make sure we can isolate one customer’s environment (enclosure) from another at a physical level. Please describe how the Services provided at both Data Center Facilities meets this requirement.

5.8.3. (M) Floor to Ceiling Cage or Wall

The Vendor shall provide an option to lease enclosures at both Data Center Facilities that are separated via a cage or wall from floor to ceiling or separated rooms.

5.8.4. (M) Oversized Leased Enclosure Space

The Vendor shall provide at both Data Center Facilities floor space for larger footprint equipment or enclosures, such as mainframe, switch distribution, or storage equipment. Please describe how the Services provided at both Data Center Facilities meets this requirement.

5.8.5. (M) Power Feeds

The Vendor shall be able to provide at both Data Center Facilities power feeds to the CTS Leased Enclosure Space in the following configurations.

208 Volts AC, Three (3) Phase 208 Volts AC, Single Phase 115 Volts AC -48 Volts DC

5.8.6. (M) Dual Power from Independent Breakers

The Vendor shall provide at both Data Center Facilities dual power connections to each CTS Leased Enclosure Space that are fed from independent breakers.

5.8.7. (DS) Switched Enclosure Power Distribution Units



Describe Vendor’s ability to provide two (2) Vendor provided, but CTS managed, Switched Rack Power Distribution Units (PDUs) per Vendor provided equipment enclosure each with remote monitoring and switched control of each individual socket and an 115V, 15A convenience outlet. Switched Rack Power Distribution Units (PDUs) shall mean the Vendor provides advanced load monitoring combined with remote on/off switching control of individual outlets for power cycling, delayed power sequencing, and outlet use management.

5.8.8. (DS) Keyboard, Video, Mouse Services

Describe Vendor’s ability to provide keyboard, video, mouse (KVM) service per device OR portable crash carts.

5.8.9. (MS) Floor Load – Maximum Pounds

Vendor shall have ensured the CTS Leased Enclosure Space has the capability to install high density storage equipment if needed at no additional cost to upgrade the floor load capability. Describe Vendor’s maximum pounds supported per enclosure in the proposed space.

5.9. Space Reservation, Growth Options and Rights of First Refusal

5.9.1. (M) Contiguous Enclosures

The Vendor shall provide an option to lease contiguous enclosures. If there are available enclosures that meet this requirement then a first right of refusal will be available to CTS.

5.9.2. (MS) CTS Leased Enclosure Space – Service Changes

The Service shall provide flexibility in the amount and level of Services CTS consumes. CTS anticipates changes in its leased enclosure space needs. Describe your ability, lead-time, maximum or minimum enclosure sizing thresholds, including partitioned/half enclosures, and the process to increase and decrease over the duration of the contract.



5.9.3. (MS) Customer Racks

The Data Center Facilities must provide an option for CTS to install its own systems, racks and enclosures, Please provide details about the available options at the Data Center Facilities for customer racks? Please describe any restrictions on customer-sourced racks at each Data Center facility.

5.9.4. (DS) Ramped Deployments

Describe your ability to offer ramped deployments, such as starting and billing based on limited deployment against an eventual goal.

5.9.5. (DS) Contract Rightsizing

Describe your ability to offer contract rightsizing, such that the original contract can be adjusted for power allocation (including decrements) at a fixed period after the service commencement date based on observed usage.

5.10. PowerThe Vendor must meet the following Power Infrastructure requirements:

5.10.1. (M) Power – Generator

The Vendor shall provide monitored generator systems sized to support the data center load with an on-site fuel supply for 72 hours.

5.10.2. (M) Vendor Additional Fuel Supply

The Vendor shall ensure both Data Center Facilities will continue to have available generator fuel beyond the initial 72 hour on-site supply.

5.10.3. (M) Power – UPS and Generator Testing Policies and Procedures

The Vendor shall have policies, procedures, and communicate to CTS the schedule for UPS and Generator activation testing.

5.10.4. (M) Power – Bonding and Grounding

The Vendor shall be responsible for bonding and grounding and ensuring that is has been done properly.

5.10.5. (M) Power – Utility Power Feeds

The Vendor shall have a minimum of two (2) physically diverse underground power feeds to both Data Center Facilities.

5.10.6. (DS) Power – Different Substations

Describe if Vendor power feeds originate from different substations.

5.10.7. (DS) Power – Different Electrical Grids

Describe if Vendor power feeds originate different electrical grids.

5.10.8. (MS) Power – Runtime UPS at 100%



The Vendor runtime for the UPS shall be at 100% load. Describe the Vendor runtime for the UPS at 100% load, and at what percentage of capacity are both Data Center Facilities at today.

5.10.9. (MS) Power – Meter and Charge for Power Usage

The Vendor shall charge for power usage. Describe how the Vendor meters and charges for power usage at both Data Center Facilities. Please outline the level of detail that is provided on power usage for both facilities.

5.10.10.(MS) Power – Power Whips

The Vendor shall provide as many as six power whips in any high-density rack. Describe if the Vendor is able to provide as many as six power whips in any of the high-density racks. Please describe what is available at both Data Center Facilities.

5.10.11.(MS) Power – Fuel Providers

The Vendor shall have Service Level Agreements with its Fuel Providers to ensure availability of fuel supply as necessary to provide the Services herein.

5.11. Telecommunications

5.11.1. (M) Telecommunications Facilities

The Vendor shall have a minimum of two (2) physically diverse underground telecommunication paths from the local exchange carriers’ central office (CO), competitive local exchange carrier’s central office, and Internet Service Providers (ISPs) including, but not limited to, optical fiber-based cable and copper-based cable.

5.11.2. (M) Access Provider Space

The Vendor shall provide structured cabling connectivity to CTS Leased Enclosure Space from the Access Provider Space that meets, at a minimum, the Telecommunications Infrastructure Standard for Data Centers defined in ANSI/TIA-942 with A-1 update published in April 2013 or the then current industry equivalent.

5.11.3. (M) Access Provider Space – Vendor Access to Leased Enclosure Space

The Vendor shall provide the telecommunication Vendors have access to their equipment enclosure(s), Telecommunications Vendors must be restricted from other Telecommunication Vendors equipment.

5.11.4. (M) Data Center Cable Infrastructure

Vendor shall be able to provide, at CTS’ request, cabling connectivity down each row of each Leased Enclosure space that meets, at a minimum, the Telecommunications Infrastructure Standard for Data Centers as defined in ANSI/TIA-942 with A-1 update published in April 2013 (or latest industry equivalent) with separate trays for optical fiber and copper cables. Please indicate the types of cabling supported.

5.12. Fire Protection/Suppression

5.12.1. (M) Fire Suppression



The Vendor’s fire suppression system shall comply with National Fire Protection Association (NFPA) codes and standards, or the then latest industry equivalent.

5.13. Physical Security

5.13.1. (M) Physical Access Control – CTS Leased Enclosure Space

The Vendor shall ensure that access to the CTS Leased Enclosure Space is restricted through the use of high security mechanical or electronic locks.

5.13.2. (M) Physical Access Control – Data Center Facilities

The Vendor shall ensure that physical access to both Data Center Facilities is restricted by an access control system that controls and records physical access to each Data Center Facility.

5.13.3. (M) Physical Access Control – Compromises

The Vendor must prevent physical security compromises at both Data Center Facilities, for example, preventing a door from being propped open during equipment service, smoking breaks, etc.

5.13.4. (M) Physical Access Control – Mechanical Keys

The Vendor shall ensure that mechanical keys are restricted keys under the control of the Vendor’s physical security staff using a key control system.

5.13.5. (M) Physical Access Control – CTS’ Leased Enclosure Space

The Vendor shall ensure physical access to the CTS’ Leased Enclosure space is restricted by a two-factor access control system that controls and records physical access, verified against a list of personnel authorized by CTS.

5.13.6. (M) Vendor Monitoring

The Vendor shall use a continuous closed circuit television (CCTV) monitoring system to monitor all access and egress points twenty four (24) hours-per-day, 7 days-per-week for both Data Center Facilities.

5.13.7. (M) Cameras

The Vendor shall prohibit the use of personal Cameras in the CTS’ Data Center unless authorized, by advanced written approval by CTS.

5.13.8. (M) CTS Leased Enclosure Monitoring

The Vendor shall use a continuous closed circuit television (CCTV) monitoring system to monitor all CTS Leased Enclosure Space.

5.13.9. (M) Vendor Physical Security Staff

The Vendor shall provide armed or unarmed security guards licensed by the state where each Data Center Facility is located, or contract with a private security guard company licensed by the state where each Data Center Facility is located to monitor the physical security of both facilities twenty four (24) hours-per-day, 7 days-per-week.

5.13.10.(M) Physical Access Control – CTS’ VisitorsState of Washington A18-RFP-030


The Vendor shall restrict visitor physical access to the CTS’ Leased Enclosure space by verification against a list of visitors authorized by CTS.

5.13.11.(M) Physical Access Control – CTS Leased Enclosure Space

The Vendor shall provide restricted access to CTS’ Leased Enclosure space to only authorized personnel twenty-four (24) hours-per-day, seven (7) days-per-week.

5.13.12.(M) Physical Access Control System Failure

In the event of an access control system failure, the Vendor shall have a secondary system to document physical access and verification against hard-copy CTS approved access list.

5.13.13.(M) Physical Access Policies and Procedures

The Vendor shall ensure all personnel follow applicable policies and procedures pertaining to physical security and access control.

5.13.14.(M) Physical Access Notification of Violation

The Vendor shall have a process for notifying customers of a possible or confirmed violation of physical security. Please provide a copy with your Response.

5.13.15.(M) Physical Security Audits

The Vendor shall agree to physical security audits as requested by CTS.

5.13.16.(M) Records

The Vendor shall provide all systems records for a time period stated by CTS within two (2) Business Days from CTS request.

5.13.17.(M) Emergency Records Review

The Vendor shall provide all requested access control and continuous monitoring system(s) records for emergency review. Emergency review is defined as a request that requires an immediate response such as law enforcement involvement.

5.13.18.(M) Record Retention – CCTV/Video and Continuous Monitoring Systems

The Vendor shall retain for a minimum of ninety (60) days all CCTV/video and continuous monitoring system records.

5.13.19. (M) Record Retention – Physical Access Control Records and Logs

The Vendor shall retain five (5) years of physical access control records and (1) year of access control logs.

5.13.20. (M) Security System - Continuous Operation

The Vendor shall ensure continuous operation of the security systems.

5.13.21. (M) CTS Leased Enclosure – IP Camera



The Vendor must provide and install IP cameras that are cabled to the CTS Leased Enclosure Space at both facilities. CTS will connect these cameras to the CTS network at both facilities.The CTS Physical Security Operations Center (PSOC) located in Olympia, WA. will be monitoring the CTS Leased Enclosure Space via these cameras.



5.13.22. (M) Regulatory Compliance Requirements- Service Management and Physical Location

The Vendor shall comply with the then current version of all applicable regulatory requirements, including but not limited to:

5.13.23.(M) Health Insurance Portability and Accountability Act (HIPAA) compliance, including assent to the terms in Appendix H;

5.13.24.(M) Criminal Justice Information Services (CJIS) compliance;

5.13.25.(M) Federal Information Security Management Act (FISMA) compliance,

5.13.26.(M) All applicable Washington State Office of the Chief Information Officer (OCIO) compliance;

5.13.27.(M) Service Organization Control (SOC) 1 & 2 compliance;

5.13.28.(M) NIST SP 800-53 compliance;

5.13.29.(M) FIPS Publication 200 compliance;

5.13.30.(M) IRS Publication 1075 compliance including assent to the terms in Appendix I;;

5.13.31.(M) Payment Card Industry (PCI) compliance.

5.14. (M) Regulatory Compliance Verification

5.14.1. (M) The Vendor shall provide yearly SSAE 16 - SOC 2 Reports – or its then current equivalent - to CTS.

5.14.2. (M) The Vendor shall provide its latest Statement on Standards for Attestation Engagements Number 16 (SSAE 16), SOC 2 report upon CTS’ request. “Statement on Standards for Attestation Engagements Number 16 Report” (SSAE 16) shall mean a standard used to audit and report on the controls at service organizations that provide services to "user entities."

5.15. (M) Data - Service Management and Physical

5.15.1. (M) The Vendor shall not access or conduct any packet capturing, data monitoring and marking on CTS’ or its users data.

5.15.2. (M) Data that is transferred as part of the Services CTS consumes under this contract must stay within the boundaries of the 48 contiguous states in North America at all times.

5.15.3. (M) All data provided to the Vendor is exclusively owned by the state of Washington and a written agreement is required prior to any disclosure if the Vendor intends to use the data other than the primary purposes of providing the agreed Services herein.



5.16. Maintenance and Operations

5.16.1. (M) Support Services

The Vendor shall provide support for the services delivered including twenty four (24) hours-per-day, seven (7) days-per-week, three hundred sixty five (365) days-per-year call center, monitoring, fault detection, problem isolation, escalation, and restoration management of supported services, networks, physical security and equipment.

5.16.2. (M) Network Operations Center

The Vendor shall provide twenty-four (24) hours-per-day, seven (7) days-per-week Network Operations Center (NOC).

5.16.3. (M) Remote Hands

The Vendor shall provide Remote Hands services in both facilities with a response time of two (2) hours during the period Monday through Friday (M-F) 8:00 A.M. to 5:00 P.M. and twenty four (24) hours for all other times. Vendor must have the ability to provide on-site technicians with scheduled availability twenty four (24) hours-per-day, seven (7) days-per-week, for physical access to CTS’ equipment for services including but not limited to:

• IT Equipment Installation• CTS may request the Vendor to install and document IT Equipment within an enclosure for

approved installations• Connectivity Installations • CTS may request the Vendor to procure and install all cabling connectivity between

enclosures• Connectivity Installations • CTS may request Vendor to procure power, fiber and copper patch cords for approved

installations• Connectivity Installations• CTS may request the Vendor to install, test and document power, fiber and copper cabling

within an enclosure for approved installations• Provision and install cross connects between telecommunication circuit(s) and CTS’

environment• Plugging/Unplugging Cables - CTS may request the Vendor to unplug power, copper and

fiber cables from a customer device and re-plugging into the same port or receptacle, or other receptacle within the same enclosure, as specified by the customer

• Cable Labeling - CTS may request the Vendor to adding or change customer applied cable labels.

• Performing equipment inventory and labeling - CTS may request the Vendor to access a specific enclosure and document the contents of the enclosure to include device brand, model, serial number and State Tag. May also include documentation of network and other connections.

• Escorting personnel - Physical Security to escort assigned personnel into CTS Leased Enclosure Space



• Reporting equipment state, such as warning lights and status lights• Reporting the physical state of the equipment• Power cycling of equipment at the direction of CTS’ personnel• Removal and/or insertion of media at the direction of CTS’ personnel• Engage maintenance vendors in the resolution of detected equipment failures• Coordinate vendor-provided preventive maintenance• Assistance in telecommunication circuit acceptance testing• Installation of the telecommunication circuit(s) into the CTS Leased Enclosure Space• Coordinate telecommunication carrier circuit acceptance testing.

5.16.4. (M) Emergency Support Number and Email Address

The Vendor shall provide a toll-free customer support/emergency telephone number and email address that are monitored and answered twenty four (24) hours-per-day, seven (7) days-per-week for items such as, but not limited to: service questions, assistance, reporting Incidents, reporting Critical Service Impacts, submitting a trouble ticket, emergencies and Disaster Declarations.

5.16.5. (M) Service Repair and Trouble Reporting Response

The Vendor shall respond within fifteen (15) minutes, twenty-four (24) hours-per-day, seven (7) days-per-week, to a voice mail, page, or text or other contact from CTS’ personnel.

5.16.6. (M) Routine Maintenance

The Vendor shall conduct routine maintenance outside the hours of 6:00 a.m.to 10:00 p.m. Pacific Standard or Daylight Time.

5.16.7. (M) End-to-End Service Monitoring and Test Capability

The Vendor must have the capability of monitoring the service End-to-End and have the ability to perform remote site testing as necessary to troubleshoot problems with their service.

5.16.8. (MS) Continuous Monitoring

The Vendor shall have processes in place for continuous monitoring, recording conditions and alarms for the electrical and mechanical systems supporting the CTYS Leased Enclosure space. Please describe how the Services provided at both Data Center Facilities meets this requirement.

5.17. Service Impacting MaintenanceFor purposes of the following section, Service Impacting means the service is degraded and is either operating within the Service Level Agreement (SLA) specifications or not operating within the SLA specifications.

5.17.1. (M) Service Impacting Maintenance Notifications

Vendor must provide a minimum of seven (7) days’ notice to CTS prior to performing Service Impacting maintenance. In addition to other agreed upon contacts channels, notice must be provided to [email protected] and [email protected].

5.17.2. (M) Deferring Service Impacting Maintenance



The Vendor must defer Service Impacting maintenance for up to forty eight (48) hours upon request from CTS. CTS will notify Vendor a minimum of twenty four (24) hours of its request for deferring before the Service Impacting maintenance is scheduled.

5.17.3. (M) Non-Service Impacting Maintenance Notifications

The Vendor must provide a minimum three (3) days’ notice to CTS prior to performing non Service Impacting maintenance.

5.18. Incident Management

5.18.1. (M) Vendor Incident Policies and Procedures

The Vendor shall have Incident Management Policies and Procedures covering at a minimum its management and procedures with respect to Incidents, emergency maintenance, and after-incident follow-up. Please provide a copy with your Response.

5.18.2. (M) Incidents

The Vendor shall notify CTS within a maximum of fifteen (15) minutes of all Incidents once discovered, including, but not limited to:

5.18.2.1. Unauthorized physical and cyber access to either Data Center Facility;

5.18.2.2. Unauthorized physical and cyber access to CTS’ equipment or telecommunication facilities;

5.18.2.3. Cyber-incidents;

5.18.2.4. Vandalism to Vendor, CTS’ equipment, or telecommunication facilities;

5.18.2.5. Fire or discharge of Fire Suppression System;

5.18.2.6. Power failure to Vendor of either power feed;

5.18.2.7. Power failure of either feed to any CTS Leased Enclosure Space;

5.18.2.8. Failure of either telecommunication circuit feed to any CTS Leased Enclosure Space;

5.18.2.9. Water intrusion;

5.18.2.10. Natural or man-made environmental impacts;

5.18.2.11. UPS failures;

5.18.2.12. Generator failures; and

5.18.2.13. HVAC failures.

5.18.3. (M) Reporting Method for Incidents State of Washington A18-RFP-030


The Vendor shall notify CTS using both CTS e-mail and telephone contacts provided herein for all Incidents. First Response of reporting shall mean a phone call to WaTech (CTS) Support Center or via email [email protected].

5.18.4. (M) Repair Log for Incidents

The Vendor must maintain an Incident repair log listing the date of the repair occurrence, problem found, action taken to resolve the problem, and the total out-of-service time. Only issues affecting CTS services need be logged.

5.18.5. (M) Reason for Outage for Major Incidents

For Major Incidents a preliminary, non-official Reason for Outage (RFO) must be provided by email or by verbal conversation to CTS’ Network Operations Center Technicians and the CTS Data Center Facilities team within two (2) hours of a Major Incident. For Major Incidents that result in a breach of Service Level Performance Minimums, Contractor must provide an official RFO within seven (7) days after the incident causing the Outage is resolved.

5.18.6. (M) Status Reports for Incidents

For all active Incidents, the Vendor must provide periodic status report (type of problem, estimated time to repair, Vendor ticket number) to the CTS Network Operations Center and the CTS Data Center Facilities team.

5.19. Service Levels

5.19.1. (M) Availability

The Services must be provided and be available twenty (24) hours-per-day, seven (7) days-per-week, three hundred sixty five (365) days-per-year.

5.19.2. (M) Service Level Agreements

The Vendor shall provide Service Levels for the Services provided herein. Attach a copy of your standard service-level agreements (SLAs) for power, mechanical, cross connect, Ethernet, and all data center facility services with your response.

5.19.3. (M) Monthly Service Availability of 99.999%

The Vendor shall have a service availability (uptime) of 99.999% per month measured as ((hours for the month – downtime hours for the month) / hours for the month). Any service procured by CTS that is unavailable is considered to be an incident.

5.20. Business Continuity and Disaster Recovery

5.20.1. (M) Disaster Declaration Activation Plan

The Vendor shall have a Disaster Declaration Activation Plan that is designed to expedite activation of the Vendor’s services during recovery operations. This plan should include the availability of Vendor personnel and the Disaster Declaration verification process.



5.20.2. (M) Continuity of Operations Plan

The Vendor shall keep and maintain a Continuity of Operations Plan (COOP) that defines the processes and protocols that must be enacted to both respond to and restore availability of production services after a disaster.

5.20.3. (M) Vendor Continuity of Operations Testing & Reporting

The Vendor shall conduct semi-annual continuity exercises to validate the integrity of the COOP and provide regular updates to the COOP. The Vendor shall provide CTS semi-annual reports as to the results of such exercises.

5.20.4. (M) Recovery Site Details

Data that is transferred as part of the Services CTS consumes under this contract must stay within the boundaries of the 48 contiguous states in North America. The Vendor shall provide the site location for any potential location that could house CTS data and ownership of that location as a response to this requirement.

5.21. Additional Services

5.21.1. (MS) Professional Services

The Vendor shall offer Professional Services. For example, CTS may need assistances with planning, designing, configuring and operation of the integrated infrastructure consisting of items such as co-located network, information security, and any other equipment and vendor provided networking services. Please describe the professional services offered.

5.21.2. (M) Direct Access to Providers

CTS reserves the right to work directly with providers for both support and configuration of services.



SECTION 6

6. (MS 480) FINANCIAL PROPOSALRespond to the following requirements per the instructions in section 3. Submission of a response indicates compliance with the requirements set forth in Section 6.

6.1. OverviewCTS seeks to acquire the Services that best meet the State’s needs at the lowest cost and best value.

Contract prices must include all cost components needed for the provisioning of the Services as described in Sections 4 and 5. All costs associated with the Services must be incorporated into the price of the Response to the RFP. Any Services offered by the Vendor or its Subcontractor(s) that does not have a corresponding separate price will have no separate additional cost to CTS when acquired by CTS.

6.2. Financial Grounds for DisqualificationFailure to identify all costs in a manner consistent with the instructions in this RFP is sufficient grounds for disqualification.

6.3. TaxesVendor must collect and report all applicable state taxes as set forth in Vendor Licensed to do Business in Washington. Vendor must not include taxes on the Price List or in the Cost Model form.

6.4. Presentation of All Cost ComponentsAll elements of recurring and non-recurring costs must be identified and included in the Price List and Cost Model. This must include, but is not limited to, all administrative fees, maintenance, manuals, documentation, shipping charges, labor, travel, training, consultation services, wiring and supplies needed for the installation, equipment, warranty work and maintenance of the Services.

6.5. Miscellaneous Expenses Expenses related to day-to-day performance under any Contract, including but not limited to, travel, lodging, meals, incidentals will not be reimbursed to the Vendor. Hourly rates proposed by Vendor must include these costs.

6.6. Price ProtectionFor the entire term(s) of the Contract, the Vendor must guarantee to provide the Services at the proposed rates. Services rates cannot increase during any term of the Contract.

6.7. Price Decrease GuaranteeThe ASV, at its discretion, may elect to provide Services specified in this RFP at a lower price than originally quoted at any time during the term of the Contract.

6.8. Costs Not Specified



Where there is no charge or rate for Services enter N/C (no charge) or zero (0) on the Price List or Cost Model, as applicable. If the Vendor fails to provide a price, the State will assume the item is free. If the Vendor states “no charge” for an item in the model, the State will receive that item free for the period represented in the model.

6.9. Cost ModelThe Cost Model form contained in Appendix E must be completed using the pricing from Vendor’s proposed Price List included in its Response. Vendor must include in the Cost Model all cost components needed for the provisioning of the Services as described in Sections 4 and 5.

Do not include taxes in the Cost Model form. Vendor must collect and report all applicable state taxes.

All costs necessary to meet all mandatory and desired specifications identified in the Technical Requirements Section 5 must be included.

Include all the assumptions set forth in the Cost Model form when preparing your Response.

The Vendor must follow the instructions set forth below to complete the Cost Model, which will be the basis for evaluation of the Financial Response as specified in Section 7, Financial Proposal Evaluation. Use the forms in Appendix E, Cost Model, to itemize the costs associated with your proposed Services. All prices appearing in the Cost Model must also be included in Vendor’s Price List.

6.10. Price List Vendor must provide a Price List as an attachment to its Response. Such list shall include the prices for all Services necessary to meet the RFP's minimum mandatory requirements. Vendor’s Price List may include any additional products, software, and services appropriate to the scope of this RFP.

All terms on the price list must be compatible with the terms of the RFP and subsequent Contract.

All prices provided in the Appendix E Cost Model must be consistent with and cross-reference the Price List.



SECTION 7

7. EVALUATION PROCESS

7.1. OverviewThe Vendor who meets all of the RFP requirements and receives the highest number of total points as described below in the Section, Vendor Total Score, will be declared the ASV and enter into contract negotiations with CTS.

7.2. Administrative ScreeningResponses will be reviewed initially by the RFP Coordinator to determine on a pass/fail basis compliance with administrative requirements as specified herein. Evaluation teams will only evaluate Responses meeting all administrative requirements.

7.3. Requirements Responses meeting all of the administrative requirements will then be reviewed on a pass/fail basis to determine if the Response meets the Requirements. Only Responses meeting all Requirements will be further evaluated. The State reserves the right to determine at its sole discretion whether Vendor’s response to a Requirement is sufficient to pass.

If only one Vendor is determined to be responsive, the CTS may award a single contract without formal evaluation. At any time, the CTS may reject any and all proposals submitted in response to the RFP.

7.4. Vendor Scoring Only Responses that pass the administrative screening and Mandatory requirements review will be evaluated and scored based on responses to the scored requirements in the RFP. Responses receiving a “0” on any Mandatory Scored (MS) element(s) will be disqualified.

Evaluation points will be assigned based on the effectiveness of the Response to each technical requirement. A scale of 10 points will be used as the scale is defined as follows:

0 Unsatisfactory Vendor has ommited any discussion of the feature or capability, is non-responsive or the information provided is wholly inadequate.

1-2 Below Average Vendor’s feature or capability is substandard to that which is average or expected as the norm or vendor has not adequately established the capability to perform this requirement.

3-5 Average Vendor has an average capability to meet this requirement or has described its approach in sufficient detailed to be consided “as meeting minimum requirements”.

5-8 Above Average Vendor’s feature or capability is above-average or vendor has demonstrated its approach in sufficient detail to be considered “above average”.

8-10 Exceptional Vendor feature or capability is a far superior approach or solution to that which is expected as the norm.



7.4.1.Vendor Requirements Score

The RFP Coordinator will calculate the scores for each scored item in Section 4. The total scores of all the Vendor Requirements will be summed together and an average point score will be calculated as set forth below. This will be used in the calculation of Vendor’s total score, as set forth in, Vendor Total Score.

Sum of Evaluators’ Vendor Requirements Scores = Vendor’s Avg. Vendor ScoreNumber of Evaluators



Vendor’s Avg. Score x 750 = Requirements ScoreHighest Avg. Requirements Score



7.4.2.Financial Proposal Evaluation

The RFP Coordinator will calculate the financial score for the Financial Proposal section of the Response using the total implementation price for Vendor’s Cost Models.

Lowest Total Proposal x 480 = Financial ScoreVendor’s Total Proposal

7.4.1.Optional Client Reference Score

The RFP Coordinator will calculate the scores for each Client Reference Form, Appendix G. The total scores of all the Vendor’s Client References will be summed together and an average point score will be calculated as set forth below. This will be used in the calculation of Vendor’s total score, as set forth in, Vendor Total Score.

References Total Scores = Vendor’s Avg. ScoreNumber of Vendor’s References

Vendor’s Avg. Score x 50 Reference ScoreHighest Avg. Reference Score

7.5. Allocation of PointsThe scores for Response will be assigned a relative importance for each scored section. The relative importance for each section is as follows:

Vendor RequirementsFinancial ProposalClient References (Optional)

750 points480 points50 points

Total 1280 points

7.6. Vendor Total ScoreVendors will be ranked using the Vendor’s Total Score for its Response, with the highest score ranked first and the next highest score ranked second, and so forth.

7.7. Selection of Apparently Successful VendorThe Vendor with the highest Vendor Response Total will be declared the ASV. CTS will enter into contract negotiations with the ASV. Should contract negotiations fail to be completed within thirty (30) days after initiation, CTS may immediately cease contract negotiations and declare the Vendor with the second highest score as the new ASV and enter into contract negotiations with that Vendor. This process will continue until the Contracts are signed or no qualified Vendors remain.



APPENDIX ACERTIFICATIONS AND ASSURANCES

Issued by the State of WashingtonWe make the following certifications and assurances as a required element of the Response, to which it is attached, affirming the truthfulness of the facts declared here and acknowledging that the continuing compliance with these statements and all requirements of the RFP are conditions precedent to the award or continuation of the resulting Contract.

The prices in this Response have been arrived at independently, without, for the purpose of restricting competition, any consultation, communication, or agreement with any other offeror or competitor relating to (i) those prices, (ii) the intention to submit an offer, or (iii) the methods or factors used to calculate the prices offered. The prices in this Response have not been and will not be knowingly disclosed by the offeror, directly or indirectly, to any other offeror or competitor before Contract award unless otherwise required by law. No attempt has been made or will be made by the offeror to induce any other concern to submit or not to submit an offer for the purpose of restricting competition. However, we may freely join with other persons or organizations for the purpose of presenting a single proposal or bid.

The attached Response is a firm offer for a period of 90 days following the Response Due Date specified in the RFP, and it may be accepted by CTS without further negotiation (except where obviously required by lack of certainty in key terms) at any time within the 90 day period. In the case of protest, your Response will remain valid for 120 days or until the protest is resolved, whichever is later.

In preparing this Response, we have not been assisted by any current or former employee of the state of Washington whose duties relate (or did relate) to the State's solicitation, or prospective Contract, and who was assisting in other than his or her official, public capacity. Neither does such a person nor any member of his or her immediate family have any financial interest in the outcome of this Response. (Any exceptions to these assurances are described in full detail on a separate page and attached to this document.)

We understand that the State will not reimburse us for any costs incurred in the preparation of this Response. All Responses become the property of the State, and we claim no proprietary right to the ideas, writings, items or samples unless so stated in the Response. Submission of the attached Response constitutes an acceptance of the evaluation criteria and an agreement to abide by the procedures, compliance with Mandatory and all other administrative requirements described in the solicitation document.

We understand that any Contract awarded, as a result of this Response will incorporate all the solicitation requirements. Submission of a Response and execution of this Certifications and Assurances document certify our willingness to comply with the Contract terms and conditions appearing in Appendix B, or substantially similar terms, if selected as a contractor. It is further understood that our standard contract will not be considered as a replacement for the terms and conditions appearing in Appendix B of this solicitation.

We (circle one) are / are not submitting proposed Contract exceptions (see Subsection 3.14, Contract Requirements).

Vendor Signature Vendor Company Name

Title Date

Certifications and Assurances Appendix A

Consolidated Technology Services Page A-1

APPENDIX BPROPOSED CONTRACT

Posted separately on the CTS Web site at: http://cts.wa.gov/procurement/procurement.aspx

Proposed Contract Appendix B

Consolidated Technology Services Page B-1

http://cts.wa.gov/procurement/procurement.aspx

APPENDIX C(If Applicable) MWBE Participation Form

Minority and Women's Business Enterprises (MWBE)

Participation Form

MWBE participation is defined as: Certified MBEs and WBEs bidding as prime contractor, or prime contractor firms subcontracting with certified MWBEs. For questions regarding the above, contact Office of MWBE, (360) 753-9693.

In accordance with WAC 326-30-046, CTS goals for acquisitions have been established as follows: 12% MBE or WBE.

MBE FIRM NAME *MBE CERTIFICATION NO. PARTICIPATION %

WBE FIRM NAME *WBE CERTIFICATION NO. PARTICIPATION %

*Certification number issued by the Washington State Office of Minority and Women's Business Enterprises.

Name of Vendor completing this Certification: __________________________________________

MWBE Appendix C

Consolidated Technology Services Page C-1

APPENDIX D

Protest Procedure Appendix D

Consolidated Technology Services Page D-1

PROTEST PROCEDURE

A Vendor who is aggrieved in connection with the solicitation or award of a contract, who has submitted a response and participated in a debriefing conference, may submit a written protest to the Chief Legal Services Officer at Consolidated Technology Services, 1500 Jefferson Street SE, 5 th Floor, Olympia WA 98501 or [email protected].

Grounds

Protests may be based only on alleged bias on the part of an evaluator, mathematical error in the computation of the score, or failure to follow the process or standards stated in the related procurement document.

Timing

A protest shall be presented to CTS in writing no later than 5 Business Days after the post award debrief has occurred. The written letter shall state the grounds for the protest and state the relevant facts, circumstances and documents in support of the Vendor’s position.

Process

In conducting its review, CTS will consider all available relevant facts. CTS will resolve the protest in one of the following ways:

1. Find that the protest lacks merit and upholding the agency's action.2. Find only technical or harmless errors in the agency's acquisition process, determining the

agency to be in substantial compliance, and rejecting the protest; or3. Find merit in the protest and provide options to the agency, including:

a. Correcting errors and reevaluating all Responses;b. Reissuing the solicitation document; orc. Making other findings and determining other courses of action as appropriate.



mailto:[email protected]

Except as stated otherwise below, the Chief Legal Services Officer will review protests on behalf of the agency. The agency will deliver its written decision to the protesting vendor within five Business Days after receiving the protest, unless more time is needed. The protesting vendor will be notified if additional time is necessary. Exempt Purchases under $100,000 shall be reviewed only by the Chief Legal Services Officer, whose opinion is final.

Vendors may appeal the Chief Legal Service Officer’s determination, on Exempt Purchases over $100,000, by submitting an appeal in writing to the Director. An appeal shall be filed no later than 5 Business Days after Chief Legal Service Officer’s decision. Decisions made by the Director or designee are final.

In the event the Chief Legal Service Officer has a conflict of interest, the protest or appeal will be managed by a CTS senior level manager appointed by the Deputy Director. This individual must not be involved with the business that is the subject matter of the protest appeal.



APPENDIX E(MS 400) COST MODEL

a) DESCRIPTION

The intent of this worksheet is to enable CTS to know all the costs of your solution consistent with all Mandatory, Mandatory Scored, and Desirable Scored items located in this RFP. Where the Response does not provide a particular service or needed element of the solution, space is provided below to identify what additional service elements CTS must account for and the cost of those service elements.

Please only itemize costs located on the submitted Price List per Section 6.

b) ASSUMPTIONS

This is only an example to be used for pricing and does not guarantee this configuration nor sizing.

c) COST MODEL

a. (M) Billing Approach

Please provide a description of the general billing approach for the solution proposed. For example, provide information on how you bundle the costs into the one time/recurring enclosure charges, how you charge for floor space, how you charge for expansions and contractions of services. Specify variables which may impact pricing (e.g., sizing, tier pricing, etc.).

b. (MS – 80 Points) Service Availability Credits

a) The Vendor shall provide remedies for failure to meet service availability (uptime) of 99.999% per month by providing service level credits utilizing the following tiered approach.

b) Please complete the highlighted section in the table below.c) Please also specify your percentage reduction in the current monthly invoice and

explain the criteria and process.

Colocation Service

(Actual Availability)

Monthly Outage in Minutes

(~30 Day Month)

Vendor Service Level Credits

(Please fill out)

99.982%-100% 8 minutes 0%

99.75% - 99.981% 8 to 108 minutes

NDA for Procurement Documents Appendix F

Consolidated Technology Services Page F-1

99.67% - 99.74% 108 - 142 minutes

<99.67 >143 minutes

c. Cost ModelPlease complete the following Cost Model in an Appendix E. If discounts are identified, specify if these discounts are granted in perpetuity.

Appendix E – Cost Model Form

Location A (Seattle) Vendor Price $ ____________________

Scope of Work:

1ea. 1/2 Data Center IT equipment enclosure 2ea. (redundant) 2.5 kw enclosure power distribution units Place 2ea. cross connects from cloud vendor A to WaTech PE router located in the Watech

leased enclosure. Place 2ea. cross connects from cloud vendor B to WaTech PE router located in the Watech

leased enclosure. Place 2ea. cross connects third party vendor circuits to WaTech PE router located in the

Watech leased enclosure. Include 4 hours remote hands NRC for working with third party vendor and or CTS/WaTech to

complete test and acceptance of the installations. Install, configure and test 1ea. 10Gbps data center interconnectivity between the primary and

the secondary Data Center facilities.

Location B (East Coast) Vendor Price $____________________

Scope of Work: 1ea. full Data Center IT equipment enclosure 2ea. (redundant) 5.0 kw enclosure power distribution units Place 2ea. cross connects from cloud vendor A to WaTech PE router located in the Watech

leased enclosure. Place 2ea. cross connects from cloud vendor B to WaTech PE router located in the Watech

leased enclosure. Place 2ea. cross connects third party vendor circuits to WaTech PE router located in the

Watech leased enclosure. Include 4 hours remote hands NRC for working with third party vendor and or CTS/WaTech to

complete test and acceptance of the installations.



Quote must include MRC charges and NRC charges for IT equipment enclosures, power, labor and materials.



APPENDIX FNDA for Procurement Documents

Confidentiality and Nondisclosure Agreement

Between Consolidated Technology Services and -----------------

This Confidentiality and Nondisclosure Agreement (“Agreement”) is entered into by and between the Consolidated Technology Services an agency of Washington State government (“CTS”), and --------------- (“VENDOR”). VENDOR and CTS are sometimes referred to individually as a “Party” and collectively as the “Parties.” The Parties acknowledge that the Vendor has certain confidential or sensitive information and/or material that CTS requires access to in order to evaluate the Vendor’s response to RFP Colocation Data Services RFP ---------------------

Specifically, Vendor will share --------------------------

The Parties agree to the terms and conditions herein.

NOW THEREFORE, in consideration of the above premises and the promises contained herein, the Parties agree as follows:

1. Whenever used in this Agreement, the term “Confidential Information” will mean (i) information exempt from disclosure to the public or other unauthorized persons under either chapter 42.56 RCW or other state or federal statutes; or (ii) information related to Vendor’s security; or (iii) information that would ordinarily be considered confidential or proprietary in the light of the circumstances surrounding disclosure, whether or not so marked. Notwithstanding the foregoing, the term “Confidential Information”, shall not be construed to include information that (i) is or becomes readily available in public records or documents, or (ii) is known by Recipient prior to receiving it from Discloser, or (iii) is independently developed by Recipient or other third parties (iv) is disclosed pursuant to applicable law, judicial action or government regulations, including without limitation the Washington State Public Records Act, RCW 42.56, et seq.

2. The Parties acknowledge that the protection of their Confidential Information is essential. The purpose of this Agreement is to enable the Vendor to make disclosure of Confidential Information to CTS while still maintaining rights in and control over the Confidential Information. The purpose is also to preserve confidentiality of the Confidential Information and to prevent its unauthorized disclosure. It is understood that this agreement does not grant a CTS an express or implied license or an option on a license, or any other rights to or interests in the Vendor’s Confidential Information.



3. CTS will not remove, obscure or alter any confidentiality or trade secret notation from the Confidential Information without the Discloser’s prior written authorization.

4. Confidential Information will remain the exclusive property of the Vendor. Upon completion of the Project, or whenever requested by the Vendor, CTS will promptly destroy or return to Vendor all Confidential Information and all copies thereof, including summaries, reports or notes based thereon, unless otherwise expressly authorized by the Vendor in writing, or unless to do so would violate any federal or state law or court order.

5. CTS agrees that the breach of the terms of this Agreement would cause irreparable damage. Also, Vendor has the right to seek an order to restrain CTS from breaching this agreement.

6. This Agreement sets forth the entire agreement of the parties with respect to the use and disclosure of the Confidential Information and may be modified only by a writing signed by both parties. This Agreement will be construed and enforced in all respects in accordance with the laws of the State of Washington. The parties consent to the exclusive jurisdiction of the Superior Court of the State of Washington and exclusive venue in Thurston County, Washington.

7. Term. The Term of this Agreement shall be from the date of the last signature for one year, unless earlier terminated by either Party by giving eight (8) Business Days written notice to the other Party. Notwithstanding such termination or the expiration of this Agreement, the obligations of confidentiality shall continue for a period of two (2) years from the date the Confidential Information was received.

APPROVED APPROVED

State of Washington


Signature Signature

Print or Type Name Print or Type Name

Title Date Title Date



Appendix GData Center Tour NDA

Confidentiality and Nondisclosure Agreement

Between Consolidated Technology Services

and

xxxxx

This Confidentiality and Nondisclosure Agreement (“Agreement”) is entered into by and between the CONSOLIDATED TECHNOLOGY SERVICES, an agency of Washington State government (“CTS”), and------------ (“VISITOR”). VISITOR and CTS are sometimes referred to individually as a “Party” and collectively as the “Parties.”

The Parties acknowledge that CTS has certain confidential or sensitive information and/or material and VISITOR may require access to the CTS information for the purpose of TOURING THE CTS Colocation DATA CENTER (“Purpose”).

In the event that CTS does not share Confidential Information, this agreement will immediately terminate. Visitor agrees that if any Confidential Information is released or viewed during this tour, the Confidential Information will be managed pursuant to the terms and conditions contained in this Agreement.

The Parties further agree that the subject matter and contents disclosed and observed during the State Data Center Tour (and any related subsequent meetings and/ or communications, and related documentation) constitute CTS’ Confidential Information as defined in Section 1 below. The Parties agree to the terms and conditions herein.

NOW THEREFORE, in consideration of the above premises and the promises contained herein, the Parties agree as follows:

1. Whenever used in this Agreement, the term “Confidential Information” will mean (i) the subject matter and all content of the Tour, including technical and business information that describes or relates to the activities of the State Data Center (and any related subsequent meetings and/ or communications, and related documentation); (ii) information exempt from disclosure to the public or other unauthorized persons under either chapter 42.56 RCW or other state or federal statutes; or (iii) information related to the security and composition of the state of Washington CTS administered statewide network, unless otherwise identified as non-confidential at the time of disclosure; or (v) information that would ordinarily be considered confidential or proprietary in the light of the circumstances surrounding disclosure, whether or not so marked. Notwithstanding the foregoing, the term “Confidential Information”, shall not be construed to include information that (i) is or becomes readily available in public records or documents, or (ii) is known by Recipient prior to receiving it from Discloser, or (iii) is independently developed by Recipient or other third parties (iv) is disclosed pursuant to applicable law, judicial action or government regulations, including without limitation the Washington State Public Records Act, RCW 42.56, et seq.

Data Center Tour NDA Appendix G

Consolidated Technology Services Page G-1

2. Visitor agrees and acknowledge that the protection of Confidential Information is essential. The purpose of this Agreement is to enable CTS to make disclosure of Confidential Information to the Visitor as may be needed during the State Data Center Tour, while still maintaining rights in and control over the Confidential Information. The purpose is also to preserve confidentiality of the Confidential Information and to prevent its unauthorized disclosure. 3. The acts or omissions of Visitor’s Affiliates with respect to the Confidential Information shall be deemed to be acts or omissions of the Visitor.4. Visitor agrees that the breach of the terms of this Agreement would cause irreparable damage. Therefore, Visitor agrees that if it should breach its obligations hereunder, Visitor will defend, indemnify, and hold CTS harmless from actual damages from losses that result from its breach. This includes attorneys’ fees and costs of suit5. This Agreement sets forth the entire agreement of the parties with respect to the disclosure of Confidential Information and may be modified only by a writing signed by both Parties. This Agreement will be construed and enforced in all respects in accordance with the laws of the State of Washington. The parties consent to the exclusive jurisdiction of the Superior Court of the State of Washington and exclusive venue in Thurston County, Washington.APPROVED APPROVED

State of Washington


Signature Signature

Print or Type Name Print or Type Name

Title

Date

Title Date

6. Term. The Term of this Agreement shall be from the date of the last signature until --------------- unless earlier terminated by either Party by giving one month written notice to the other Party. Notwithstanding such termination or the expiration of this Agreement, the obligations of confidentiality shall continue for a period of two (2) years from the date the Confidential Information was received.

Data Center Tour NDA Appendix G

Consolidated Technology Services Page G-2

APPENDIX H

BUSINESS ASSOCIATES AGREEMENT

SAMPLE

The purpose of this Contract is to demonstrate the Business Associate relationship between the Contractor and the CTS, as defined by Health Insurance Portability and Accountability Act (HIPAA). 45 CFR 160.103 .

1. Definitions.

a. “Business Associate,” as used in this Contract, means the “Contractor” and generally has the same meaning as the term “business associate” at 45 CFR 160.103. Any reference to Business Associate in this Contract includes Business Associate’s employees, agents, officers, Subcontractors, third party contractors, volunteers, or directors.

b. “Business Associate Agreement” means this HIPAA Compliance section of the Contract and includes the Business Associate provisions required by the U.S. Department of Health and Human Services, Office for Civil Rights.

c. “Breach” means the acquisition, access, use, or disclosure of Protected Health Information in a manner not permitted under the HIPAA Privacy Rule which compromises the security or privacy of the Protected Health Information, with the exclusions and exceptions listed in 45 CFR 164.402.

d. “Covered Entity” means CTS, a Covered Entity as defined at 45 CFR 160.103, in its conduct of covered functions by its health care components.

e. “Designated Record Set” means a group of records maintained by or for a Covered Entity, that is: the medical and billing records about Individuals maintained by or for a covered health care provider; the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or Used in whole or part by or for the Covered Entity to make decisions about Individuals.

f. “Electronic Protected Health Information (EPHI)” means Protected Health Information that is transmitted by electronic media or maintained in any medium described in the definition of electronic media at 45 CFR 160.103.

g. “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191, as modified by the American Recovery and Reinvestment Act of 2009 (“ARRA”), Sec. 13400 – 13424, H.R. 1 (2009) (HITECH Act).

Appendix H

Consolidated Technology Services Page H-1

h. “HIPAA Rules” means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and Part 164.

i. “Individual(s)” means the person(s) who is the subject of PHI and includes a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

j. “Minimum Necessary” means the least amount of PHI necessary to accomplish the purpose for which the PHI is needed.

k. “Protected Health Information (PHI)” means individually identifiable health information created, received, maintained or transmitted by Business Associate on behalf of a health care component of the Covered Entity that relates to the provision of health care to an Individual; the past, present, or future physical or mental health or condition of an Individual; or the past, present, or future payment for provision of health care to an Individual. 45 CFR 160.103. PHI includes demographic information that identifies the Individual or about which there is reasonable basis to believe can be used to identify the Individual. 45 CFR 160.103. PHI is information transmitted or held in any form or medium and includes EPHI. 45 CFR 160.103. PHI does not include education records covered by the Family Educational Rights and Privacy Act, as amended, 20 USCA 1232g(a)(4)(B)(iv) or employment records held by a Covered Entity in its role as employer.

l. “Subcontractor” as used in this HIPAA Compliance section of the Contract (in addition to its definition in the General Terms and Conditions) means a Business Associate that creates, receives, maintains, or transmits Protected Health Information on behalf of another Business Associate.

m. “Unsecured PHI” is PHI that has not been made unusable, unreadable, or indecipherable to unauthorized individuals through the use of technology such as encryption.

n. “Use” includes the sharing, employment, application, utilization, examination, or analysis, of PHI within an entity that maintains such information.

2. Compliance. Business Associate shall perform all Contract duties, activities and tasks in compliance with the applicable HIPAA Rules, and all applicable attendant regulations as promulgated by the U.S. Department of Health and Human Services, Office of Civil Rights with respect to CTS protected health information (PHI).

Appendix H


3. Use and Disclosure of PHI. Business Associate is limited to the following permitted and required uses or disclosures of PHI:

4. Duty to Protect PHI. Business Associate shall protect PHI from, and shall use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 (Security Standards for the Protection of Electronic Protected Health Information) with respect to EPHI, to prevent the unauthorized Use or disclosure of PHI other than as provided for in this Contract or as required by law, for as long as the PHI is within its possession and control, even after the termination or expiration of this Contract.

5. Minimum Necessary Standard. Business Associate shall apply the HIPAA Minimum Necessary standard to any Use or disclosure of PHI necessary to achieve the purposes of this Contract. See 45 CFR 164.514 (d)(2) through (d)(5).

6. Disclosure as Part of the Provision of Services. Business Associate shall only Use or disclose PHI as necessary to perform the services specified in this Contract and set forth in the applicable SLAs, or as required by law, and shall not Use or disclose such PHI in any manner that would violate Subpart E of 45 CFR Part 164 (Privacy of Individually Identifiable Health Information) if done by Covered Entity, except for the specific uses and disclosures set forth below.

7. Use for Proper Management and Administration. Business Associate may Use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.

8. Disclosure for Proper Management and Administration. Business Associate shall not disclose the PHI without CTS permission. If CTS approves, Contractor may disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of the Business Associate, provided the disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been Breached.

Appendix H


9. Impermissible Use or Disclosure of PHI. Business Associate shall report to CTS in writing all Uses or disclosures of PHI not provided for by this Contract within one (1) business day of becoming aware of the unauthorized Use or disclosure of PHI, including Breaches of unsecured PHI as required at 45 CFR 164.410 (Notification by a Business Associate), as well as any security incident of which it becomes aware. Upon request by CTS, Business Associate shall mitigate, to the extent practicable, any harmful effect resulting from the impermissible Use or disclosure.

10. Failure to Cure. If CTS learns of a pattern or practice of the Business Associate that constitutes a violation of the Business Associate’s obligations under the terms of this Contract and reasonable steps by CTS do not end the violation, CTS shall terminate this Contract, if feasible. In addition, If Business Associate learns of a pattern or practice of its Subcontractors that constitutes a violation of the Business Associate’s obligations under the terms of their contract and reasonable steps by the Business Associate do not end the violation, Business Associate shall terminate the Subcontract, if feasible.

11. Termination for Cause. Business Associate authorizes immediate termination of this Contract by CTS, if CTS determines that Business Associate has violated a material term of this Business Associate Agreement. CTS may, at its sole option, offer Business Associate an opportunity to cure a violation of this Business Associate Agreement before exercising a termination for cause.

12. Consent to Audit. Business Associate shall give reasonable access to PHI, its internal practices, records, books, documents, electronic data and/or all other business information received from, or created or received by Business Associate on behalf of CTS, to the Secretary of DHHS and/or to CTS for use in determining compliance with HIPAA privacy requirements.

13. Obligations of Business Associate Upon Expiration or Termination. Upon expiration or termination of this Contract for any reason, with respect to PHI received from CTS, or created, maintained, or received by Business Associate, or any Subcontractors, on behalf of CTS, Business Associate shall:

(1) Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;

Appendix H


(2) Return to CTS or destroy the remaining PHI that the Business Associate or any Subcontractors still maintain in any form;

Appendix H


(3) Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 (Security Standards for the Protection of Electronic Protected Health Information) with respect to Electronic Protected Health Information to prevent Use or disclosure of the PHI, other than as provided for in this Section, for as long as Business Associate or any Subcontractors retain the PHI;

(4) Not Use or disclose the PHI retained by Business Associate or any Subcontractors other than for the purposes for which such PHI was retained and subject to the same conditions set out in the “Use and Disclosure of PHI” section of this Contract which applied prior to termination; and

(5) Return to CTS or destroy the PHI retained by Business Associate, or any Subcontractors, when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities.

14. Survival. The obligations of the Business Associate under this section shall survive the termination or expiration of this Contract.

15. Individual Rights.a. Accounting of Disclosures. CTS will not disclose the PHI without CTS prior

authorization.

(1) Business Associate shall document all disclosures, except those disclosures that are exempt under 45 CFR 164.528, of PHI and information related to such disclosures.

(2) Within ten (10) business days of a request from CTS, Business Associate shall make available to CTS the information in Business Associate’s possession that is necessary for CTS to respond in a timely manner to a request for an accounting of disclosures of PHI by the Business Associate. See 45 CFR 164.504(e)(2)(ii)(G) and 164.528(b)(1).

(3) At the request of CTS or in response to a request made directly to the Business Associate by an Individual, Business Associate shall respond, in a timely manner and in accordance with HIPAA and the HIPAA Rules, to requests by Individuals for an accounting of disclosures of PHI.

(4) Business Associate record keeping procedures shall be sufficient to respond to a request for an accounting under this section for the six (6) years prior to the date on which the accounting was requested.

b. Access –.

(1) Business Associate shall make available PHI that it holds that is part of a Designated Record Set when requested by CTS as necessary to satisfy CTS’s obligations under 45 CFR 164.524 (Access of Individuals to Protected Health Information).

Appendix H


(2) If the request for access to PHI in a designated record set is made by the Individual to the Business Associate, the Business Associate will refer the individual to CTS. If CTS asks the Business Associate to respond to a request, the Business Associate shall comply with requirements in 45 CFR 164.524 (Access of Individuals to Protected Health Information) on form, time and manner of access. When the request is made by CTS, the Business Associate shall provide the records to CTS within ten (10) business days.

c. Amendment. (1) If CTS amends, in whole or in part, a record or PHI contained in an

Individual’s Designated Record Set and CTS has previously provided the PHI or record that is the subject of the amendment to Business Associate, then CTS will inform Business Associate of the amendment pursuant to 45 CFR 164.526(c)(3) (Amendment of Protected Health Information).

(2) Business Associate shall not make any amendments to PHI in a Designated Record.

16. Subcontracts and other Third Party Agreements. In accordance with 45 CFR 164.502(e)(1)(ii), 164.504(e)(1)(i), and 164.308(b)(2), Business Associate shall ensure that any agents, Subcontractors, independent contractors or other third parties that create, receive, maintain, or transmit PHI on Business Associate’s behalf, enter into a written contract that contains the same terms, restrictions, requirements, and conditions as the HIPAA compliance provisions in this Contract with respect to such PHI. The same provisions must also be included in any contracts by a Business Associate’s Subcontractor with its own business associates as required by 45 CFR 164.314(a)(2)(b) and 164.504(e)(5).

17. Obligations. To the extent the Business Associate is to carry out one or more of CTS’s obligation(s) under Subpart E of 45 CFR Part 164 (Privacy of Individually Identifiable Health Information), Business Associate shall comply with the requirements set forth herein that would apply to CTS in the performance of such obligation(s).

18. Liability. Within ten (10) business days, Business Associate must notify CTS of any complaint, enforcement or compliance action initiated by the Office for Civil Rights based on an allegation of violation of the HIPAA Rules and must inform CTS of the outcome of that action. Business Associate bears all responsibility for any penalties, fines or sanctions imposed against the Business Associate for violations of the HIPAA Rules and for any imposed against its Subcontractors or agents for which it is found liable.

19. Breach Notification.

Appendix H


a. In the event of a Breach of Unsecured PHI or disclosure that compromises the privacy or security of PHI obtained from CTS or involving CTS clients, Business Associate will take all measures required by state or federal law.

b. Business Associate will notify CTS within one (1) business day by telephone and in writing of any acquisition, access, Use or disclosure of PHI not allowed by the provisions of this Contract or not authorized by HIPAA Rules or required by law of which it becomes aware which potentially compromises the security or privacy of the Protected Health Information as defined in 45 CFR 164.402 (Definitions).

c. Business Associate will notify the CTS Contact shown on the cover page of this Contract within one (1) business day by telephone or e-mail of any potential Breach of security or privacy of PHI by the Business Associate or its Subcontractors or agents. Business Associate will follow telephone or e-mail notification with a faxed or other written explanation of the Breach, to include the following: date and time of the Breach, date Breach was discovered, location and nature of the PHI, type of Breach, origination and destination of PHI, Business Associate unit and personnel associated with the Breach, detailed description of the Breach, anticipated mitigation steps, and the name, address, telephone number, fax number, and e-mail of the individual who is responsible as the primary point of contact. Business Associate will address communications to the CTS Contact. Business Associate will coordinate and cooperate with CTS to provide a copy of its investigation and other information requested by CTS, including advance copies of any notifications required for CTS review before disseminating and verification of the dates notifications were sent.

d. If CTS determines that Business Associate or its Subcontractor(s) or agent(s) is responsible for a Breach of unsecured PHI:

(1) requiring notification of Individuals under 45 CFR § 164.404 (Notification to Individuals), Business Associate bears the responsibility and costs for notifying the affected Individuals and receiving and responding to those Individuals’ questions or requests for additional information;

(2) requiring notification of the media under 45 CFR § 164.406 (Notification to the media), Business Associate bears the responsibility and costs for notifying the media and receiving and responding to media questions or requests for additional information;

(3) requiring notification of the U.S. Department of Health and Human Services Secretary under 45 CFR § 164.408 (Notification to the Secretary), Business Associate bears the responsibility and costs for notifying the Secretary and receiving and responding to the Secretary’s questions or requests for additional information; and

(4) CTS will take appropriate remedial measures up to termination of this Contract.

23. Miscellaneous Provisions.

a. Regulatory References. A reference in this Contract to a section in the HIPAA Rules means the section as in effect or amended.

Appendix H


b. Interpretation. Any ambiguity in this Contract shall be interpreted to permit compliance with the HIPAA Rules.

c. Data Formats Included. This Contract applies to PHI received from the CTS in electronic, handwritten, typed or digital formats, stored in either magnetic or optical media, provided to Contractor as part of Contractor’s role in providing technical services to the CTS.

d. Data Sharing Agreement. With respect to the performance of this Agreement, the Contractor agrees to comply with all applicable requirements of the information security standards document, 141.10 - Securing Information Technology Assets Standards, promulgated by the Office of the Chief Information Officer for the State of Washington

APPENDIX I

FTI Compliance Language

I. PERFORMANCE

In performance of this contract, Vendor agrees to comply with and assume responsibility for compliance by his or her employees with the following requirements with respect to FTI data in CTS’ possession or control.

1. All work requiring Vendor involvement, will be done under the supervision of Vendor or Vendor’s employees.

2. All Vendor Contractor work performed without an escort will be subject to the Publication 1075 “Exhibit 7- Safeguarding Contract Language” located in the then current version.

3. Vendor employees with Physical Access to FTI must meet the background investigation requirements defined in IRS Publication 1075.

4. Upon receipt of CTS Customers policy and with a reasonable implementation time, Vendor employees with Physical Access to FTI must meet the background investigation requirements defined by CTS Customer policy.

Appendix H


5. The Parties agree that return information will not be provided to Vendor as part of the Colocation Services being provided. IN the event any return or return information is made available in any format to Vendor, it shall be used only for the purpose of carrying out the provisions of this contract. Information contained in such material will be treated as confidential and will not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Disclosure to anyone will be prohibited without prior CTS approval and a documented need to have the FTI disclosed.

6. All CTS and CTS Customer computer systems processing, storing, or transmitting FTI must meet the requirements defined in IRS Publication 1075. To meet functional and assurance requirements, CTS Customers will ensure the security features of the environment must provide for the managerial, operational, and technical controls. CTS Customers will follow the appropriate and applicable facilities controls as set forth in Exhibit A. All security features must be available and activated to protect against unauthorized use of and access to Federal tax information. CTS Customers will use best efforts to provide information timely access to all information for reporting, auditing, and corrective action plans that CTS Customers deems necessary.

7. Vendor is bound by the provisions of Publication 1075, relative to protecting all FTI within their possession or control as set forth.

8. Vendor in conjunction with CTS, is responsible to address corrective action recommendations that pertain to the date center to resolve findings of noncompliance identified by IRS inspections.

9. Vendor shall, upon discovering a possible improper inspection or disclosure of FTI, including breaches and security incidents, by a federal employee, a state employee, or any other person, the individual making the observation or receiving information must contact the CTS CISO within 12 hours at the contact information below:

a. Cindi Hart

10. No work involving FTI furnished under this contract will be subcontracted without prior written approval of the IRS. Vendor will use best efforts to update its contracts with subcontractor for its existing subcontractors.

Appendix H


11. Vendor will maintain a list of employees authorized access to the facilities, when that employee is allowed unescorted access. Such list will be provided to the agency and, upon request, to the IRS reviewing office.

12. CTS will have the right to void the contract if Vendor fails to provide the safeguards described above.

II. CRIMINAL/CIVIL SANCTIONS:

(1) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1.

(2) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or

Appendix H


disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431.

(3) Additionally, it is incumbent upon CTS to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(4) Granting a contractor access to FTI must be preceded by certifying that each individual understands the agency’s security policy and procedures for safeguarding IRS information. Contractors must maintain their authorization to access FTI through annual recertification. The initial certification and recertification must be documented and placed in the agency's files for review. As part of the rertification and at least annually afterwards, contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For both the initial certification and the annual certification, the contractor must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

III. INSPECTION:

The IRS,CTS and CTS Customers, with 24 hour notice, shall have the right to send its inspectors in to the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, s tore, process or transmit FTI. On the basis of such inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with contract safeguards.

IV. INTERNAL INSPECTIONS

Appendix H


CTS and CTS Customers will conduct an internal inspection of the data center at a minimum, every 18 months. Results will be shared with Vendor. Vendor will work with CTS to resolve any recommendations that arise from the inspection.

Vendor agrees to follow the applicable then current standards around internal inspections for recordkeeping, secure storage, limited access, disposal, and computer security. Currently, these obligations are set forth in more detail in Section 6.4 of the Guideline.

Unless the then current standard sets forth a different obligation, Vendor agrees it will:

1. Provide an objective assessment conducted by a function other than the using function,2. Have an 18 month review cycle.3. Complete a documented schedule detailing the timing of all internal inspections in the

current year and the next two years. 4. Not have Logical Access to any Customer FTI data as part of Colocation Services.

The Parties agree to use the most current version of the IRS Publication 1075, Tax Information Security Guideline for the provisioning of this Service. In the event of a conflict, the then current Guideline shall prevail.

Appendix H


Appendix J

A Few Critical Things to Keep in MindWhen Responding to an RFP for


This document is explanatory only and has no consequence on the processes stated in any particular procurement.

1. _______ Read the entire document. Note critical items such as: mandatory requirements; supplies/services required; submittal dates; number of copies required for submittal; funding amount and source; contract requirements (i.e., contract performance security, insurance requirements, performance and/or reporting requirements, etc.).

2. _______ Note the procurement officer's name, address, phone numbers and e-mail address. This is the only person you are allowed to communicate with regarding the RFP and is an excellent source of information for any questions you may have.

3. _______ Take advantage of the “question and answer” period. Submit your questions to the RFP Coordinator by the due date listed in the Schedule of Events and view the answers given in the formal “addenda” issued for the RFP. All addenda issued for an RFP are posted on the State’s website and will include all questions asked and answered concerning the RFP.

4. _______ Follow the format required in the RFP when preparing your response. Provide point-by-point responses to all sections in a clear and concise manner. Make sure to address each subpart.

5. _______ Provide complete answers/descriptions. Read and answer all questions and requirements. Don’t assume the State or evaluator/evaluation committee will know what your company capabilities are or what items/services you can provide, even if you have previously contracted with the State. The proposals are evaluated based solely on the information and materials provided in your response.

Appendix H


6. _______ Check the State’s website for RFP addenda. Before submitting your response, check the State’s website at http://cts.wa.gov/procurement/procurement.aspx to see whether any addenda were issued for the RFP.

7. _______ Review and read the RFP document again to make sure that you have addressed all requirements and have followed all of the instructions. Once you have done that, read the RFP document again.

8. _______ Submit your response on time. Note all the dates and times listed in the Schedule of Events and within the document, and be sure to submit all required items on time. Late proposal responses are never accepted

Appendix H
