OFFICE OF THE CHIEF PROCUREMENT OFFICER … OFFICE OF THE CHIEF PROCUREMENT OFFICER TONI PRECKWINKLE PRESIDENT ... as it relates to overall management and support of the Palantir Gotham

TONI PRECKWINKLE

PRESIDENT

Cook County Board

of Commissioners

RICHARD R. BOYKIN

1st District

ROBERT STEELE

2nd District

JERRY BUTLER

3rd District

STANLEY MOORE

4th District

DEBORAH SIMS

5th District

JOAN PATRICIA MURPHY

6th District

JESUS G. GARCIA

7th District

LUIS ARROYO JR.

8th District

PETER N. SILVESTRI

9th District

BRIDGET GAINER

10th District

JOHN P. DALEY

11th District

JOHN A. FRITCHEY

12th District

LARRY SUFFREDIN

13th District

GREGG GOSLIN

14th District

TIMOTHY O. SCHNEIDER

15th District

JEFFREY R. TOBOLSKI

16th District

SEAN M. MORRISON

17th District

OFFICE OF THE CHIEF PROCUREMENT OFFICER

SHANNON E. ANDREWS

CHIEF PROCUREMENT OFFICER

118 North Clark Street, Room 1018 Chicago, Illinois 60602 (312) 603-5370

ADDENDUM NO. 1

October 6, 2015

Palantir Gotham Support for

Cook County Sheriff’s Office

RFP No. 1550-14816

To: Interested Vendors of Record A. General: This addendum revises the above-referenced solicitation. This addendum is issued prior to execution of the contract, forms a part of contract documents and modifies previously issued documents. Insofar as previously issued contract documents are inconsistent with modifications indicated by this addendum, modifications indicated by this addendum shall govern. Where any part of the contract documents are modified by this addendum, all unaltered provisions shall remain in effect. B. Acknowledgement: Acknowledge receipt of this Addendum by returning a signed copy of the Addenda Acknowledgement Form included with the solicitation. Since all addenda become a part of the Proposal, all addenda must be signed by an authorized Proposer representative and returned with the Proposal on or before the Proposal due date. Failure to sign and return any and all addenda acknowledgements may be grounds for rejection of the Proposal. C. Attachments: The addendum includes attachments described in this addendum. One copy of each attachment is issued

with this addendum, unless otherwise indicated. Insert the attachment(s) in the solicitation document in the

correct sequence and location. Revise your response to this solicitation to reflect the modifications per this

addendum, as applicable.

Attachment 1: Revised Contract Page 15A


Attachment 3 Revised Contract Page 28A

Attachment 4: Pre-Proposal Conference Attendees List

Attachment 5: Response to Proposers’ Questions


RFP No. 1550-14816 - Addendum No. 1 Page 3

Rev 1/1/15


Request for Proposal (RFP) No. 1550-14816

15A

8. Security and Compliance Responses required to all subsections. Please limit your response to a total of 10 pages for all security

and compliance sections combined.

8.1. Data Security Controls The proposal must give an overview of the System’s software, hardware, and other controls supporting

the System’s data securityoverall environment.

The proposer must also provide a reasonably detailed explanation as to how the proposal protects the

System and County Data within each of the following additional data security categories (NOTE: the

County recognizes that reasonable descriptions of each security attribute below will vary in length, some

attributes requiring little explanation, others not.) (If proposer determines any of the following

requirements to be inapplicable, proposer shall state so and shall also state the basis for determining

each such requirement to be inapplicable):

a. Password configurations (e.g., complexity, aging, etc.);

b. Authentication configuration (e.g., active directory, encrypted data exchange, hash,

etc.);

c. Encryption configurations (e.g., symmetrical AES-256, asymmetrical RSA 2048, etc.) for

both data at rest and data in motion;

d. Logging/Auditing capabilities (e.g., verbose user tracking and reporting, etc.);

e. Logs must be exportable to third party log aggregators;

f. Physical security (e.g., 24-hour security, alarms, restricted access, etc.);

g.a. Personnel security (e.g., extensive background checks, annual recheck, etc.);

h. Web Application configurations (e.g., SQL injection protection, buffer overflow, etc.);

i.b. Network transmission security (LAN and VPN);

j.c. Data that is to be transmitted off-site must be encrypted end to end.

Lastly, the proposer shall confirm that, under its proposal, all data-at-rest will not be stored outside of

the continental United States.

8.2. Secure Development and Configuration Practices The Proposer must describe its application development and configuration practices and how they will

reasonably protect the security, confidentiality and privacy of County data and any individuals who may

be considered data subjects as to the solution.

The Proposer should state whether it will adhere to the following guidelines: Microsoft Secure Coding

Guidelines for the .NET Framework, CERT Secure Coding Standards, OWASP Secure Coding Principles,

privacy by design principles, and the Federal Trade Commission’s Fair Information Practice Principles.

8.3. Compliance Requirements The proposer must provide sufficient detail on whether and how the proposal possesses data security

controls that comply with (If proposer determines any of the following requirements to be inapplicable,



Rev 1/1/15



23A

11.3.3. Best and Final Offer The County reserves the right to request a Best and Final Offer from finalist Proposer(s), if

it deems such an approach necessary. In general, the Best and Final Offer will consist of

updated costs as well as answers to specific questions that were identified during the

evaluation of Proposals.

If the County chooses to invoke this option, Proposals will be re-evaluated by incorporating the

information requested in the Best and Final Offer document, including costs, and answers to

specific questions presented in the document. The specific format for the Best and Final Offer

would be determined during evaluation discussions. Turnaround time for responding to a Best

and Final Offers document is usually brief (i.e., five (5) business days).

11.4. Selection Process Upon review of all information provided by shortlisted proposers, the evaluation committee will make a

recommendation for selection to the Chief Procurement Officer for concurrence and submission to the

County elected officials. The County reserves the right to check references on any projects performed by

the proposer whether provided by the proposer or known by the County. The selected proposal will be

submitted for approval to the County Board. The County intends to select a proposal that best meets the

needs of the County and provides the best overall value. Upon approval of the selected Proposer, a

contract will be prepared by the County and presented to the Selected Proposer for signature.

12. Evaluation Criteria

12.1. Responsiveness of Proposals Proposer is compliant with all the submission requirements of the RFP.

12.2. Technical Proposal Proposals will be reviewed and selected based on the following criteria:

1. Qualifications and specialized experience for the Proposer to successfully perform the services for

the County, as evidenced by the successful implementation of similar projects in at least three (3)

large complex public sector organizations. Preferably city, county, state, or other government

entities.

2. Quality of the proposed Plan of Action, Project Approach, Project Management and Methodology,

including implementation schedule, support in the post implementation phase and understanding

of the County’s needs goals and objectives.

3. Qualifications and experience of the proposed key personnel as evidenced by relevant experience.

3.4. Level, quality, and relevancy of proposed participation by certified MBE/WBE firms.

4.5. Financial stability of the Proposer.

12.3. Price Proposal Price will be evaluated separately for overall reasonableness.



Rev 1/1/15



28A

Appendix I Pricing Proposal Form Proposer shall provide the fixed hourly rates proposed in Appendix I to this RFP. The specified fixed hourly

rates shall include wages, overhead, general and administrative expenses and profit. In addition,

contract-level program management support costs shall also be included in the fixed hourly rates

proposed in Appendix I to this RFP, and encompass support for contract-level management, reporting

requirements and related travel and meeting attendance costs associated with the Proposer’s program

management staff, as it relates to overall management and support of the Palantir Gotham Environment.

Proposers are required to submit the pricing proposal in a separate envelope from the technical

proposal. In addition, include a breakdown of personnel rate card and the number and level of staffing

for each task.

The pricing proposal must be submitted in form of hard copy and electronic format.

If your company has specific, unique and/or innovative ideas to implement this system that are outside

of the parameters defined on the pricing proposal, please provide your firm’s recommendations on a

separate sheet.

Service Labor Cost Hourly Rate

Remotely On-Site

Server patch management

Basic Maintenance Labor

New Data integrations and development projects Projects for new hardware, users,

software

Developing applications

Priority support

Pricing Proposal For Travel Expenses (if applicable):

Travel expenses within a 50-mile radius of the County facility are not allowed. Other travel expenses will be reimbursed per the Cook County Travel Policy. If travel expenses are reimbursable, enter the estimated number of trips to be made during the term of the Contract and estimated travel expenses per trip below:

Number of Trips:

Estimated Travel Expenses Per Trip: $______________



Rev 1/1/15

Attachment 4: Pre-Proposal Conference Sign-In Sheets – September 23, 2015



Rev 1/1/15

Attachment 5: Response to Proposers’ Questions

1 of 4

Item No. Questions Answers1 What is the independent government estimate for Time &

Material hours for Base Year and Option Years?T&M estimates will be controlled by the stability of the environment. The County does not have an estimate on number of hours required per month for standard maintenance.

2 What are the MBE/WBE participation goals? PWS 10.15 states ")% of the overall estimated expenditures for this procurement"; however, PWS 12.2.4 cites "level, quality and relevancy or proposed participation by certified MBE/WBE firms"?

The MBE/WBE participation goals for this solicitation are 0%.

Please see Addendum No. 1 for revised Page 23A.

3 Section 5.2, bullet 5 states "Expected Deliverables in the following format below and see the Section 1 of the Deliverables Table Template attached."

We did not locate said template. Can the County government please provide the referenced Deliverable Table?

The language was intended to reference the table contained within Section 5.2. This table is located below Section 5.2: Bullet 5.

4 Section 2, First paragraph (bottom of page 6) states "…travel options should be provided by the vendor". Section 5.6, Second paragraph, Bullet 1 (top of page 12) describes how "The Proposer shall state its willingness to obtain the County's written approval prior to billing the County for travel and expenses, as well as its willingness to adhere to the County's travel policy." Within Appendix I Pricing Proposal Form, the First paragraph states "In addition, contract-level program management suports costs shall also be included in the fixed hourly rates proposed in Appendix I to this RFP, and encompass suport for contract-level management, reporting requirements and related travel and meeting attendance costs associated with the Proposer's program management staff, as it relates to overall management and support of the Palantir Gotham Environment."

Is the County government's intent for travel related to services rendered under this RFP to be cost reimbursable or is the Proposer required to include all travel related Other Direct Costs (ODCs) within their wrap rate/fixed hourly rates?

The County will reimburse Proposers for travel expenses in accordance with the County's Travel Policy. Proposers should not include travel costs within their hourly rates.

Please see Addendum No. 1 for revised Page 28A.

COOK COUNTY ILLINOISOFFICE OF THE CHIEF PROCUREMENT OFFICER

CONTRACT NO. 1550-14816 ADDENDUM NO. 1 PALANTIR GOTHAM SUPPORT

2 of 4

Item No. Questions Answers



5 What is the number of current/potential users that we will be supporting? What is their level of training within Palantir?

There are approximately 30 current users with a potential of up to 150 users. Palantir provided basic user training training regarding usage of the system for investigations for about 175 County employees. The Sheriff's Office does not anticipate the vendor being required to provide training for more than 30-50 County employees, if required at all.

6 Out of the existing user base, how many are trained and acting as admins?

The County is uncertain of what the Proposer means by "admin". There are 3 County employees who are considered "power users" plus an additional employee who may/may not be considered by Proposers as an "admin".

7 How many Cook County resources support this project? Is there a government organizational chart that can be provided?

Cook County has one technical resource with a basic understanding of the environment. The Cook County Organizational Chart may be found on the County's website at the following link:

http://www.cookcountyil.gov/wp-content/uploads/2014/06/CookCounty_OrgChart1.pdf

8 If vendor is responsible for O & M, is the current source code available?

The source code for the Palantir application will not be available. However, the code for the data integrations that calls Palantir API’s is available and may need to be included as part of the support.

9 Appendix I, format requests a labor rate for each service area. Is CCSO only requiring a labor rate or is there an added requirement to estimate hours and total cost?

CSSO is only seeking a Labor Cost Hourly Rate.

10 Des the Proposer need to include the license costs for Oracle DB in our proposal?

No, the Oracle license costs is not required.

11 Could the County clarify, Section 5.4 of the PWS, explaining the rollout support approach and on-site support during the rollout? As it pertains to the scope of work, there will not be a need for rollout support.

Additionally, does the Vendor need to provide end-user training or provide end-user training for enhancements only?

If as part of the engagement we require the Proposer to code and deploy new data integrations, the County would like to understand the Proposers' methodology for rolling out these integrations.

As one of the potential services, the Sheriff's Office may leverage end user training on the Palantir Interface.

3 of 4




12 Section 8, What IA technologies are currently in place to facilitate scanning, auditing and repoting?

The County only has the IA technologies that natively come with the Palantir environment.

13 Section 8.1, Data security controls, internal controls for the system -- Could the County clarify the system?

Please see Addendum No. 1 for revised Page 15A

14 Section 8.1, Could Cook County please clarify physical security (e.g. 24-hour security, alarms, restricted access, etc.)?

Physical security refers to the security measures that the Proposer would provide to protect any CCSO-owned hardware that was moved or serviced offsite from theft, damage or loss.

15 Following on UCJIS requirements, are we required to have our own UCJIS certifications or will we fall under theirs?

The Proposer's staff which has access to the CCSO Palantir environment will need to be background checked per UCJIS requirements in order for the CCSO to remain CJIS compliant.

16 Are specific law enforcement background checks needed? Standarized Law Enforcement Background checks are needed17 What is the log aggregator mentioned in 8.1 E of the RFP? A log aggregator is an application to read or monitor log files. As Palantir leverages

Jenkins for jobs and Nagios for core operations, most out of the box aggregators will be able to read what our stack puts out.

18 Section 5 (page 8) says the "Proposer must comply with the County's content management procedures for tracking progress and documents for the duration of the project…"

Are the County's content management procedures available?

As stated in Section 5: Proposer must track progress and documents for the duration of the project via either the County’s SharePoint site or as otherwise agreed. In addition, the Consultant Proposer will submit written weekly or monthly status reports to the County, which may include: work accomplished, updated Gantt charts, production goals, accepted deliverables, meetings and minutes, status of risks, issues or problems, summaries of approved project changes, and invoicing and payment.

19 Do you have security guidelines for your site that can be shared with offerors to prepare this proposal?

No, the County does not have security guidelines which can be shared with Proposers.

20 Is the Security Addendum required to be completed and returned with the proposal?

No, not with the Proposal; however, the selected vendor employees will be required to sign this document.

4 of 4




21 Each key personnel shall have three (3) references; what is considered a reference?

A reference is considered a previous client's representative with whom the Key Personnel reported to while performing a project similar to the scope for this solicitation.

22 Financial Status - Section 13.2.8, Provide the audited financial statements for the last three fiscal years. Include the letter of opinion, balance sheet, schedules, and related auditor's notes. Can the County explain why this is a requirement?

This requirement will allow the County to determine the financial stability of the Proposer. See Section 12.2.

23 Section 13.2.8 Financial Status states "Provide the audited financial statements for the last three fiscal years. Include the letter of opinion, balance sheet, schedules, and related auditor's notes."

If we do not have audited financial statements and instead have compilations that are reviewed by an outside CPA firm for GAAP compliance which have met and satisfied the financial status requirements of other federal and state clients, do compilations satisfy the requirements within Section 13.2.8?

If your company is not required by federal, state and local law, financial institutions, or company management to have audited, reviewed, or compiled financial statements prepared by an independent certified public accountant, you may submit an internally generated balance sheet and income statement instead.

24 Section 10.17, Cook County Format -- Will there be guidance for solicitation format beyond using the format of the solicitation?

Proposers are directed to Section 13 Submission of Proposal for additional details regarding the format for submitting their proposal.

25 Please clarify in which volume each of the items listed in solicitation section 13.2 should be placed (technical, pricing, or both). Some of the information requested is highly sensitive and is typically provided in the pricing volume, but it is not so stated in the solicitation.

The items listed in Section 13.2 are considered elements of the Technical Proposal. Per Section 13.1.5: Paragraph 2, "The Pricing Proposal shall be submitted in a separate sealed envelope. The envelope shall clearly identify the content as 'Price Proposal'. All other submission requirements shall be included with the Technical Proposal."

26 Is the Certification for Consulting or Auditing Services required to be completed and returned with the proposal?

Yes, Proposers should complete and return Appendix VIII with the proposal.

27 Should vendors address Exhibit 3 - Schedule of Compensation? If so, can you please specify what you are looking for in an offeror's response?

Appendix III Cook County Professional Services Agreement ("PSA") is included with the solicitation so Proposers can review the County's terms and conditions which will be included in the contract which results from this solicitation.

Documents

OFFICE OF THE CHIEF PROCUREMENT OFFICER … OFFICE OF THE CHIEF PROCUREMENT OFFICER TONI PRECKWINKLE PRESIDENT ... as it relates to overall management and support of the Palantir Gotham