rfo 14-144083 - 21st century project assessment

August 22, 2014

CALIFORNIA DEPARTMENT OF TECHNOLOGY REQUEST FOR OFFER 14-144083

Assessment of State Controller’s 21st Century Project The California Department of Technology (Department of Technology) is soliciting a Contractor to provide an independent assessment of the SAP solution for the State Controller’s Office’s 21st Century Project. Please review this Request for Offer (RFO) entitled Department of Technology RFO #14-144083 Assessment of State Controller’s 21st Century Project. In submitting your offer, you must comply with the instructions contained herein. The services required are identified in the Statement of Work (SOW) (Exhibit A). Responses to this RFO will be reviewed, and the award made, using the IT Master Service Agreement (MSA) Best Value Evaluation (Attachment 1). Responses are due by 10/01/2014, by 2:00 p.m. Pacific Time. Mail or deliver one (1) original, three (3) copies, and one (1) CD/DVD-ROM or flash drive of your response clearly labeled to the Department Contact named below. Questions regarding this RFO must be sent via email by the date stated in the Key Action Dates. An official response will be released to all interested vendors via a Question and Answer document.

Department Contact: Ms. Sandy Louie

California Department of Technology Procurement and Contracting Services Branch

916-431-3600 [email protected]

Parcel Post (FedEx, UPS, etc.) or Hand Delivered

United States Postal Service (USPS)

California Department of Technology Attn: Ms. Sandy Louie 10860 Gold Center Drive Suite 200 (Security Desk) Rancho Cordova, CA 95670

California Department of Technology Attn: Ms. Sandy Louie Mail Stop Y18 P.O. Box 1810 Rancho Cordova, CA 95741

Please seal and mark your response “Request for Offer – Do Not Open”, and list the RFO number 14-144083 on the front of your package. NOTE: Neither email submittals, nor fax transmittals of proposals will be accepted for this RFO. Under no circumstances shall late deliveries be accepted. All responses received after the due date and time shall be returned to the vendor unopened.

mailto:[email protected]

CALIFORNIA DEPARTMENT OF TECHNOLOGY RFO #14-144083 ASSESSMENT OF 21ST CENTURY PROJECT

Assessment of 21st Century Project

1. BACKGROUND The State Controller’s Office (SCO) is responsible for issuing pay to employees of the state civil service, California State University (CSU) and Judicial Council. There are currently over 160 departments and 24 CSU campuses in the State of California. The state workforce is comprised of approximately 275,000 employees, represented by 21 state civil service bargaining units and 10 CSU bargaining units. Employees are located throughout California and in other states, and range from elected officials, managers and supervisors, and higher education faculty, to rank and file workers in a variety of occupations. In May 2004, the Department of Finance (DOF) approved the Feasibility Study Report (FSR) for the 21st Century Project. The FSR established that the existing Human Resource Management System (HRMS)/payroll systems operated by the SCO were outdated and did not meet the needs of today’s government. Based on this approval, the SCO initiated a two-phased procurement process. The purpose of the first procurement was to select a commercial off-the-shelf (COTS) software product to support the state’s human resource management needs; the second phase was to secure the services of an experienced integrator to implement the COTS solution. In April 2005, the software procurement was finalized and SAP was selected as the COTS software for the State’s new HRMS/payroll system, called MyCalPAYS. The second phase of the procurement process began in May 2005 with the release of a Request for Proposal (RFP) for systems integrator services. In June 2006, the contract was awarded to a vendor. That contract was later cancelled and an RFP for a new SI vendor was released. Upon conclusion of the two-stage procurement and evaluation process, SAP Public Services, Inc. was selected for contract award. The contract with SAP Public Services, Inc. was approved by DGS on February 2, 2010. The accepted strategy of Special Project Report (SPR) 4 consists of a complete build of the MyCalPAYS system, followed by an SCO-only pilot, followed by a second larger pilot, and then the implementation of three sequential “waves” of departments of as many as 85,000 employees each. When the contract was executed a month later than anticipated in the final proposal, a decision was made to combine the two pilots and deploy them on the second pilot’s go-live date, September 2011. In early 2011, it became evident the existing conversion methodology to extract, transform and load the legacy data into the SAP system was not working, and that it would not be feasible for converting the large employee populations planned for each wave. A re-planning effort in April and May 2011 concluded that a September 2011 go-live, for even a reduced population, was not viable. SPR 5 recommended extending the project for one additional year. The roll-out of Pilot 1 (June 2012) would include only the SCO and would demonstrate whether the system functioned as contractually and legally required and, if not, allow for a window of time to address any issues while ensuring that any risk of payroll errors would be limited to only the employees of the State Controller.


The SCO population was selected to manage system rollout with limited risk given the SCO’s small employee population, representing roughly one half of one percent (0.5%) of the ultimate State employee population to be paid using the new system. Pilot 2 would follow three months later adding just 10,000 new State employees to the system to ensure it worked for a population significantly larger than that of Pilot 1, but still small relative to the total State employee population to be served by the system. Pilot 2 would then be followed by a phased deployment of the remaining departments in three successive waves assuming the system worked. In June 2012, the SCO deployed Pilot 1 of the MyCalPays system. The pilot revealed a significant volume of troubling errors. The SCO worked with SAP in good faith to go through the errors and ensure that SAP was addressing them as contractually required. SAP did not cure the issues as required and, in October 2012, the SCO issued a cure letter to compel SAP to fulfill its contractual obligations. While the SCO hoped SAP would successfully cure its system’s failure to deliver an accurate, stable, and reliable payroll, SAP failed to cure as contractually required. For the next several months errors in pay produced by the payroll system continued and SAP failed to provide the SCO a viable recovery plan to address them. Consequently, in February 2013, SAP’s failure to meet its contractual obligation to cure, left the State with no choice but to terminate the contract with SAP as the system integrator for the MCP system. Following this termination, the Department of Technology suspended the 21st Century Project pending approval of an evaluation of the lessons learned and a go-forward strategy/plan. In June 2013, the SCO and SAP participated in contractual mediation. After it became clear that the mediation process was at an impasse, it was ended. On November 21, 2013, the SCO filed a lawsuit against SAP for breach of contract. There are seven (7) project team members (both staff and consultants) in the Project Management Office remaining at SCO but the State will make all concerted effort to identify and make available project staff regardless of state department that currently work for to ensure the assessment team has access to the most knowledgeable resources. Please see Attachment 5 for the project organization chart as of January 2013. The state is going to conduct several project assessments including:

1. A MyCalPAYS system/software assessment, 2. An options and alternatives analysis for a different system, and 3. A project management assessment.

The first step is to understand what California received for its money, what is reusable and what the estimated cost to complete the project is. The scope of Assessment 1 includes the following:

• Determining how well the current MyCalPAYS design and system meet the State’s business and legal requirements, including identifying which requirements are not satisfied by the system.

• Determining what portion of the current MyCalPAYS design and system may be usable.


• Determining the estimated cost to complete the system ensuring that it is compliant with the State’s business and legal requirements, with no material changes to the current system.

Assessment 2 is an options and alternatives assessment. The objective is to determine alternatives to the current planned approach. Assessment 3 is a project management assessment. The objective of this assessment is to determine the effectiveness of the project management. This RFO is for the first assessment. Vendors who performed work on the 21st Century Project are prohibited from bidding this assessment. The awarded vendor will be able to submit offers on subsequent assessments, and will only be able to submit offers on any subsequent project work that is not the result of a recommendation from the assessment. Assessments 2 and 3 will be conducted in the future. 2. KEY ACTION DATES

Adherence to the following schedule of dates and times is required. If the Department of Technology finds it necessary to change any of these dates, it will be accomplished by issuing an addendum.

KEY ACTION DATES DATE Release of RFO 8/22/14 Last Day to Submit Questions 9/3/14 Release of Answers to Questions 9/5/14 RFO Response Submission Due Date (2:00 PM, PT) 10/1/14 Interviews* 10/13/14-10/17/14 Proposed Award Date 10/27/14

*Interviews are not required and will be conducted at the sole discretion of the Department. A 1-2 day advance notice will be given when interviews will take place, but team members must plan on attending an interview within the dates shown for interviews as noted above.

3. AUTHORITY TO CONTRACT OUT

This solicitation is being conducted under the policies and procedures developed by the Department of General Services (DGS) as provided under Public Contract Code (PCC) sections 12100 et seq.


4. CONSULTANT ADMONISHMENT OF FOLLOW-ON CONTRACTS

No person, firm, or subsidiary thereof who has been awarded a consulting services contract, or awarded a contract which includes a consulting component, may submit a bid for, nor be awarded a contract for, the provision of services, procurement of goods or supplies, or any other related action which is required, suggested, or otherwise deemed appropriate in the end product of the consulting services contract. Therefore, any consultant that contracts with the State to develop and provide formal recommendations for the acquisition of IT products or services is precluded from contracting for any work recommended in the formal recommendation.

5. BUDGET AMOUNT The contract shall not exceed $1,275,000 and there is no obligation on the Department of Technology’s part to utilize the entire amount.

6. RFO RESPONSE GUIDELINES Responses to this RFO shall contain all data/information requested and shall conform to the format described in this RFO. It is the responsibility of the Respondent to provide all required data, and any other information deemed necessary, for the Department of Technology to determine and verify the Respondent’s ability to produce the deliverables defined in the SOW, Exhibit A. Unless otherwise specified, all electronic files and media submitted in response to this RFO must be in formats compatible with the Department of Technology’s standard desktop computing environment, which consists of Microsoft (MS) Windows 7 SP 1, MS Office Suite 2010, and Adobe Acrobat Reader XI, et al.

7. RFO RESPONSE CONTENT The following shall be submitted in the RFO response, in the order specified below and will be reviewed for completeness as pass or fail. Any response that fails may be deemed non-responsive. a. Cover Letter

A cover letter signed by the individual authorized to bind the company that must state that they agree to all of the terms and conditions set forth in this RFO.

b. Table of contents A table of contents that lists the following response sections.

c. Methodology and Work plan Provide a detailed methodology and work plan identifying: (1) Each deliverable, including non-payable deliverables (e.g., status reports)


(2) The methodology for how the work will be undertaken including any proposed tools (e.g., testing software).

(3) Specific activities to implement the methodology (e.g., Contractor will review the following documents (and include list of documents)).

(4) All resources needed from the state (e.g., project staff to interview, system environment to conduct tests) and when they will be needed (e.g., start of step 1 and ending in step n).

d. Timeline/Schedule and responsible and involved parties

Identify when activities will start and end and who on the vendor’s team is leading each activity.

e. Required State Resources Identify state resources needed by function (e.g., Project Manager, Subject Matter Expert), if any, for each activity, and the effort and duration of state resources. This will enable the State to know when to make the resources available.

f. Staff Experience/resumes

The response must include a completed Staff Experience Worksheet (Attachment 2) with attached resume(s) and any additional attachments necessary detailing current or past experience of the consulting team members (not the firm’s experience) being proposed for this engagement. Team members are defined as any resource being proposed, whether at the prime or subcontractor’s firm. Staff experience worksheet is not required or necessary to be submitted for the engagement manager or administrative support staff. Sufficient detail should be provided for the Department of Technology to confirm experience commensurate with technical assessment services requested in the SOW. Only include engagements with commensurate experience for the role the team member is being proposed on Attachment 2 and on the resume.

g. References

Two (2) references (each submitted on a separate Attachment 3) which have used similar services for each proposed team member (not the firm) identified for this effort that can confirm the team member’s knowledge, skills, and experience. Experience must have occurred in the last ten (10) calendar years. A reference must be external to the Respondent’s organization and corporate structure. References must support the depth and breadth of experience required. References are to include customer name and address, and the name, telephone number and e-mail address of a contact person. For purposes of this solicitation, the Department of Technology may be used as a reference, including current or former Department of Technology employees. The Department of Technology staff may contact referenced organizations to verify the information provided. Negative responses from references may be cause for rejection of the response/offering.


h. A signed Security and Confidentiality Statement (Attachment 4).

i. A completed Payee Data Record (Std. 204) available for download at the following link: http://www.documents.dgs.ca.gov/osp/pdf/std204.pdf

j. Cost Worksheet

A completed Cost Worksheet (Exhibit B-1). All costs shall be filled in by the Respondent. Provide the classification(s) and hourly rate(s) for the description of services/task(s) described in this RFO SOW (Exhibit A). Proposal costs to this RFO are subject to the Department of General Services' Leveraged Procurement Agreement dollar limitations for IT MSA acquisitions. If you have more deliverables than is noted in Exhibit B-1, please add rows and then complete for the additional deliverables. The number of deliverables in this exhibit is no indication of the expected number of deliverables for this engagement.

k. The complete IT MSA agreement including the signed STD 213 that shows the contract number, IT MSA term dates, and the DGS Contract Administrator’s signature, including any supplements must be included with only the original response (not copies) and only on the CD/DVD-ROM or flash drive.

l. A completed Bidder Declaration (GSPD-05-105) available for download at the following link: http://www.documents.dgs.ca.gov/pd/delegations/GSPD105.pdf. When completing the declaration, all subcontractors proposed for participation in the contract must be identified.

8. ADMINISTRATIVE INFORMATION a. This RFO and the Respondent’s response will be incorporated by reference

into the resulting Contract.

b. Upon RFO response opening, all documents submitted in response to this RFO will become the property of the State of California, and will be regarded as public records under the California Public Records Act (Government Code Section 6250 et. seq.) and subject to review by the public.

c. Upon an executed Contract, the Contractor shall submit a signed Conflict of

Interest, Statement of Economic Interest Form 700 (provided by the Department of Technology Contract Administrator) for himself, his employees and any subcontractors assigned to this effort. Further information is available at the following address: http://www.fppc.ca.gov.

http://www.documents.dgs.ca.gov/osp/pdf/std204.pdf

http://www.documents.dgs.ca.gov/pd/delegations/GSPD105.pdf

http://www.fppc.ca.gov/


d. Federal Tax Administration Requirements The Department of Technology must notify the United States Internal Revenue Service (IRS) prior to executing, or amending, any contract to disclose, or provide access to, federal tax information (FTI) to a Contractor or Sub-Contractor, at least 45 calendar days prior to the disclosure of FTI, to ensure appropriate contractual language is included and that Contractors are held to safeguarding requirements. This procedure conforms to IRS Publication 1075, Exhibit 12 - 45-DAY NOTIFICATION REQUIREMENTS. If an unfavorable response is received by the IRS, the contract will be terminated immediately, per General Provisions – Information Technology (GSPD-401), clause 23, Termination for Default.


EXHIBIT A STATEMENT OF WORK

1. OBJECTIVE

Three (3) separate assessments will focus on key objectives that are required to develop a strategic direction to move the project forward.

Assessment 1 [the assessment called for in this statement of work (SOW)] is the MyCalPAYS system and software assessment. The objective of this assessment is to determine which of the system requirements are met by the system, what could be leveraged from the project if the State moved forward with the current software and design, and what is the estimated cost to complete the project as planned.

2. TERM/PERIOD OF PERFORMANCE

a. The period of performance for the Contract shall be from two weeks after the

proposed award date noted in Section 2 – Key Action Dates and June 30, 2015, with option to extend for one additional 12 month term at the original rates evaluated and considered.

b. The Contractor shall not be authorized to deliver or commence the performance of services as described in this SOW until written approval has been obtained from all entities. Any delivery or performance of service that is commenced prior to the signing of the Contract shall be considered voluntary on the part of the Contractor and non-compensable.

c. Consistent with the terms and conditions of the original solicitation, and upon mutual consent, the Department of Technology and the Contractor may execute written amendments for changes to this Contract that were evaluated and considered.

3. QUALIFICATIONS a. Mandatory Qualifications

The firm and proposed team members must have the following minimal mandatory experience. Additional points will be provided for additional years of experience in the various categories. i. Firm Experience

1. A public sector practice that has been in existence for at least five years. 2. Performed at least two successful (as determined by client satisfaction)

information technology project assessments, including one similar to this assessment, within the last five years.

3. Five years’ experience with Human Capital Management (HCM), payroll processing, and Enterprise Resource Planning (ERP) systems.


ii. Team member’s experience (each team member must fulfill at least one of these requirements): 1. Two full implementation cycles of SAP payroll 2. Five years SAP payroll experience 3. System assessment

b. Desirable Qualifications Additional points will be provided for team members who meet the desirable qualifications noted below: 1. SAP payroll implementation experience in a public sector environment 2. Experience with resolving troubled SAP payroll implementations

4. PROJECT DELIVERABLES Deliverable(s) are expected that will provide conclusions related to the following areas: a. Determine which system requirements are met and which ones remain unmet by

the MyCalPAYS system. A deliverable will be expected that describes in detail the methodology, any assumptions made, and a listing of the system requirements determined to be met and those that are not met by the system.

b. Determine, of the products delivered, what can be used to complete the project. (For example, this may include project artifacts, the solution, etc.) The Contractor shall identify what deliverables are useable given the Contractor’s understanding of the requirements that have been met, what requirements remain unmet, and an analysis of the scalability of the existing design to the statewide population. The Contractor shall identify all areas that must be redesigned in order for the system to serve the 240,000 statewide workforce population.

c. Determine the cost for a vendor to complete (as needed) modification and implementation of the MyCalPAYS system based upon the findings and recommendations arrived at above. The Contractor will identify a single price that a prospective integrator is likely to charge to complete the project pursuant to the terms of the SCO-SAP integration contract including the warranty. The Contractor shall include an explanation reflecting how it arrived at the price estimate along with any assumptions made in developing the price.

In short, the findings and recommendation deliverable(s) must answer the following questions: 1. Which requirements are met by the MyCalPAYS solution, as currently

implemented? 2. What requirements have not been met with the MyCalPAYS solution? 3. What portion of the current MyCalPAYS design and system may be usable?


4. What is the estimated cost for a vendor to complete (as appropriate) modifications and implementation of the system ensuring that it is compliant with the stated system requirements?

In addition to developing the payable deliverable(s) that answers the questions noted above, the Contractor shall also: 1. Develop a Table of Contents for the final deliverable, to be approved by the

State, within three months of contract signing. 2. Provide draft findings and recommendations, for input by the State, at least 30

State business days before the final findings and recommendation deliverable is due.

3. Update the project work plan activities and schedule within 30 calendar days of contract start date, and every two weeks thereafter to reflect the most current agreement of work to be done and timeframe in which to complete it.

4. Develop and present monthly written status reports with the detail noted below in Section 6 – Contractor Reporting.

5. Develop and present written presentations that identify draft findings and recommendations to the Department of Technology and State Controller’s Office.

6. Develop and present written presentations with final findings and recommendations. (Expect five briefings to take place, including at least two to the Legislature.)

7. Ensure all contractor team members working on this engagement complete the State’s Confidentiality Agreement, Conflict of Interest forms, the Information Security Policy and Computer Use Statement, and the Security Awareness training. The Confidentiality Agreement must be completed prior to commencement of work on this contract.

5. ACCEPTANCE OF DELIVERABLES

It shall be in the State’s sole determination as to whether a deliverable has been successfully completed and acceptable to the State.

a. Payment for tasks performed under this Contract shall be by Firm Fixed by

deliverable. It shall be the Department of Technology’s sole determination as to whether the tasks and deliverables identified in this Contract or in a supplemental Work Authorization (WA), Exhibit A-2 have been successfully completed and are acceptable. The approval process is outlined in Section 11 – Performance.

b. The Contractor costs related to rework of unacceptable work products shall be costs of the Contractor, and shall not be billed to the Department of Technology.

c. The Contractor shall meet all deliverable completion dates, as agreed to in the Contract or in a WA.


6. CONTRACTOR REPORTING

The Contractor will submit (and then meet to discuss) monthly written status reports in MS Word format to the Department of Technology Contract Administrator as directed. The reports shall be detailed regarding current status and future activities. Status reports are not considered payable deliverables under the terms of this Contract. These reports shall include, but not be limited to:

a. A summary of the work completed during the reporting period, showing actual

versus planned.

b. Identification of tasks that are behind schedule, identification of remediation activities, and an estimation of impact on the project schedule.

c. The status of the overall engagement and all phases/projects, including discussion of risks, problems encountered, and proposed solutions.

d. The tasks expected to be completed in the next reporting period.

e. Ad hoc reporting as required. 7. CONTRACTOR RESPONSIBILITIES

a. The Contractor will provide its own equipment and software necessary to

perform the required duties, except for the SAP software in question, which the State will provide.

b. The Contractor shall work independently with limited support from the SCO’s project team.

c. The Contractor only needs limited technical support from SCO to provide access to the MyCalPAYS environment.

d. The Contractor shall designate a primary contact person to whom all project

communications may be addressed and who has the authority to make decision on all aspects of the services.

e. The Contractor will notify the Department of Technology, in writing, within five (5) calendar days of any changes in the personnel assigned to the tasks by completing Exhibit A-3 – Personnel Change Order Request/Authorization form. If a Contractor employee is unable to perform due to illness, resignation, or other factors beyond the Contractor’s control, the Contractor will make every reasonable effort to provide suitable substitute personnel. The substitute personnel shall have equal or better qualifications and meet all MSA requirements and must be approved in advance of any performance under the Contract by the Department of Technology Contract Administrator via an approved Personnel Change Order Request/ Authorization form, Exhibit A-3


and submission of Experience Worksheet, Attachment 2 that describes the candidate’s experience vis-à-vis the requirements in this RFO. If an employee remains in the Contractor’s employ, the Contractor may not remove the employee or reduce the hours the employee is providing on this contract.

f. The Contractor personnel shall perform their duties on any of the premises of the Department of Technology or State Controller’s Office’s facilities located within the greater Sacramento area during regular State working hours, and at all other times as required to successfully provide the services described in this SOW. The MyCalPAYS system is currently hosted at the State’s Data Center (OTech) in Rancho Cordova. State work hours are typically between 8:00 a.m. and 5:00 p.m.

8. DEPARTMENT OF TECHNOLOGY RESPONSIBILITIES a. Designate a Contract Administrator to whom all Contractor communication may

be addressed, and who has the authority to act on all aspects of the services. This person will review the SOW and associated documents with the Contractor to ensure understanding of the responsibilities of both parties.

b. Provide Contractor personnel with standard cubicle and/or office working facilities at any of the Department of Technology sites and/or other locations specified by the Department of Technology (i.e., State Controller’s Office), as necessary, with limited network connectivity to access team working documents.

c. Ensure access is provided to State Controller’s Office staff and management, offices and operation areas, as required, to complete the tasks and activities defined under this Contract.

d. Facilitate gaining access to project staff who have left the State Controller’s

Office but work for the State in another department.

e. Perform review and approval or rejection of draft and final deliverables within twenty (20) State business days.

9. UNANTICIPATED TASKS

a. In the event that additional work must be performed which was wholly

unanticipated and is not specified in the SOW, but which in the opinion of both parties is necessary to the successful accomplishment of the general scope of work outlined, the procedures outlined in this Section will be employed.

b. For each item of unanticipated work not specified in the SOW, a WA will be prepared in accordance with the form provided as Exhibit A-2, WA form.

c. It is understood and agreed by both parties to this Contract that all of the terms of this Contract shall remain in force with the inclusion of any such WA. Such


WA shall in no way constitute a Contract other than as provided pursuant to this Contract nor in any way amend or supersede any of the other provisions of this Contract.

10. WORK AUTHORIZATIONS (WA)

a. Each WA shall consist of a detailed statement of the purpose, objective, or

goals to be undertaken by the Contractor and all information requested to be provided per Exhibit A-2, WA form.

b. All WA must be in writing prior to beginning work and signed by the Contractor and the Department of Technology.

c. The Department of Technology has the right to require the Contractor to stop or suspend work on any WA.

d. Personnel resources will not be expended (at a cost to the Department of Technology) on task accomplishment in excess of estimated work hours required unless the procedure below is followed:

1) If, in performance of the work, the Contractor determines that a WA to be

performed under this Contract cannot be accomplished within the estimated work hours, the Contractor will immediately notify the Department of Technology in writing of the Contractor’s estimate of the work hours which will be required to complete the WA in full. Upon receipt of such notification, the Department of Technology may:

a) Authorize the Contractor to expend the estimated additional work

hours or service in excess of the original estimate necessary to accomplish the WA;

b) Terminate the WA; or

c) Alter the scope of the WA in order to define tasks that can be

accomplished within the remaining estimated work hours.

2) The Department of Technology will notify the Contractor in writing of its decision with seven (7) State business days after receipt of the notification. If notice of the decision is given to proceed, the Contractor may expend the estimated additional work hours or services. The Department of Technology agrees to reimburse the Contractor for such additional work hours.


11. PERFORMANCE The Department of Technology will be the sole judge of the acceptability of all work performed and all work products produced by the Contractor as a result of this SOW. Should the work performed or the products produced by the Contractor fail to meet the Department of Technology conditions, requirements, specifications, guidelines, or other applicable standards, the following resolution process will be employed, except as superseded by other binding processes:

1. The Department of Technology will notify the Contractor in writing within twenty

(20) State business days after submission of any final deliverable of any acceptance problems by identifying the specific inadequacies and/or failures in the services performed and/or the products produced by the Contractor.

2. The Contractor will, within five (5) State business days after initial problem notification, respond to the Department of Technology by submitting a detailed explanation describing precisely how the deliverable adheres to and satisfies all applicable requirements, and/or a proposed corrective action plan to address the specific inadequacies and/or failures in the deliverable. Failure by the Contractor to respond to the Department of Technology’s initial problem notification within the required time limits may result in immediate termination of the Contract. In the event of such termination, the Department of Technology shall pay all amounts due the Contractor for all work approved prior to termination.

3. The Department of Technology will, within five (5) State business days after receipt of the Contractor’s detailed explanation and/or proposed corrective action plan, notify the Contractor in writing whether it accepts or rejects the explanation and/or plan. If the Department of Technology rejects the explanation and/or plan, the Contractor will submit a revised corrective action plan within three (3) State business days of notification of rejection. Failure by the Contractor to respond to the Department of Technology’s notification of rejection by submitting a revised corrective action plan within the required time limits may result in immediate termination of the Contract. In the event of such termination, the Department of Technology shall pay all amounts due the Contractor for all work approved prior to termination.

4. The Department of Technology will, within three (3) State business days of receipt of the revised corrective action plan, notify the Contractor in writing whether it accepts or rejects the revised corrective action plan proposed by the Contractor. Rejection of the revised corrective action plan will result in immediate termination of the Contract. In the event of such termination, the Department of Technology shall pay all amounts due the Contractor for all work approved prior to termination.


12. PROBLEM ESCALATION The parties acknowledge and agree that certain technical and project-related problems or issues may arise, and that such matters shall be brought to the Department of Technology’s attention. Problems or issues shall normally be reported in regular status reports. There may be instances, however, where the severity of the problem justifies escalated reporting. To this extent, the Contractor will determine the level of severity and notify the Contract Administrator.

13. CANCELLATION The Department of Technology may exercise its option to terminate the Contract at any time with 30 calendar days’ prior written notice. In the event of such termination, the Department of Technology shall pay all amounts due the Contractor for all deliverables approved prior to termination.

14. OTHER CONTRACT CONSIDERATIONS

a. The Contractor will act as prime contractor under this Contract. In addition to identifying all personnel proposed to work under this Contract, the Contractor shall also identify its sub-contractor affiliation, as applicable.

b. Should sub-contractors need to be changed for this engagement after contract execution, the Department of Technology reserves the right to approve all sub-contractors prior to the performance of any work by the sub-contractor on a Bidder Declaration (GSPD-05-105).

c. Nothing contained in this Contract shall create any contractual relationship between the State and any sub-contractors, and no sub-contract shall relieve the Contractor of its responsibilities and obligations hereunder. The Contractor is fully responsible to the Department of Technology for the acts and omissions of its sub-contractors and of persons either directly or indirectly employed by any of them.

d. If a sub-contractor is a California Certified Small Business (SB) and/or Disabled Veteran Business Enterprise (DVBE), then those amounts paid to certified sub-contractors shall be identified on the Contractor’s invoice(s).

e. The Contractor's obligation to pay its sub-contractors is an independent obligation from the State’s obligation to make payments to the Contractor. As a result, the State shall have no obligation to pay or to enforce the payment of any moneys to any sub-contractor.


15. CONTRACT REPRESENTATIVES

All notices required by, or relating to, this Contract shall be in writing and shall be sent to the parties of the Contract at the address below unless changed from time to time, in which event each party shall so notify the other in writing, and all such notices shall be deemed duly given if deposited, postage prepaid, in the United States mail or e-mailed and directed to the addresses then prevailing. The Contract Administrators during the term of this contract will be:

State: California Department of Technology Contractor: TBD Name: Mary Winkley Name: Phone: 916-403-9614 Phone: e-mail: [email protected] e-mail:

Direct all contract inquiries to:

State: California Department of Technology Contractor: TBD Unit: Procurement & Contracting Services Name: Name: Sandy Louie Address: Address: P.O. Box 1810 MS Y-18

Rancho Cordova, CA 95741 Phone: 916-431-3600 Phone: Fax: 916-463-9909 Fax: e-mail: [email protected] e-mail:




EXHIBIT A-1 STAFF RESOURCE RESUMES

Placeholder for Staff Resource Resumes (to be added upon contract execution)


EXHIBIT A-2 WORK AUTHORIZATION FORM

WORK AUTHORIZATION NUMBER PAGE(S)

of TITLE

TASK SUMMARY (Brief description of tasks to be performed under work authorization)

START DATE COMPLETION DATE

TOTAL ESTIMATED LABOR HOURS TOTAL ESTIMATED COST

This task will be performed in accordance with the Work Authorization and the provisions of Contract Number APPROVALS CONTRACTOR PROJECT MANAGER NAME TITLE

SIGNATURE DATE

DEPARTMENT OF TECHNOLOGY CONTRACT ADMINISTRATOR NAME TITLE

SIGNATURE DATE


EXHIBIT A-3 PERSONNEL CHANGE ORDER REQUEST/AUTHORIZATION

CHANGE ORDER NO.___

Contractor Name= ________________Contract Number = __TA-_________

Proposed Start Date = _________ or upon approval by the Contract Administrator, whichever occurs later Description of Change:

Current: Proposed: Name of Proposed Contractor Personnel (including phone number and email address):

SOW Personnel Classification:

Hourly Rate:

MSA Personnel Classification:

Attachment 3 included? Resume Attached?

Reason for Change: Approval: Changes identified above are in accordance with the terms and condition of the contract. By signing below, the Contractor Official has confirmed that the proposed staff meets the MSA personnel classification requirements and any requirements listed in the Statement of Work (Exhibit A). The Contract Administrator’s signature below indicates that he/she has confirmed that the proposed staff meets the requirements listed in the Statement of Work (Exhibit A).

Contractor Official (Print name & Sign) / Date Contract Administrator (Print name & Sign) / Date


EXHIBIT B BUDGET DETAIL AND PAYMENT PROVISIONS

1. Payment for services performed under this Contract shall be Firm Fixed by Deliverable. It

shall be the Department of Technology’s sole determination as to whether a task has been successfully completed and is acceptable. Signed acceptance is required from the Department of Technology Contract Administrator before processing an invoice for payment.

2. Upon successful completion/acceptance of each deliverable, the Contractor will submit an invoice for payment associated with the individual payment amounts. Payment shall be based on the cost worksheet and approval by the Department of Technology.

3. Invoices shall be submitted in triplicate, and shall identify the deliverable and cost. (Should a Work Authorization be executed, the invoice shall be submitted in triplicate and include labor and costs charged for each task. Invoices shall be submitted monthly, in arrears, identifying Contractor personnel by name and classification, hourly rate of pay, and hours expended by deliverable.) Invoices shall be due and payable, and payment shall be made, only after the Department of Technology acceptance of hours worked and/or completion of each task under this Contract.

4. The Contractor costs related to items such as travel and per diem are costs of the Contractor, shall be inclusive of the hourly rate submitted, and will not be paid separately as part of this Contract.

5. Submit your invoice using ONE, of the following options referencing the Contract Number or Agency Order Number:

a. Send via U.S. Mail in TRIPLICATE to:

California Department of Technology Financial Management Branch – Accounting Office P.O. Box 1810 Rancho Cordova, CA 95741

OR b. Send electronically to: [email protected]

6. It is mutually agreed that if the Budget Act of the current year and/or any subsequent years

covered under this Contract does not appropriate sufficient funds for the program, this Contract shall be of no further force and effect. In this event, the State shall have no liability to pay any funds whatsoever to the Contractor or to furnish any other considerations under this Contract and Contractor shall not be obligated to perform any provisions of this Contract.

7. If funding for any fiscal year is reduced or deleted by the Budget Act for purposes of this program, the State shall have the option to either cancel this Contract with no liability occurring to the State, or offer a contract amendment to the Contractor to reflect the reduced amount.

8. Payment will be made in accordance with, and within the time specified in, Government

Code Chapter 4.5, commencing with Section 927. Payment to small/micro businesses shall be made in accordance with and within the time specified in Chapter 4.5, Government Code 927 et seq.



EXHIBIT B-1 COST WORKSHEET

The Contractor shall provide all labor, materials, and equipment necessary to provide the consulting services for Assessment of 21st Century Project in accordance with the specifications described in the SOW, Exhibit A, at the rates specified below. Payment for services performed under this contract shall be Firm Fixed by Deliverable. Submission of this information is required.

DELIVERABLE 1 "[ Click here TITLE OF DELIVERABLE 1]"

CONSULTANT NAME / MSA CLASSIFICATION

RATE / HOUR COST

NORMAL DISCOUNTED

Total Cost Deliverable 1 DELIVERABLE 2

"[ Click here TITLE OF DELIVERABLE 2]" CONSULTANT NAME / MSA CLASSIFICATION

RATE / HOUR COST

NORMAL DISCOUNTED



RATE / HOUR COST

NORMAL DISCOUNTED



RATE / HOUR COST

NORMAL DISCOUNTED

Total Cost Deliverable 4


A. Total Deliverables 1 - 4 (Sum of all deliverables)

B. 10% of Cost for Deliverables 1 – 4 (Line A multiplied by 10%)

C. Total Contract Value (Sum of Line A + Line B)

The vendor shall set aside 10% of the total contract value to be used for Unanticipated Tasks and document the total amount available for Unanticipated Tasks. When an unanticipated task is approved to be performed via an approved WA, Exhibit A-2, it shall be invoiced against the team members’ names shown below and at the indicated Rate per Hour. The Department of Technology will maintain a listing of Unanticipated Task charges and review to ensure they do not exceed the contract allowed amounts.

Team Member Name MSA Classification Rate / Hour Normal Discounted


EXHIBIT D SPECIAL TERMS AND CONDITIONS TO SAFEGUARD FEDERAL TAX INFORMATION

Federal statute, regulations and guidelines require that all contracts for services relating to the processing, storage, transmission, or reproduction of federal tax returns or return information, the programming, maintenance, repair, or testing of equipment or other property, or the providing of other services, for tax administration purposes include the provisions contained in this exhibit. (See 26 U.S.C. §6103(n); 26 C.F.R. §301.6103(n)-1(a)(2) and (d); Internal Revenue Service (IRS) Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (Rev. 8-2010), Section 5.5 and Exhibit 7.) The contractor agrees to comply with 26 U.S.C. §6103(n); 26 C.F.R. §301.6103(n)-1; IRS Publication 1075 (Rev. 8-2010); and all applicable conditions and restrictions as may be prescribed by the IRS by regulation, published rules or procedures, or written communication to the contractor. (See 26 C.F.R. §301.6103(n)-1(d); IRS Publication 1075 (Rev. 8-2010).) I. PERFORMANCE In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by his or her employees with the following requirements: (1) All work will be done under the supervision of the Contractor or the Contractor's

employees. (2) Any return or return information made available in any format shall be used only for

the purpose of carrying out the provisions of this contract. Information contained in such material will be treated as confidential and will not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Disclosure to anyone other than an officer or employee of the contractor will be prohibited.

(3) All returns and return information will be accounted for upon receipt and properly

stored before, during, and after processing. In addition, all related output will be given the same level of protection as required for the source material.

(4) The Contractor certifies that the data processed during the performance of this

contract will be completely purged from all data storage components of his or her computer facility, and no output will be retained by the contractor at the time the work is completed. If immediate purging of all data storage components is not possible, the Contractor certifies that any IRS data remaining in any storage component will be safeguarded to prevent unauthorized disclosures.


(5) Any spoilage or any intermediate hard copy printout that may result during the processing of IRS data will be given to the agency or his or her designee. When this is not possible, the Contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts, and will provide the agency or his or her designee with a statement containing the date of destruction, description of material destroyed, and the method used.

(6) All computer systems receiving, processing, storing, or transmitting Federal tax

information must meet the requirements defined in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to Federal tax information.

(7) No work involving Federal tax information furnished under this contract will be

subcontracted without prior written approval of the IRS. (8) The Contractor will maintain a list of employees with authorized access. Such list will

be provided to the department and, upon request, to the IRS reviewing office. (9) The department will have the right to void the Contract if the contractor fails to

provide the safeguards described above. II. CRIMINAL/CIVIL SANCTIONS (1) Each officer or employee of any person to whom returns or return information is or

may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1.

(2) Each officer or employee of any person to whom returns or return information is or

may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.


Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431.

(3) Additionally, it is incumbent upon the contractor to inform its officers and employees

of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(4) Granting a contractor access to FTI must be preceded by certifying that each

individual understands the agency’s security policy and procedures for safeguarding IRS information. Contractors must maintain their authorization to access FTI through annual recertification. The initial certification and recertification must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, contractors should be advised of the provisions of IRC Sections 7431, 7213, and 7213A (see Exhibit 6, IRC Sec. 7431 Civil Damages for Unauthorized Disclosure of Returns and Return Information and Exhibit 5, IRC Sec. 7213 Unauthorized Disclosure of Information). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For both the initial certification and the annual certification, the contractor should sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.1

III. INSPECTION The IRS and the Agency shall have the right to send its officers and employees into the offices and plants of the contractor for inspection of the facilities and operations provided for the performance of any work under this contract. On the basis of such inspection, specific measures may be required in cases where the contractor is found to be noncompliant with contract safeguards.

1 A 30 minute disclosure awareness training video produced by the IRS can be found at: http://www.irsvideos.gov/Governments/Safeguards/DisclosureAwarenessTrainingPub4711


REFERENCES 26 U.S.C. §6103(n) Pursuant to regulations prescribed by the Secretary, returns and return information may be disclosed to any person, including any person described in section 7513 (a), to the extent necessary in connection with the processing, storage, transmission, and reproduction of such returns and return information, the programming, maintenance, repair, testing, and procurement of equipment, and the providing of other services, for purposes of tax administration. 26 C.F.R. §301.6103(n)-1 Disclosure of returns and return information in connection with procurement of property and services for tax administration purposes. (a) General rule. Pursuant to the provisions of section 6103(n) of the Internal Revenue

Code and subject to the requirements of paragraphs (b), (c), and (d) of this section, officers or employees of the Treasury Department, a State tax agency, the Social Security Administration, or the Department of Justice, are authorized to disclose returns and return information (as defined in section 6103(b)) to any person (including, in the case of the Treasury Department, any person described in section 7513(a)), or to an officer or employee of such person, to the extent necessary in connection with contractual procurement of—

(1) Equipment or other property, or (2) Services relating to the processing, storage, transmission, or reproduction of such

returns or return information, the programming, maintenance, repair, or testing of equipment or other property, or the providing of other services, for purposes of tax administration (as defined in section 6103(b)(4)). No person, or officer or employee of such person, to whom a return or return information is disclosed by an officer or employee of the Treasury Department, the State tax agency, the Social Security Administration, or the Department of Justice, under the authority of this paragraph shall in turn disclose such return or return information for any purpose other than as described in this paragraph, and no such further disclosure for any such described purpose shall be made by such person, officer, or employee to anyone, other than another officer or employee of such person whose duties or responsibilities require such disclosure for a purpose described in this paragraph, without written approval by the Internal Revenue Service.

(b) Limitations. For purposes of paragraph (a) of this section, disclosure of returns or return information in connection with contractual procurement of property or services described in such paragraph will be treated as necessary only if such procurement or the performance of such services cannot otherwise be reasonably, properly, or economically carried out or performed without such disclosure.

http://www.law.cornell.edu/uscode/html/uscode26/usc_sec_26_00007513----000-.html

http://www.law.cornell.edu/uscode/html/uscode26/usc_sec_26_00007513----000-.html%23a


Thus, for example, disclosures of returns or return information to employees of a contractor for purposes of programming, maintaining, repairing, or testing computer equipment used by the Internal Revenue Service or a State tax agency should be made only if such services cannot be reasonably, properly, or economically performed by use of information or other data in a form which does not identify a particular taxpayer. If, however, disclosure of returns or return information is in fact necessary in order for such employees to reasonably, properly, or economically perform the computer related services, such disclosures should be restricted to returns or return information selected or appearing at random. Further, for purposes of paragraph (a), disclosure of returns or return information in connection with the contractual procurement of property or services described in such paragraph should be made only to the extent necessary to reasonably, properly, or economically conduct such procurement activity. Thus, for example, if an activity described in paragraph (a) can be reasonably, properly, and economically conducted by disclosure of only parts or portions of a return or if deletion of taxpayer identity information (as defined in section 6103(b)(6) of the Code) reflected on a return would not seriously impair the ability of the contractor or his officers or employees to conduct the activity, then only such parts or portions of the return, or only the return with taxpayer identity information deleted, should be disclosed.

(c) Notification requirements. Persons to whom returns or return information is or may

be disclosed as authorized by paragraph (a) of this section shall provide written notice to their officers or employees—

(1) That returns or return information disclosed to such officer or employee can be

used only for a purpose and to the extent authorized by paragraph (a) of this section;

(2) That further inspection of any returns or return information for a purpose or to an extent unauthorized by paragraph (a) of this section constitutes a misdemeanor, punishable upon conviction by a fine of as much as $1,000, or imprisonment for as long as 1 year, or both, together with costs of prosecution;

(3) That further disclosure of any returns or return information for a purpose or to an extent unauthorized by paragraph (a) of this section constitutes a felony, punishable upon conviction by a fine of as much as $5,000, or imprisonment for as long as 5 years, or both, together with the costs of prosecution;

(4) That any such unauthorized further inspection or disclosure of returns or return information may also result in an award of civil damages against any person who is not an officer or employee of the United States in an amount not less than $1,000 for each act of unauthorized inspection or disclosure or the sum of actual damages sustained by the plaintiff as a result of such unauthorized disclosure or inspection as well as an award of costs and reasonable attorney’s fees; and

(5) If such person is an officer or employee of the United States, a conviction for an offense referenced in paragraph (c)(2) or (c)(3) of this section shall result in dismissal from office or discharge from employment.


(d) Safeguards. Any person to whom a return or return information is disclosed as authorized by paragraph (a) of this section shall comply with all applicable conditions and requirements which may be prescribed by the Internal Revenue Service for the purposes of protecting the confidentiality of returns and return information and preventing disclosures of returns or return information in a manner unauthorized by paragraph (a). The terms of any contract between the Treasury Department, a State tax agency, the Social Security Administration, or the Department of Justice, and a person pursuant to which a return or return information is or may be disclosed for a purpose described in paragraph (a) shall provide, or shall be amended to provide, that such person, and officers and employees of the person, shall comply with all such applicable conditions and restrictions as may be prescribed by the Service by regulation, published rules or procedures, or written communication to such person. If the Service determines that any person, or an officer or employee of any such person, to whom returns or return information has been disclosed as provided in paragraph (a) has failed to, or does not, satisfy such prescribed conditions or requirements, the Service may take such actions as are deemed necessary to ensure that such conditions or requirements are or will be satisfied, including— (1) Suspension or termination of any duty or obligation arising under a contract with

the Treasury Department referred to in this paragraph or suspension of disclosures by the Treasury Department otherwise authorized by paragraph (a) of this section, or

(2) Suspension of further disclosures of returns or return information by the Service to the State tax agency, or to the Department of Justice, until the Service determines that such conditions and requirements have been or will be satisfied.

(e) Definitions. For purposes of this section— (1) The term Treasury Department includes the Internal Revenue Service and the

Office of the Chief Counsel for the Internal Revenue Service; (2) The term State tax agency means an agency, body, or commission described in

section 6103(d) of the Code; and (3) The term Department of Justice includes offices of the United States Attorneys.


IRS Publication 1075 (Rev. 8-2010) Section 5.5 Control over Processing Processing of FTI, in an electronic media format, including removable media, microfilms, photo impressions, or other formats (including tape reformatting or reproduction or conversion to punch cards, digital images or hard copy printout) will be performed pursuant to one of the following procedures: 5.5.1 Agency Owned and Operated Facility Processing under this method will take place in a manner that will protect the confidentiality of the information on the electronic media. All safeguards outlined in this publication also must be followed and will be subject to IRS safeguard reviews. 5.5.2 Contractor or Agency Shared Facility – Consolidated Data Centers Recipients of FTI are allowed to use a shared facility but only in a manner that does not allow access to FTI by employees, agents, representatives or contractors of other agencies using the shared facility. Note: For purposes of applying sections 6103(l), (m) and (n), the term “agent” includes

contractors. Access restrictions pursuant to the IRC authority by which the FTI is received continue to apply. For example, since human services agencies administering benefit eligibility programs may not allow contractor access to any FTI received, their data within the consolidated data center may not be accessed by any contractor of the data center.

The requirements in Exhibit 7, Contract Language for General Services, must be included in the contract in accordance with IRC Section 6103(n). The contractor or agency-shared computer facility is also subject to IRS safeguard reviews.

Note: The above rules also apply to releasing electronic media to a private contractor or

other agency office even if the purpose is merely to erase the old media for reuse.

Agencies utilizing consolidated data centers must implement appropriate

controls to ensure the protection of FTI, including a service level agreement (SLA) between the agency authorized to receive FTI and the consolidated data center. The SLA should cover the following:

1. The consolidated data center is considered to be a “contractor” of the agency

receiving FTI. The agency receiving FTI – whether it is a state revenue, workforce, child support enforcement or human services agency – is responsible for ensuring the protection of all FTI received. However, as the “contractor” for the agency receiving FTI, the consolidated data center shares responsibility for safeguarding FTI as well.


2. Provide written notification to the consolidated data center management that they are bound by the provisions of Publication 1075, relative to protecting all federal tax information within their possession or control. The SLA should also include details concerning the consolidated data center’s responsibilities during a safeguard review and support required to resolve identified findings.

3. The agency will conduct an internal inspection of the consolidated data center

every eighteen months (see section 6.3). Multiple agencies sharing a consolidated data center may partner together to conduct a single, comprehensive internal inspection. However, care should be taken to ensure agency representatives do not gain unauthorized access to other agency’s FTI during the internal inspection.

4. The employees from the consolidated data center with access to FTI,

including system administrators and programmers, must receive disclosure awareness training prior to access to FTI and annually thereafter and sign a confidentiality statement. This provision also extends to any contractors hired by the consolidated data center that has access to FTI.

5. The specific data breach incident reporting procedures for all consolidated

data center employees and contractors. The required disclosure awareness training must include a review of these procedures.

6. The Exhibit 7 language must be included in the contract between the recipient

agency and the consolidated data center, including all contracts involving contractors hired by the consolidated data center.

7. Identify responsibilities for coordination of the 45-day notification of the use of

contractors or sub-contractors with access to FTI. Note: Generally, consolidated data centers are either operated by a separate state

agency (example: Department of Information Services) or by a private contractor. If an agency is considering transitioning to either a state owned or private vendor consolidated data center, the Office of Safeguards strongly suggests the agency submit a request for discussions with Safeguards as early as possible in the decision-making or implementation planning process. The purpose of these discussions is to ensure the agency remains in compliance with safeguarding requirements during the transition to the consolidated data center.

26 U.S.C. §7213. Unauthorized disclosure of information (a) Returns and return information

(1) Federal employees and other persons It shall be unlawful for any officer or employee of the United States or any person described in section 6103(n) (or an officer or employee of any such person), or any former officer or employee, willfully to disclose to any person, except as authorized in this title, any return or return information (as defined in section 6103(b)). Any violation of this paragraph shall be a felony punishable

http://www.fourmilab.ch/ustax/www/t26-F-61-B-6103.html%23_n_

http://www.fourmilab.ch/ustax/www/t26-F-61-B-6103.html%23_b_


upon conviction by a fine in any amount not exceeding $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution, and if such offense is committed by any officer or employee of the United States, he shall, in addition to any other punishment, be dismissed from office or discharged from employment upon conviction for such offense.

(2) State and other employees It shall be unlawful for any person (not described in paragraph (1)) willfully to disclose to any person, except as authorized in this title, any return or return information (as defined in section 6103(b)) acquired by him or another person under subsection (d), (i)(3)(B)(i) or (7)(A)(ii), (l)(6), (7), (8), (9), (10), (12), (15), (16), (19), or (20) or (m)(2), (4), (5), (6), or (7) of section 6103. Any violation of this paragraph shall be a felony punishable by a fine in any amount not exceeding $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution.

(3) Other persons It shall be unlawful for any person to whom any return or return information (as defined in section 6103(b)) is disclosed in a manner unauthorized by this title thereafter willfully to print or publish in any manner not provided by law any such return or return information. Any violation of this paragraph shall be a felony punishable by a fine in any amount not exceeding $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution.

(4) Solicitation It shall be unlawful for any person willfully to offer any item of material value in exchange for any return or return information (as defined in section 6103(b)) and to receive as a result of such solicitation any such return or return information. Any violation of this paragraph shall be a felony punishable by a fine in any amount not exceeding $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution.

(5) Shareholders It shall be unlawful for any person to whom a return or return information (as defined in section 6103(b)) is disclosed pursuant to the provisions of section 6103(e)(1)(D)(iii) willfully to disclose such return or return information in any manner not provided by law. Any violation of this paragraph shall be a felony punishable by a fine in any amount not to exceed $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution.

(b) Disclosure of operations of manufacturer or producer Any officer or employee of the United States who divulges or makes known in any manner whatever not provided by law to any person the operations, style of work, or apparatus of any manufacturer or producer visited by him in the discharge of his official duties shall be guilty of a misdemeanor and, upon conviction thereof, shall be fined not more than $1,000, or imprisoned not more than 1 year, or both, together with the costs of prosecution; and the offender shall be dismissed from office or discharged from employment.

(c) Disclosures by certain delegates of Secretary All provisions of law relating to the disclosure of information, and all provisions of law relating to penalties for unauthorized disclosure of information, which are applicable in respect of any function under this title when performed by an officer or


http://www.fourmilab.ch/ustax/www/t26-F-61-B-6103.html




http://www.fourmilab.ch/ustax/www/t26-F-61-B-6103.html%23_e__1__D__iii_


employee of the Treasury Department are likewise applicable in respect of such function when performed by any person who is a "delegate" within the meaning of section 7701(a)(12)(B).

(d) Disclosure of software Any person who willfully divulges or makes known software (as defined in section 7612(d)(1)) to any person in violation of section 7612 shall be guilty of a felony and, upon conviction thereof, shall be fined not more than $5,000, or imprisoned not more than 5 years, or both, together with the costs of prosecution.

(e) Cross references (1) Penalties for disclosure of information by preparers of returns

For penalty for disclosure or use of information by preparers of returns, see section 7216.

(2) Penalties for disclosure of confidential information For penalties for disclosure of confidential information by any officer or employee of the United States or any department or agency thereof, see 18 U.S.C. 1905.

26 U.S.C. §7213A. Unauthorized inspection of returns or return information (a) Prohibitions (1) Federal employees and other persons It shall be unlawful for— (A) any officer or employee of the United States, or (B) any person described in subsection (l)(18) or (n) of section 6103 or an officer or employee of any such person, willfully to inspect, except as authorized in this title, any return or return information. (2) State and other employees It shall be unlawful for any person (not described in paragraph (1)) willfully to inspect, except as authorized in this title, any return or return information acquired by such person or another person under a provision of section 6103 referred to in section 7213 (a)(2) or under section 6104 (c). (b) Penalty (1) In general Any violation of subsection (a) shall be punishable upon conviction by a fine in any amount not exceeding $1,000, or imprisonment of not more than 1 year, or both, together with the costs of prosecution. (2) Federal officers or employees An officer or employee of the United States who is convicted of any violation of subsection (a) shall, in addition to any other punishment, be dismissed from office or discharged from employment.

http://www.fourmilab.ch/ustax/www/t26-F-79-7701.html%23_a__12__B_

http://www.fourmilab.ch/ustax/www/t26-F-78-A-7612.html%23_d__1_

http://www.fourmilab.ch/ustax/www/t26-F-78-A-7612.html

http://www.fourmilab.ch/ustax/www/t26-F-75-A-I-7216.html




http://www.law.cornell.edu/uscode/html/uscode26/usc_sec_26_00007213----000-.html%23a_2


http://www.law.cornell.edu/uscode/html/uscode26/usc_sec_26_00006104----000-.html%23c


(c) Definitions For purposes of this section, the terms “inspect”, “return”, and “return information” have the respective meanings given such terms by section 6103 (b). 26 U.S.C. §7431. Civil damages for unauthorized inspection or disclosure of returns and return information (a) In general

(1) Inspection or disclosure by employee of United States If any officer or employee of the United States knowingly, or by reason of negligence, inspects or discloses any return or return information with respect to a taxpayer in violation of any provision of section 6103, such taxpayer may bring a civil action for damages against the United States in a district court of the United States.

(2) Inspection or disclosure by a person who is not an employee of United States If any person who is not an officer or employee of the United States knowingly, or by reason of negligence, inspects or discloses any return or return information with respect to a taxpayer in violation of any provision of section 6103, such taxpayer may bring a civil action for damages against such person in a district court of the United States.

(b) Exceptions No liability shall arise under this section with respect to any inspection or disclosure - (1) which results from a good faith, but erroneous, interpretation of section 6103, or (2) which is requested by the taxpayer.

(c) Damages In any action brought under subsection (a), upon a finding of liability on the part of the defendant, the defendant shall be liable to the plaintiff in an amount equal to the sum of - (1) the greater of -

(A) $1,000 for each act of unauthorized inspection or disclosure of a return or return information with respect to which such defendant is found liable, or (B) the sum of -

(i) the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure, plus (ii) in the case of a willful inspection or disclosure or an inspection or disclosure which is the result of gross negligence, punitive damages, plus

(2) the costs of the action, plus (3) in the case of a plaintiff which is described in section 7430(c)(4)(A)(ii), reasonable attorneys fees, except that if the defendant is the United States, reasonable attorneys fees may be awarded only if the plaintiff is the prevailing party (as determined under section 7430(c)(4)).

(d) Period for bringing action Notwithstanding any other provision of law, an action to enforce any liability created under this section may be brought, without regard to the amount in controversy, at


http://www.law.cornell.edu/uscode/html/uscode26/usc_sec_26_00006103----000-.html%23b




http://www.fourmilab.ch/ustax/www/t26-F-76-B-7430.html%23_c__4__A__ii_

http://www.fourmilab.ch/ustax/www/t26-F-76-B-7430.html%23_c__4_


any time within 2 years after the date of discovery by the plaintiff of the unauthorized inspection or disclosure.

(e) Notification of unlawful inspection and disclosure If any person is criminally charged by indictment or information with inspection or disclosure of a taxpayer's return or return information in violation of - (1) paragraph (1) or (2) of section 7213(a), (2) section 7213A(a), or (3) subparagraph (B) of section 1030(a)(2) of title 18, United States Code, the Secretary shall notify such taxpayer as soon as practicable of such inspection or disclosure.

(f) Definitions For purposes of this section, the terms "inspect", "inspection", "return", and "return information" have the respective meanings given such terms by section 6103(b).

(g) Extension to information obtained under section 3406 For purposes of this section - (1) any information obtained under section 3406 (including information with respect to any payee certification failure under subsection (d) thereof) shall be treated as return information, and (2) any inspection or use of such information other than for purposes of meeting any requirement under section 3406 or (subject to the safeguards set forth in section 6103) for purposes permitted under section 6103 shall be treated as a violation of section 6103. For purposes of subsection (b), the reference to section 6103 shall be treated as including a reference to section 3406.

(h) Special rule for information obtained under section 6103(k)(9) For purposes of this section, any reference to section 6103 shall be treated as including a reference to section 6311(e).

http://www.fourmilab.ch/ustax/www/t26-F-75-A-I-7213.html%23_a_

http://www.fourmilab.ch/ustax/www/t26-F-75-A-I-7213A.html%23_a_


http://www.fourmilab.ch/ustax/www/t26-C-24-3406.html








http://www.fourmilab.ch/ustax/www/t26-F-61-B-6103.html%23_k__9_


http://www.fourmilab.ch/ustax/www/t26-F-64-B-6311.html%23_e_


ATTACHMENT 1 BEST VALUE EVALUATION

All offers will be reviewed for responsiveness to the requirements of the RFO. If a response is missing required information, it may be deemed non-responsive. The Selection Team will compare responsive offers based on the “best value” criteria in order of importance as described below. Further review is subject to the Department of Technology’s discretion. 1. Staff Experience Worksheet (Attachment 2) and Consultant resumes;

2. Workplan/approach and methodologies to be used during engagement;

3. Completed Cost Worksheet Requirements (Exhibit B-1);

4. References (Attachment 3):

a. Customers identified in Attachment 3 – References, may be contacted. The

reference will be interviewed in areas such as: compliance with provisions of contract, timeliness of project completion, and success factors. Each reference will be posed a specific set of questions and their responses documented. Negative responses from references may be cause for rejection of the response/offering;

b. If the Respondent has previously contracted with and performed services for the State, the Department of Technology will contact the Department of General Services to review Contractor Evaluation Reports; and

c. References are current, within the past ten (10) years, and are similar in size, service, and scope of service to this RFO.


ATTACHMENT 2 EXPERIENCE WORKSHEET

CANDIDATE NAME "[ Click here Title of Cert]" CERTIFICATION NUMBER AND EXPIRATION DATE

EDUCATIONAL BACKGROUND HIGHEST DEGREE OR (GLOBAL EQUIVALENT) ATTAINED YEAR AWARDED

Bachelor’s Master’s Doctoral FIELD OF STUDY (ADVANCED DEGREE/EQUIVALENT) EDUCATIONAL INSTITUTION NAME

LICENSES AND CERTIFICATIONS YEAR AWARDED

SAP BACKGROUND LIST AND DESCRIBE PROFESSIONAL EXPERIENCE YEARS OF EXPERIENCE

INFORMATION TECHNOLOGY BACKGROUND LIST AND DESCRIBE PROFESSIONAL EXPERIENCE YEARS OF EXPERIENCE


SAP EXPERIENCE PROJECT MANAGEMENT/PORTFOLIO NAME (OR DESCRIPTION)

PERSONAL ROLE/INVOLVEMENT TERM (START MM/DD/YY AND END MM/DD/YY)

to CLIENT COMPANY/ORGANIZATION NAME CONTACT PERSON

ADDRESS CITY STATE ZIP CODE

PHONE FAX EMAIL ADDRESS

SCOPE OF SERVICES CANDIDATE PROVIDED (NOT SCOPE OF THE PROJECT CANDIDATE WORKED ON)


ATTACHMENT 3 STAFF REFERENCES

Complete a separate form for each reference. BIDDER’S NAME CONSULTANT TEAM MEMBER’S NAME FOR WHOM THIS REFERENCE IS BEING PROVIDED CLIENT COMPANY/ORGANIZATION DATES OF SERVICE (MM/YY) to ROLE TEAM MEMBER PLAYED ON ENGAGEMENT (e.g., Technical Lead, Project Manager): STREET ADDRESS CITY STATE ZIP CODE CONTACT PERSON NAME PHONE NUMBER PROJECT NAME/DESCRIPTION DESCRIPTION OF SERVICES TEAM MEMBER (NOT COMPANY) PROVIDED Describe the services provided BY THE PROPOSED TEAM MEMBER ONLY for this client as it relates to the RFO SOW Requirements. The description of services must be detailed and comprehensive enough to permit the Department of Technology to assess the similarity of these services to the work anticipated in the award of the Contract resulting from this RFO.


ATTACHMENT 4 SECURITY AND CONFIDENTIALITY STATEMENT

As an authorized representative and/or corporate officer of the company named below, I agree that all persons employed by this company will adhere to the following policy:

All information belonging to the California Department of Technology, the State Controller’s Office, or its affiliated agencies is considered sensitive and/or confidential and cannot be disclosed to any person or entity that is not directly approved to participate in the work required to execute this Contract. I certify that I will keep all project information, including information concerning the planning, processes, development or procedures of the Project, confidential and secure. I will not copy, give or otherwise disclose such information to any other person unless the Department of Technology has on file a Security and Confidentiality Statement signed by the other persons, and the disclosure is authorized by the Department of Technology and necessary for the Project. I understand that the information to be kept confidential includes, but is not limited to, specifications, administrative requirements, terms and conditions, data, concepts and discussions, as well as written and electronic materials. I further understand that if I leave this project before it ends, I must still keep all project information confidential. I agree to follow any instructions provided by the Project relating to the confidentiality of project information. I fully understand that any unauthorized disclosure I make may be basis for civil or criminal penalties and/or disciplinary action (for state employees). I agree to advise the Contract Administrator immediately in the event of an unauthorized disclosure, inappropriate access, misuse, theft or loss of data. All materials provided for this Project, except where explicitly stated will be promptly returned or destroyed, as instructed by an authorized Department of Technology representative. If the materials are destroyed and not returned, a letter attesting to their complete destruction which documents the destruction procedures must be sent to the Contract Administrator at the Department of Technology before payment can be made for services rendered. In addition, all copies or derivations, including any working or archival backups of the information, will be physically and/or electronically destroyed within five (5) calendar days immediately following either the end of the contract period or the final payment, as determined by the Department of Technology. All personnel assigned to this project shall be provided a Security and Confidentiality Statement and will be expected to sign and return it to the representative listed below before beginning work on this project.

REPRESENTATIVE NAME TITLE PHONE NUMBER COMPANY NAME STREET ADDRESS CITY STATE ZIP CODE SIGNATURE DATE

40


ATTACHMENT 5 21ST CENTURY PROJECT ORGANIZATION CHART – AS OF JANUARY 2013

41



42



43

rfo 14-144083 - 21st century project assessment

Documents

state of california

department contact

century project assessment

offer rfo

state workforce

state controllers offices

department of finance

state controllers office