Web viewRequest for Proposals. Issue Date:September 30, 2016. RFP Number: VCCS-ASR-17-124. Title:Online Admissions Application. Commodity Code:92003: Application Service

Request for Proposals

Issue Date: September 30, 2016

RFP Number: VCCS-ASR-17-124

Title: Online Admissions Application

Commodity Code: 92003: Application Service Provider20832: Customer Relationship Management Software20800: Computer Software for Microcomputers (Preprogrammed)

Issuing Agency: Commonwealth of VirginiaVirginia Community College SystemStrategic Sourcing300 Arboretum Place, Suite 370Richmond, VA 23236

Initial Period of Contract: Two (2) years (negotiable), with renewal options available as indicated.

Proposals will Be Received Until: November 1, 2016 at 2:00 PM local time.

All proposals must be received SEALED by the date and time shown on the cover page of this solicitation at the following address. Any proposals received after the stated time and date will not be considered.

Pre-Proposal Conference: In lieu of a pre-proposal conference, potential offerors may submit questions in writing to the email address below no later than 4:00 PM local time on October 14, 2016. The following Subject line must be used in the email “VCCS-ASR-17-124– QUESTIONS” for any submitted questions. The VCCS may issue addenda to the solicitation if needed.

Any inquiries regarding this solicitation should be directed only to: Michele Skaggs, VCCS Assistant Procurement Director

Email: [email protected] Phone: (804) 819-4965 Fax: (804) 819-4764

IF PROPOSALS ARE MAILED, SEND DIRECTLY TO ISSUING AGENCY SHOWN ABOVE. IF PROPOSALS ARE HAND DELIVERED, DELIVER TO: Address Shown Above during normal business hours

In compliance with this request for proposals and to all the conditions imposed therein and hereby incorporated by reference, the undersigned offers and agrees to furnish the goods/services in accordance with the attached signed proposal or as mutually agreed upon by subsequent negotiation.

Name and Address of Firm:

Date:

By:

Signature in Ink

Name/Title:

eVA Vendor ID number: Vendor SCC ID Number:

Vendor DUNS Number: Telephone Number:

DSBSD Certification Number: Email:

Note: This public body does not discriminate against faith-based organizations in accordance with the Code of Virginia, Section 2.2-4343.1 or against an offeror because of race, religion, color, sex, national origin, age, disability, or any other basis prohibited by state law relating to discrimination in employment.

I. PURPOSE

The Virginia Community College System (VCCS) seeks proposals from qualified firms to provide a customized technology solution, provide project management through the implementation process, and provide ongoing maintenance, support and licensing for an Online Admissions Application System for the VCCS and its 23 community colleges.

II. BACKGROUND

The Virginia Community College System (VCCS) is an open access set of 23 colleges. As a result, the VCCS has no application fee and the ability for a student to easily apply at any time, from any place, while limiting barriers for enrollment is critical. Our students come from a diverse set of backgrounds and educational level, so an application that has an intuitive and easy to understand design is key. Students who start the VCCS online application complete it at a high rate, though about 8,000-10,000 students a year are lost between account creation and completion. However, students who complete the application have less than a 50% enrollment rate at their chosen college. The VCCS wishes to create a new online application to improve several critical issues in the current native application. We would like an updated, modern interface and design that includes customized applicant communication methods. The overall goals are raising application completion rates, applicant satisfaction, and subsequent enrollment yield. Also, of concern is the ability to effectively and easily modify the application specifics, on an as needed basis by VCCS personnel. Additionally, security and reduction of fraudulent applications is a primary need for the new application.

You can find the current VCCS application here: https://apply.vccs.edu/

III. STATEMENT OF NEEDS

The VCCS seeks to procure and implement a fully integrated Application for Admission. Offerors may propose a single application, multiple integrated applications, or multiple integrated applications interfaced with one or more existing VCCS systems. The proposed solution must meet all required functionality specified for the project in this RFP. The requirements outlined will be required as part of the solution regardless of the software configuration being proposed. The Offeror’s responses to requirements should address all components outlined in the Statement of Needs including all requirements, implementation complexity, project management, associated level of effort, and all deliverables required to meet the functional, management and technical requirements specified.

A. Business Requirements

The VCCS objective is to create a new online application to improve several critical issues in the current homegrown application. Our goal is to provide an updated, modern interface and design, raise application completion rates, improve satisfaction, and increase subsequent enrollment. The solution should include the ability to effectively and easily modify the application on an as-need basis by VCCS personnel, provide reporting and outreach tools, and maintain a secure environment to protect authentication and prevent fraudulent application submissions.

The proposed solution must fully integrate with PeopleSoft SIS to include 12 components, EAD, triggers, and Search/Match at or near real-time. See Attachment 7 – VCCS Technical Requirements for additional specifications.

Page 2 of 42 Request for Proposals # VCCS-ITS-17-124

Online Admissions Application

https://apply.vccs.edu/

1. Design

The VCCS consists of 23 colleges which also require the ability to manage applications at the institutional level. While maintaining a consistent, modern look and feel, each college should have the ability to customize the application to reflect their culture, logo, and environment.

i. Provide a link to a demonstration site or detailed screenshots that illustrate your solution’s interface and design

ii. Describe your solution’s ability to customize application design per college while still operating inside a standardized system-wide application interface.

iii. Describe the ability of your solution to use branching logic (if/then programming) to customize application questions based on applicant answers during the application process.

iv. Describe the options VCCS staff (and college staff, if applicable) will have to easily update questions and other application design elements in your product.

2. Accessibility

Providing an environment for all potential students that limit barriers to entry and success is critical. Any proposed solution must be fully ADA-Accessible.

i. Describe how you will ensure and maintain compliance with Section 508 of the Federal Rehabilitation Act of 1973, as amended, the Commonwealth of Virginia Information Technology Accessibility Standard (ITRM) Standard GOV103-00, and the Web Content Accessibility Guidelines (WCAG) Version 2.0, Conformance Level AA?

ii. Describe how your solution utilizes an adaptive design, i.e. adapts to any device used, including, but not limited to mobile.

iii. Describe how the proposed solution provides application compatibility with all browsers, internet connection speeds, and device types?

3. Functionality

Any proposed solution must provide functionality that aligns with the goal of raising application completion rates, increasing applicant satisfaction, and increasing subsequent enrollment yield. The solution must also provide a secure environment in which students may submit applications, allow for the ability to effectively and efficiently modify the application specifics by VCCS personnel, and prevent fraudulent applications.



i. Describe how your solution supports the application needs of an open access set of colleges with college-specific programs serving a diverse population with varying educational and cultural backgrounds.

ii. Describe options to create subprogram applications that may have more extensive questions/requirements than the standard application for admission by college.

iii. Describe any options to utilize social media information to pre-populate application information. (ex. Facebook, LinkedIn, Google).

iv. Describe any processes or methodologies available to allow applicants to apply to multiple colleges in the VCCS in one submission, including choosing varying programs per college?

v. Describe the process for which students may upload documents when submitting their application?

vi. Describe how the proposed solution would integrate with VA Education Wizard for purposes of pre-populating student data directly into the application, including student program choices from the Wizard? For reference, visit the website at https://www.vawizard.org/wizard/home.

vii. Describe your ability for college staff to enter offline/paper applications submitted to the local college directly into your application system.

viii. What is the process and methodology to ensure that applications are valid requests to apply to the college? Describe authentication procedures to prevent fraudulent application submissions.

4. Reporting

In order to continually improve the application experience for our students, the VCCS is interested in analyzing data such as completion percentages, demographics, and interest. Reports provide key information to help improve the application process as well as create outreach opportunities to assist the student populations.

i. Describe reporting and/or data analytics options available for your solution.

ii. In accordance with § 23.2.2:1 of the Code of Virginia, the name, date of birth, gender and student identification number must be submitted to the Virginia State Police. Describe the process of providing standard daily reports of applicants and transmission to the Virginia State Police as required.



https://www.vawizard.org/wizard/home

5. Customer Relations Management

The proposed technology solution should be designed to allow easy access for VCCS staff and potential students to communicate, in order to have a more positive application experience. The ability to reach out to students who have questions, who fail to complete an application, or submit inquiries is critical to establishing a relationship and assisting students in their journey.

i. Describe any outreach options available to communicate with students upon application submission and/or for applicants who have incomplete applications.

ii. Describe any options available for an Inquiry/Interest “mini-app” to be used as a Customer Relations Management tool?

iii. Describe your customer support options for application completion issues experienced by applicants.

iv. Describe any other customer relations management tools available.

B. Project Management Methodology and Governance Requirements

The contractor shall employ a formal project management methodology for the execution of the project. As a member of the Project Management Team, the contractor shall develop and present management reports for effective execution and monitoring of scope, schedule, budget, organizational change, and risk for the project. VCCS currently uses SharePoint Project website for project management functions such as documentation sharing, issue tracking, risk management and other project collaboration activities requested by the VCCS Program Management Office.

All activities of the project shall be integrated, executed, monitored, controlled, closed, and documented as specified in the Project Management Plan (PMP). The PMP must be developed and documented by the contractor at the direction of the VCCS Project Manager with the members of the Project Team and approved by the VCCS Project Sponsor and Steering Committee. The PMP shall be a comprehensive project management document that incorporates all contractor and VCCS activities, deliverables, and processes essential for the successful implementation of the project.

1. Project Scope

The project scope management plan should define, document, and control all work that is included in the project. The plan should define all of the processes and templates necessary to control changes to project scope and formal acceptance all completed project deliverables.

i. Describe the processes and templates used to control changes to project scope.

ii. Describe the process for acceptance criteria for completed deliverables.



2. Project Budget

The project budget plan defines the funding required to complete the defined project activities within a specified time period in relation to the estimated task durations, assigned resources, project risk, and quality management. This component of the PMP will allow actual costs to be compared and measured against the baseline project budget.

i. Describe the process and templates used to manage the project budget as it relates to tasks, resources, and risk and quality management.

3. Project Schedule

The project schedule management plan establishes the format and criteria for developing and controlling the project schedule for the project. Development of the project schedule includes defining required activities and analyzing activity sequences, durations, resource requirements, and schedule constraints to create the project schedule.

i. Describe the process, tools and template used to manage the project schedule.

ii. Describe the process, tools and templates used to document and report changes to the project schedule, including methodologies to ensure that the project is completed on schedule.

iii. Provide an estimated timeline for project implementation with the assumption that work begins at ‘Day Zero’.

4. Experience, Resources, and Staffing

The project resource management and staffing plans define the human resources and non-labor resources needed to successfully complete the project and the processes for managing these resources. The contractor must provide all resources and staffing to effectively develop, implement, and manage the project. Any changes or modifications of staff to the project must possess, at a minimum, the level of education and experience proposed for the tasks assigned. Any changes or modifications to resources or staffing must be reviewed and accepted by the VCCS.

i. Provide documentation of projects successfully completed of similar size and scope as the proposed solution.

ii. Provide resumes of the project management team to include experience on projects of similar size and scope.

iii. Provide an organization chart proposed for the project management team.

iv. Describe the methodology for managing changes to resources and staff.

v. Describe the approach for the development, maintenance, and reporting of resources and staff assigned or allocated to the project.

vi. Describe the level of resources and staff that the VCCS will be expected to maintain during implementation and post-implementation activities.



5. Risk Management

The project risk management component will define how the project team responds to and manages risk to the project scope, schedule, and budget throughout the execution of the project.

i. Describe the methodology used to identify, monitor and manage risk to the project scope, schedule and budget.

ii. Describe the processes and provisions to perform qualitative and quantitative risk analysis and responses to the results.

iii. Provide any documentation of results from research and prior risk response measures.

6. Enterprise System Go-Live

Planning and preparation for successful go-live date(s) must integrate final preparation activities from all project areas to ensure readiness of the organization and application. These final preparation activities will be planned and documented in a system Go-Live Plan at a detailed level.

i. Describe the process for readiness validation of the organization through completion of all organized change management, training, and documentation activities scheduled prior to Go-Live.

ii. Describe the process for readiness validation of the system and application through successful completion of testing activities prior to production.

iii. Provide a detailed description of all resourced activities necessary to establish in a production environment and support the system through a defined Support and Transition period.

7. Technical and Project Documentation

Technical and Project documentation being developed and delivered as part of the solution should be managed in accordance with the configuration management plan. The Offeror should include the use of tools (such as the VCCS’s standard tool, SharePoint) that allow for version control, check-in/check-out, security management, and document comparisons.

i. Describe the methodology for documentation management throughout the project.

ii. Describe the process for disaster recovery, performance tuning, and debugging aids.

iii. Describe how the solution will support VCS Disaster Recovery testing which will be performed no more than once annually and with a minimum of 30 calendar days’ notice to the contractor.

iv. Identify tools used for document version control, check-in/check-out, security management and document comparisons.

8. Service Level Agreement

A Service Level Agreement (SLA) will be developed by the contractor, in coordination with the VCCS and used to document expectations and obligations of all parties of any resulting contract. The SLA shall



include a description of the products and/or services provided, levels of acceptable services, verifiable performance criteria, their monitoring and reporting. The VCCS retains the right to monitor and revoke any activity related to its assets. The VCCS retains the right to audit responsibilities defined in any resulting contract or agreement, to have those audits carried out by a third party, and to enumerate the statutory rights of auditors.

i. Describe the methodology and process for identifying performance criteria, levels of acceptable service and monitoring and reporting activities.

ii. Define the metrics for integration transaction success and cycle times; uptime and maximum downtimes; and meantime to repair.

iii. Provide a draft SLA that incorporates performance commitments, obligations and expectations.

iv. Describe the methodology and process for establishment of an escalation process for problem resolution.

v. Describe the methodology, performance metrics, expectations and obligations for performance regarding customer service and help desk activities. KSG – are we requiring a true help desk or customer service activities. See help desk section.

C. Build, Deploy, and Implementation Requirements

1. Implementation Services

The Offeror with input from the VCCS shall develop an implementation plan during the initial planning phase of the Project. This component of the PMP encompasses the processes involved in deploying the software properly throughout all installations in the VCCS environment. The plan includes, but is not limited to, installation, configuration, running, testing, and making necessary changes.

i. Describe your build, deploy, implementation methodology, to include the amount of time it would take to successfully implement your solution for all operational units operated by the 23 community colleges. Describe the process by addressing, at a minimum:

Guidance of the build, deploy, implement process including the verification of a fully operational system after deployment but prior to business operations.

Guidance as to the VCCS staff needed and the skill levels they must possess during implementation and during ongoing operation.

End user training. Operational support assistance (ex. hotline). Include available hours, normal response

time after initial call made, support communication capabilities, remote diagnostic capabilities, billing for assisting, etc.

Account management philosophy and team.

ii. The project should be planned and executed by employing a defined, documented, and repeatable system development methodology such as CMM ® Level 2. Describe the proposed system development methodology to be implemented. Address the staff training, process, tools and techniques used.



2. Organizational Change Management (OCM)

Key success factors for the project are stakeholder involvement, understanding, and satisfaction. This approach includes the dynamic interaction of five key components: Project Sponsorship; Organizational Change; Communication; Coordinated Testing; and Training and Education.

These activities ensure that organizational readiness for the implementation of the project is assessed, detailed organization transition plans are developed and executed, stakeholders are appropriately informed of project activities, and proper and timely training has taken place.

To ensure successful implementation of the necessary organizational change, describe how your solution addresses the following:

i. Describe how the solution ensures the key organizational factors (vision, organizational structure, relationships, culture, people, systems, and processes) are properly aligned to provide maximum benefit.

ii. Describe how the solution ensures the appropriate work environment is available to support the desired outcomes.

iii. Describe how education and training is provided and conducted.

iv. Describe the methodology for facilitating the delivery of clear, consistent information to all project stakeholders.

3. Project Status

Bi-weekly project status meetings will be held. Attendance is expected by the contractor’s Project Manager and appropriate staff. The Project Manager should expect to prepare, present and respond to questions and concerns regarding the overall project status with respect to the project work plan, progress information, completed deliverables, and planned project activities. These reports should summarize any outstanding project issues or obstacles and detail any proposed deviations from planned activities, schedules, budgets, or staffing.

i. Describe the methodology and process for monitoring and reporting on the status of the project.

ii. Provide examples of project status reports for projects of similar size and scope.

4. Technical Management Requirements

Application hardware and software for non-production and production environments of the solution must be designed and documented to meet the functional and technical requirements, architecture standards, and the performance standards specified in this RFP. This is intended to cover any hardware or software components that are deployed within the VCCS infrastructure including those used for integration with cloud based systems.

It is the intent of VCCS that all Enterprise System components (hardware, operating system, telecommunications, firewall, disk storage, and database) will be procured by VCCS and installed and hosted by VCCS at the VCCS data center with a back-up and the VCCS recovery site. For all



environments, the contractor must work directly with VCCS personnel to ensure the proposed application architecture is appropriate for the defined usage.

i. Describe the methodology, process, and tools used to ensure that technical management requirements are met.

5. Application Architecture

Application Architecture Requirements refer to design and documentation of all application components (including, but not limited to the database, application, application servers, web servers, all necessary middleware, and disk storage) required to support the technical and functional requirements for the project. Proposals should include a preliminary application architecture that meets the functional and technical requirements, the architecture standards of VCCS, and the specified performance standards. At a minimum, the following environments should be established for the Project. Any other application environments required by the contractor to support their system development methodology for the solution should also be included to ensure the successful execution of the Project. When developing the preliminary recommended application architecture, note that the non-production environments shall reside on a server that is physically separate from the server hosting the production environment.

ENVIRONMENT DEFINITIONSEnvironment Definition Sandbox Fit/Gap, general design and preliminary configurationDevelopment All database and application development, configuration, and unit testingSystem Test Systems and integration testingUser Acceptance Test User acceptance testing and Production StagingProduction Load and Stress Testing prior to Go-Live, Production after Go-LiveTraining Training

i. Provide a detailed description of the application architecture approach to be used and the deliverables to be produced as part of the solution including the architecture that will be left in place for testing and potential development after completed installation.

ii. Describe how the proposed solution includes all production and non-production software and hardware components to be deployed within the VCCS infrastructure.

iii. Include a detailed description of the performance and capacity planning methodology and how it is integrated into the application architecture approach.

iv. Provide the server specifications (server, application, software, operating system, and hardware specifications) for the recommended preliminary application architecture for the specified architectural components.

v. Provide the specific workstation configurations (environment, function, application, software, operating system, and hardware specifications) required by the solution as part of the recommended preliminary application architecture.

vi. Describe the development languages and tools to be used and a brief description of how each tool will be used as part of the application architecture for the solution to support successful implementation of the project.



vii. Describe the approach to database design that ensures a successful implementation and ongoing high performance.

6. System Architecture

Web Browser interface

If the solution provides a web-based user interface it shall be designed to comply with, as applicable, the Commonwealth Enterprise Technical Architecture Standard (ETA 225-08) as defined at: http://www.vita.virginia.gov/uploadedFiles/VITA_Main_Public/Library/PSGs/EA_Standard.pdf

i. Provide documentation, assurance, or confirmation that the solution is in compliance with the stated standards.

Custom Integrations

If VCCS related custom integrations are involved in a Software as a Service solution, the solution must include the hosting of three complete separate environments (landscapes): development, test, and production.

ii. Describe the methodology and process to define separate development, test, and production environments.

User Accessibility

Any proposed solution must be designed to meet the following:

i. Design must function using the then-current VCCS certified versions of the following web browsers: Internet Explorer, Firefox, Chrome, and Safari.

ii. Design must function with standard VCCS end-user computer configurations.

iii. Design must adhere to the Commonwealth of Virginia Information Technology Accessibility Standard (GOV103-00) as defined at http://www.vita.virginia.gov/default.aspx?id=663

iv. If applicable, the solution shall comply with all current COV Data Standards, as applicable to the project - as described on:

http://www.vita.virginia.gov/uploadedFiles/VITA_Main_Public/EAD/Enterprise_Data_Management/COV_Adopted_Standards.xlsx

7. Application Administration

The application administrator(s), in coordination with VCCS staff, will be responsible for installation and maintenance of the application software, web services, and middleware required to effectively deploy the solution on all environments specified in the proposed solution.

i. Provide a detailed description of the application administration approach that will be used and resulting deliverables that will be produced as part of the solution.



http://www.vita.virginia.gov/uploadedFiles/VITA_Main_Public/Library/PSGs/EA_Standard.pdf

8. Configuration Management

The installation and modification of all components (for non-production and production environments) shall be controlled by a configuration management plan which shall be developed by the contractor in coordination with VCCS staff and consistent with VCCS standards. This component of the PMP serves to identify the configuration items and define processes for configuration control, status accounting, audit, and review of the application work products to be delivered to VCCS, including designated internal work products, acquired products, tools, and other items used to create all environments and components.

In addition to the activities defined by the configuration management plan, the contractor shall be responsible for coordinating the migration of code changes to the defined environments using the configuration management processes established for the project.

i. Provide a detailed description of the configuration management approach, process and tools to be used and resulting deliverables to be produced.

ii. Describe the process for assigning a configuration manager, employing automated tools and other support requirements to include, but not be limited to the capability to check in/out documents, workflow to support document approval and migration, and object and document versioning.

9. Change Management

During the lifecycle of the project, changes to proposed functions, features, work processes and procedures may be required. A change is defined as any activity that alters the project scope, deliverables, basic architecture, cost or schedule.

i. Describe the methodology utilized to minimize the impact of to the critical path of the project.

ii. Describe the process and methodology used to identify, document and notify the VCCS of changes to the project.

iii. Describe the process to initiate, log, track, monitor, and receive acceptance of change requests.

Any approved changes to the configuration must be documented and tracked by the Contractor.

iv. Provide configuration documentation to include network, data flow and other process diagrams.

v. Provide policies and procedures relating to documentation and tracking of configuration changes.

10. Design, Configuration and Development

VCCS desires to minimize, to the greatest extent possible, software modifications to any Commercial Off The Shelf (COTS) components included as part of the solution and expects to leverage COTS software configuration in order to meet the business requirements. In those cases where the solution capabilities are not inherent or available through configuration or business process re-engineering, modification of the COTS solution or custom development of selected functionality will be evaluated and formally approved through the project scope management processes.



For any custom coding that is required, the VCCS requires a Coding Structure and Data Standards Document which conforms to existing VCCS standards that includes, at a minimum, a comprehensive set of business element naming and usage standards and valid values and validation rules for proposed business elements.

i. Provide a detailed description of the application and database design methodology that will be used, and the resulting deliverables that will be produced as a part of the solution.

ii. Provide a detailed description of the application configuration methodology including standards that will be used and the resulting deliverables that will be produced as part of the solution.

iii. Describe in detail the interface development approach to be used and the resulting deliverables to be produced as part of the Solution. The interface development approach should incorporate a needs assessment, interface design, interface development, testing, transition, and development of procedures that support interface operations.

iv. Describe in detail the methodology of conducting a Fit/Gap analysis as part of the implementation of the solution. The options for meeting a specific requirement may be defined as: out of the box” (FIT), via software configuration (FIT), via business process change (GAP), via bolt-on software modification (GAP), or via core software modification (GAP).

11. Quality Management

The contractor, with input from the VCCS shall develop a quality management plan during the initial planning phase of the project. The contractor shall provide assistance to the VCCS project staff to ensure that quality reviews are conducted in accordance with and as scheduled in the detailed project plan. The project will also be subject to Independent Validation and Verification (IV&V).

These quality review activities shall be conducted on an on-going basis to provide control and quality assurance for the project, establish project reporting requirements and milestones, and to provide for project administration. Review of the implementation effort and its deliverables will be conducted by internal (VCCS) project team members or by peer reviews. Activities include but are not limited to:

Monitor progress against the plan Revise the project plan(s) as required Monitor quality of deliverables by peer review Monitor staff performance and provide supervision and guidance Prepare progress reports and report on project progress Schedule and conduct periodic progress meetings with staff, users, and others Monitor the design Monitor that the results of the conversion tasks are accurate and complete and that the conversion

schedule meets the implementation and training plans Monitor that the user and operations instructions documentation is accurate and complete Ensure systems test results meet the defined implementation requirements Ensure any organizational structure and procedures changes are consistent with requirements and

capable of handling the applications processing and maintenance requirements

i. Describe the methodology, process and tools used to ensure the quality of the products, services and process meet the specified requirements.



ii. Describe the methodology, process and tools used to assist with, and respond to, reviews, and third-party validation and verification.

12. Training

Contractor shall provide initial and ongoing educational and training services for the development, implementation, and use of the new processes and software. In addition to VCCS user training on the software application, identify training requirements for technical and professional staffs, managers, and end users. Offerors are encouraged to propose all education options available to VCCS that will assist VCCS in maximizing its use of the proposed technical solution.

i. Provide a detailed description of the training program, including deliverables that will be produced as part of the solution for the successful execution of the project.

ii. Describe any overview of other training options including those from third-party providers, training catalog, certification programs etc.

D. Technology Requirements

The VCCS is comprised of 23 separate community colleges with over 40 individual campus locations spread across the Commonwealth of Virginia. The VCCS serves over 250,000 credit students per year. VCCS uses Oracle/PeopleSoft Campus Solutions, Human Resources, and Finance for student management and administrative functions. As of August 2016, the installed versions are Campus Solutions Version 9 (PeopleTools Version 8.53), Human Resources Version 9 (PeopleTools Version. 8.53) and Finance Version 9.1 (PeopleTools Version 8.52) running on Oracle 12c databases.

1. Data Exchange and Technical Operation

The proposed solution must have the ability to exchange data with VCCS Enterprise Systems as indicated in Attachment 6: High Level Overview of VCCS Enterprise Systems and Services. The current Online Application currently maintains interfaces with the following:

VCCS Student Information System (SIS) PeopleSoft Campus Solutions Virginia State Police Sex Offender Registry Links to other applications, which may include, but not be limited to ImageNow

enterprise document management software and Wizard, Pearson K-12 student data nightly update.

VCCS has a number of enterprise systems which it uses to manage both its business, technical, and analytic operations. These systems not only assist our staff with the management of our day to day operations, but they also interface with external systems to meet Commonwealth of Virginia reporting and management operations. Most of this data exchange can be handled by building interfaces to our PeopleSoft SIS ERP, which already has interfaces to many systems including interfaces to:

• VCCS’ Blackboard Learning Management system for course, class and instructor data.

• VCCS’ Blackboard Analytics system, which supports analytical and data warehousing operations for all aspects of VCCS business.



• VCCS’ Active Directory and Directory Services system which support integration and single sign on to all VCCS’ services.

• Google student email and Google Applications for Education

Included for reference as applicable to the proposed solution:

Attachment 6: High Level Overview of VCCS Enterprise Systems and Services Attachment 7: VCCS Technical Standards Attachment 8: VCCS Interface Standards

2. Software Licenses

If applicable to the proposed solution, offeror should propose all software and applicable software license agreements required for the solution. All software license agreements should be fully assignable to the VCCS. It is anticipated that the contractor should hold all licenses through final acceptance. Depending upon the proposed solution, the purchase and assignment of all software licenses to the VCCS should be finalized according to a negotiated assignment timetable. VCCS reserves the right to adjust the assignment timetable.

i. Please provide a detailed description of the approach to handling software licenses on the Project.

ii. Please provide a copy of the license agreement(s).

3. Software Upgrades

It is the goal of VCCS to establish and execute processes to stay current with all application software and components, including patches, throughout the life of the project. As part of the project implementation, the contractor shall evaluate the release schedules for all software components and make a recommendation to VCCS on the versions of all software components at initial installation and at Go-Live. If any software components are approved by VCCS for upgrade or patch installation prior to Go-Live, the contractor shall plan the project work to accommodate the effort necessary to implement a release or patch in a manner that minimizes impact and cost to the project and allows for the software components to be as close as feasible to the most current releases of the software products, including patches.

It is the goal of VCCS to remain current (no more than one release behind a major release) and supported on all software components after Go-Live. The contractor shall be responsible for the evaluation, planning, and execution of all software upgrades during the support and transition period. All upgrade or patch installation plans must be approved by VCCS prior to execution. In the event an infrastructure component upgrade requires a component upgrade, the contractor shall work with the infrastructure service provider to evaluate and plan the necessary upgrades to the components in coordination with VCCS. Solution shall limit scheduled maintenance to nights and weekends during non-critical times to the greatest degree possible.

i. Please provide a detailed description of the Software Upgrade methodology that will be employed. Include a description of the upgrade strategy, resources, tools, and activities that will be used to ensure currency at Go-Live and throughout the support and transition period.



ii. Describe the methodology and process to provide support to the VCCS during operating system, database, or application software upgrades.

4. Customer Support / Help Desk

The initial point of contact for customers shall be a fully functioning help desk staffed by the contractor prior to the commencement of UAT and continue through the term of any contract agreement, including any exercised renewal options.

i. Describe in detail the support services that will be provided through the help desk.

ii. Describe performance metrics regarding customer support and help desk functions.

iii. Define organization structure and tiers to be established for issue tracking.

iv. Provide description of response times, problem escalation guidelines, and problem resolution procedures.

5. Post Implementation Support and Transition

It is the goal of VCCS to establish an optimum level of post-implementation support for the provision of customer service and application administration support. The post-implementation support and transition period begins at Go-Live and continues through the term of any resulting contract, including any, and all, exercised renewal options. The proposed, and approved, design, development, and configuration management processes utilized throughout the implementation phase shall be continued for any modifications that are approved.

i. Please provide a detailed description of the approach to post-implementation support and the support services to be provided. The description should include team structure, staffing roles and responsibilities, support tiers, service levels and associated metrics, types of service, problem resolution, and routine maintenance processes and support.

ii. Provide an outline of the post-implementation support and transition plan that will be developed as part of the solution. Include, at minimum, information regarding the approach to the following:

Ongoing maintenance support Technical support Help desk Automated customer support Web-based support Training and Education Services Consulting Services Remote system administration Licensing

E. Physical and Environmental Security Requirements



1. Data Center Security

Contractor must provide assurance that physical security measures are in place, including barriers, alarm systems, access control systems, policies and procedures such as:

• Construction of a hardened building envelope and perimeter• The use of employee and visitor badges• Visitor escorts at all times• Visitor logs• Entrance control

i. Describe the methodology, process and procedures used to assure that physical security measures are in place.

ii. Describe the “defense in depth” approach to minimizing the impact of a defeat of a specific security measure.

iii. Identify the provisions for back-up and recovery, to include identity of general locations for data centers used as primary data center and secondary data center where used for back-up purposes.

All data must reside at data center locations within the continental United States. Back-up data must be located at a site that is geographically remote to the primary data center.

2. Fire Protection

The contractor must provide a copy of an independent security audit of the hosting facility attesting to the compliance of the facility with all applicable information security standards referenced.

3. Environmental Security

Contractor must provide assurance that environmental security measures are in place.

i. Provide information regarding the primary and backup power utilities serving each data center, including monitoring of the electric power sources.

ii. Provide information regarding the primary and backup telecommunications utilities that will service the contract.

iii. Provide information regarding the primary and backup air conditioning systems supporting each data center and monitoring of air conditioning systems.

4. Security Certification

The contractor must provide documentation of all security certifications and independent security assessments of the data center(s) in which the VCCS systems will be housed, including backup and continuity of operations sites.

i. Describe the methodology and plan to maintain and/or enhance the security certifications over the term of any resulting contract or agreement.



F. Logical Security

1. Information Security Perimeter

The contractor must provide a secure perimeter and operating environment that includes a security plan for monitoring firewall intrusion detection, vulnerability assessments, penetration analysis, access control, and incident management.

i. Describe the tools, policies and procedures in place that will prevent and detect unauthorized attempts to access the VCCS’s systems

ii. Describe the tools used for monitoring and alerting processes.

iii. Provide sample reports, logs and audit trails.

2. Data Access Control

Access to system software and database must be controlled by unique identifiers which must be assigned to each person with system access to ensure accountability and audit trails and periodic password changes. The solution shall prohibit the storage of passwords in clear text and shall be designed to suppress the display of passwords on the screen as they are entered. The solution shall be designed to utilize Role-Based Access Control (RBAC) to control user access to system access. All VCCS data must be hosted in a separate database(s) with separate user accounts and passwords to operate the hosted software. VCCS requires a single-tenant hosting option separated from that of other customers.

i. Describe security access and procedures to ensure accountability, audit trails, and periodic password changes.

ii. For hosted solutions that do not use Federated Identity and Access Management for Single-Sign On authentication, provide the methodology for complexity and expiration requirements.

iii. Describe the methodology and process to provide the ability for VCCS System Administrators to modify end-user profiles and permission levels.

iv. Describe the methodology and process designed to control system access through end-user authentication.

3. Data Protection

The VCCS’s systems must be protected from hacking and virus attacks. Such attacks must be detected and prevented. Where prevention fails, the VCCS’s systems must be cleansed of viruses and/or recovered.

i. Describe the tools, policies and procedures that will detect and defend the VCCS’s systems against malware and virus attacks.

ii. Describe the deployment of anti-malware configured to provide real-time protection within a SaaS network infrastructure.



iii. Describe the frequency of updates for anti-malware library definitions and anti-virus scans.

iv. Describe the tools, policies and procedures that will be used to cleanse the VCCS’s systems, should a hacking or virus successfully attack the VCCS’s systems.

4. Data Integrity

The integrity of VCCS data must be maintained at all times with steps taken to prevent unauthorized changes to the data and transfer or transmission of the VCCS data to unauthorized third parties. Any proposed solution must identify database software used within the service.

i. Describe the tools, policies and procedures that will enable the VCCS to ensure the integrity of its data.

ii. Describe the process of providing appropriate levels of access to authorized VCCS representatives for auditing, investigations, and other purposes.

iii. Provide evidence that privileged and service account management meets or exceeds the requirements of the Virginia Community College System Information Security Standard.

5. Data Encryption

All data in transit is encrypted with a 128 bit SSL Certificate. Work papers (attachments) should be encrypted within the database using AES-256 (Advanced Encryption Standard). The solution shall be designed to use Hypertext Transport Protocol Secure (https) where access is provided through a web browser client.

i. Describe the database username and password encryption technique provided within the service.

6. System Monitoring

Describe monitoring tools in place to confirm system availability, and best practices such as:

All servers are monitored 24/7/365 with system alerts being sent to the application hosting support engineers (excessive CPU, Low disc space, application pool failures, etc.).

Maintaining logs of all end-user attempts to gain system access. Maintaining logs of all failed end-user attempts to gain system access. Generating high-priority alerts to designated users in the event of a security event. Providing the ability to query all system logs. Providing the ability to monitor the system for security breaches and intrusions. Log all breaches of system security.

7. Continuity of Operations

Offeror must propose a Continuity of Operations plan that addresses traditional Disaster Recovery Contingencies, including fire, flood, earthquake, power disruption, etc.

All relevant components of the data center operations and the hosted software solution must be configured in N+1 redundancy, allowing all primary systems to suffer failures without interrupting service to the customer (high-availability configuration). All systems are designed to provide 99.9%



availability to customers using the hosted software solution. Offeror must provide an N+1 network infrastructure that includes connectivity to at least 2 unique telecom providers for Internet access. Availability of Internet connectivity is covered by a 99.9% Service Level Agreement. The hosted software solution shall be designed to provide full system redundancy/fail-over to a remote site within the timeframe established by the business for the recovery time objective in the event that service outages or other application problems impact users for 48 hours or longer.

i. Describe the methodology and processes proposed in the Continuity of Operations Plan and Disaster Recovery Contingencies.

ii. Provide a sample plan that restores the VCCS’s production, test and development systems as determined to meet the business requirements defined for the system

8. Back-ups

All Production databases are backed up nightly with copies sent electronically to a remote SSAE 16 type II facility daily. The VCCS requires a minimum of a weekly full system backup, with incremental daily backups for all application environments (Production, Test, and Development). Full System backups must be retained for two weeks minimum. Backups must be stored off-site in an appropriately secured and environmentally controlled facility.

i. Describe the proposed back-up schedule and rotation policies.

ii. Describe the methodology for periodic testing and validation of database back-ups.

9. Security Administrator

The solution shall provide secure, remote access to allow a VCCS Security Administrator to unlock user accounts, reset end-user passwords, and conduct security investigation and system diagnostic functions.

i. Describe the methodology and process for assigning, securing, and allowing access to VCCS Security Administrators.

IV. PROPOSAL PREPARATION AND SUBMISSION INSTRUCTIONS

A. GENERAL PROPOSAL PREPARATION

1. Response : In order to be considered for selection, offerors must submit a complete response to this RFP. One (1) original and six (6) copies of each proposal must be submitted to the issuing agency.

a. Paper submission (hard copies)

2. One (1) original signed proposal including the RFP, signed coversheet, and signed acknowledgement of any addenda – marked as “ORIGINAL”

ii. Six (6) duplicate copies of above –each marked as “COPY” Note: Do not include pricing with duplicate copies. Only one copy of pricing is required – one copy of pricing schedule shall be provided in a separate sealed envelope.

iii. One (1) redacted copy (only if Offeror has invoked the protections (trade secrets/proprietary information) of § 2.2-4342F of the Code of Virginia.)



b. Electronic Submission (provide on CD-R or DVD-R)

i. One (1) electronic copy of proposal in a text searchable format (either MS Word, or text searchable PDF)

ii. One (1) redacted electronic copy of proposal in a text searchable format (either MS Word, or text searchable PDF; only if Offeror has invoked the protections of § 2.2-4342F of the Code of Virginia.)

3. Proposal Preparation :

a. Ownership of all data, materials, and documentation originated and prepared for the VCCS pursuant to this solicitation shall belong exclusively to the VCCS and be subject to public inspection in accordance with the Virginia Freedom of Information Act. Trade secrets or proprietary information submitted by an offeror shall not be subject to public disclosure under the Virginia Freedom of Information Act; however, the offeror must invoke the protections of § 2.2-4342F of the Code of Virginia, in writing, either before or at the time the data or other material is submitted. The written notice must specifically identify the data or materials to be protected and state the reasons why protection is necessary. The proprietary or trade secret material submitted must be identified by some distinct method such as highlighting or underlining and must indicate only the specific words, figures, or paragraphs that constitute trade secret or proprietary information in the original signed proposal and paper copies. Additionally, the offeror must submit a redacted copy of the proposal if invoking said protection. The classification of an entire proposal document, line item prices, and/or total proposal prices as proprietary or trade secrets is not acceptable and will result in rejection of the proposal.

b. Proposals shall be signed by an authorized representative of the Offeror. All information requested should be submitted. Failure to submit all information requested may result in the purchasing agency requiring prompt submission of missing information and/or giving a lowered evaluation of the proposal. Proposals which are substantially incomplete or lack key information may be rejected by the purchasing agency. Mandatory requirements are those required by law or regulation or are such that they cannot be waived and are not subject to negotiation.

c. Proposals should be prepared simply and economically, providing a straightforward, concise description of capabilities to satisfy the requirements of the RFP. Emphasis should be placed on completeness and clarity of content.

d. The entire proposal response shall be limited to 150 typed pages (excluding the complete RFP, without attachments) signed and filled out as required. No font shall be smaller than 11 Point. Page size shall be 8 ½ x 11 inch. Larger pages are allowed for figures or tables, but should be folded into the overall proposal and used sparingly. All pages should be numbered.

e. Proposals should be organized in the order in which the requirements are presented in the RFP. All pages of the proposal should be numbered. Each paragraph in the proposal should reference the paragraph number of the corresponding section of the RFP. Please cite the paragraph number, sub letter, and repeat the text of the requirement as it appears in the RFP . If a response covers more than one page, the paragraph number and sub letter should be repeated at the top of the next page. The proposal should contain a table of contents which cross-references the RFP requirements. Information which the Offeror desires to present that does not fall within any of the requirements of the RFP should be inserted at an appropriate place or be attached at the end of the proposal and designated as additional material. Proposals that are not organized in this manner



risk elimination from consideration if the evaluators are unable to find where the RFP requirements are specifically addressed.

f. As used in this RFP, the terms “must”, “shall”, “should” and “may” identify the criticality of requirements. “Must” and “shall” identify requirements whose absence will have a major negative impact on the suitability of the proposed solution. Items labeled as “should” or “may” are highly desirable, although their absence will not have a large impact and would be useful, but are not necessary. Depending on the overall response to the RFP, some individual “must” and “shall” items may not be fully satisfied, but it is the intent to satisfy most, if not all, “must” and “shall” requirements. The inability of an Offeror to satisfy a “must” or “shall” requirement does not automatically remove that Offeror from consideration; however, it may seriously affect the overall rating of the Offerors’ proposal.

g. Each copy of the proposal should be bound or contained in a single volume where practical. All documentation submitted with the proposal should be contained in that single volume.

4. Oral Presentation / Demonstrations : Offerors who submit a proposal in response to this RFP may be required to give an oral presentation or provide a demonstration of their proposed solution to the agency. This provides an opportunity for the Offeror to clarify or elaborate on the proposal. This is a fact finding and explanation session only and does not include negotiation. The issuing agency will schedule the time and location of these presentations. Oral presentations are an option of the purchasing agency and may or may not be conducted.

B. SPECIFIC PROPOSAL INSTRUCTIONS

Proposals should be as thorough and detailed as possible so that the VCCS may properly evaluate your capabilities to provide the required services. Offerors are required to submit the following items as a complete proposal:

1. RFP cover sheet and all addenda acknowledgments, if any, signed and filled out as required.

2. Offeror (Vendor) Data Sheet, included as an attachment to the RFP, and other specific items or data requested in the RFP.

3. Non-Disclosure Agreement must be signed and returned.

4. A written narrative statement to include:

a. Experience in providing the services described herein.

b. Names, qualifications and experience of personnel to be assigned to the project.

5. Specific methodology and plans for providing the proposed services including:

a. What, when, how and by whom the services will be performed.

b. Projected timeline for delivery of services relative to award date of contract.

6. Proposed Price. Provide a fee structure associated with services rendered as outlined in this RFP . Pricing must be included in a separate SEALED envelope. Only one copy of the proposed pricing is required. Do not include pricing with any required duplicate copies.



7. IDENTIFICATION OF PROPOSAL ENVELOPE : The signed proposal should be returned in a separate envelope or package, sealed and identified by affixing the label below to the outside of the sealed envelope/package.

SEALED PROPOSAL:DELIVER TO PURCHASING OFFICE From:

RFP# VCCS-ASR-17-124Name of Offeror Online Admissions Application

V. EVALUATION AND AWARD CRITERIA

A. EVALUATION CRITERIA : Proposals will be evaluated by the VCCS as indicated below.

B. AWARD OF CONTRACT

Selection shall be made of two or more offerors deemed to be fully qualified and best suited among those submitting proposals on the basis of the evaluation factors included in the Request for Proposals, including price, if so stated in the Request for Proposals. Negotiations shall be conducted with the offerors so selected. Price shall be considered, but need not be the sole determining factor. After negotiations have been conducted with each offeror so selected, the agency shall select the offeror which, in its opinion, has made the best proposal, and shall award the contract to that offeror. The Commonwealth may cancel this Request for Proposals or reject proposals at any time prior to an award, and is not required to furnish a statement of the reasons why a particular proposal was not deemed to be the most advantageous (Code of Virginia, § 2.2-4359D). Should the Commonwealth determine in writing and in its sole discretion that only one offeror is fully qualified, or that one offeror is clearly more highly qualified than the others under consideration, a contract may be negotiated and awarded to that offeror. The award document will be a contract incorporating by reference all the requirements, terms and conditions of the solicitation and the contractor’s proposal as negotiated.



Evaluation Criteria

Experience and Qualifications of personnel assigned to this project

Demonstrated ability to meet all business requirements

Demonstrated ability to meet all technical requirements

Demonstrated ability to meet all project management activities

Proposed Pricing

Small Business

VI. GENERAL TERMS AND CONDITIONS

A. VENDORS MANUAL: This solicitation is subject to the provisions of the Commonwealth of Virginia Vendors Manual and any changes or revisions thereto, which are hereby incorporated into this contract in their entirety. The procedure for filing contractual claims is in section 7.19 of the Vendors Manual. A copy of the manual is normally available for review at the purchasing office and is accessible on the Internet at www.eva.virginia.gov under “Vendors Manual” on the vendors tab.

B. APPLICABLE LAWS AND COURTS: This solicitation and any resulting contract shall be governed in all respects by the laws of the Commonwealth of Virginia and any litigation with respect thereto shall be brought in the courts of the Commonwealth. The agency and the contractor are encouraged to resolve any issues in controversy arising from the award of the contract or any contractual dispute using Alternative Dispute Resolution (ADR) procedures (Code of Virginia, § 2.2-4366). ADR procedures are described in Chapter 9 of the Vendors Manual. The contractor shall comply with all applicable federal, state and local laws, rules and regulations.

C. ANTI-DISCRIMINATION: By submitting their proposals, offerors certify to the Commonwealth that they will conform to the provisions of the Federal Civil Rights Act of 1964, as amended, as well as the Virginia Fair Employment Contracting Act of 1975, as amended, where applicable, the Virginians With Disabilities Act, the Americans With Disabilities Act and § 2.2-4311 of the Virginia Public Procurement Act (VPPA). If the award is made to a faith-based organization, the organization shall not discriminate against any recipient of goods, services, or disbursements made pursuant to the contract on the basis of the recipient's religion, religious belief, refusal to participate in a religious practice, or on the basis of race, age, color, gender or national origin and shall be subject to the same rules as other organizations that contract with public bodies to account for the use of the funds provided; however, if the faith-based organization segregates public funds into separate accounts, only the accounts and programs funded with public funds shall be subject to audit by the public body. (Code of Virginia, § 2.2-4343.1E).

In every contract over $10,000 the provisions in 1. and 2. below apply:

1. During the performance of this contract, the contractor agrees as follows:

a. The contractor will not discriminate against any employee or applicant for employment because of race, religion, color, sex, national origin, age, disability, or any other basis prohibited by state law relating to discrimination in employment, except where there is a bona fide occupational qualification reasonably necessary to the normal operation of the contractor. The contractor agrees to post in conspicuous places, available to employees and applicants for employment, notices setting forth the provisions of this nondiscrimination clause.

b. The contractor, in all solicitations or advertisements for employees placed by or on behalf of the contractor, will state that such contractor is an equal opportunity employer.

c. Notices, advertisements and solicitations placed in accordance with federal law, rule or regulation shall be deemed sufficient for the purpose of meeting these requirements.

2. The contractor will include the provisions of 1. above in every subcontract or purchase order over $10,000, so that the provisions will be binding upon each subcontractor or vendor.

D. ETHICS IN PUBLIC CONTRACTING: By submitting their proposals, offerors certify that their proposals are made without collusion or fraud and that they have not offered or received any kickbacks or inducements from any other offeror, supplier, manufacturer or subcontractor in connection with their proposal, and that they have not conferred on any public employee having official responsibility for this procurement transaction any payment, loan, subscription, advance, deposit of money, services or anything of more than nominal value, present or promised, unless consideration of substantially equal or greater value was exchanged.



http://www.eva.virginia.gov/

E. IMMIGRATION REFORM AND CONTROL ACT OF 1986: By entering into a written contract with the Commonwealth of Virginia, the Contractor certifies that the Contractor does not, and shall not during the performance of the contract for goods and services in the Commonwealth, knowingly employ an unauthorized alien as defined in the federal Immigration Reform and Control Act of 1986.

F. DEBARMENT STATUS: By participating in this procurement, the vendor certifies that they are not currently debarred by the Commonwealth of Virginia from submitting a response for the type of goods and/or services covered by this solicitation, Vendor further certifies that they are not debarred from filling any order or accepting any resulting order, or that they are an agent of any person or entity that is currently debarred by the Commonwealth of Virginia.

G. ANTITRUST: By entering into a contract, the contractor conveys, sells, assigns, and transfers to the Commonwealth of Virginia all rights, title and interest in and to all causes of action it may now have or hereafter acquire under the antitrust laws of the United States and the Commonwealth of Virginia, relating to the particular goods or services purchased or acquired by the Commonwealth of Virginia under said contract.

H. MANDATORY USE OF STATE FORM AND TERMS AND CONDITIONS: Failure to submit a proposal on the official state form provided for that purpose may be a cause for rejection of the proposal. Modification of or additions to the General Terms and Conditions of the solicitation may be cause for rejection of the proposal; however, the Commonwealth reserves the right to decide, on a case by case basis, in its sole discretion, whether to reject such a proposal.

I. CLARIFICATION OF TERMS: If any prospective offeror has questions about the specifications or other solicitation documents, the prospective offeror should contact the buyer whose name appears on the face of the solicitation no later than five working days before the due date. Any revisions to the solicitation will be made only by addendum issued by the buyer.

J. PAYMENT:

1. To Prime Contractor:

a. Invoices for items ordered, delivered and accepted shall be submitted by the contractor directly to the payment address shown on the purchase order/contract. All invoices shall show the state contract number and/or purchase order number; social security number (for individual contractors) or the federal employer identification number (for proprietorships, partnerships, and corporations).

b. Any payment terms requiring payment in less than 30 days will be regarded as requiring payment 30 days after invoice or delivery, whichever occurs last. This shall not affect offers of discounts for payment in less than 30 days, however.

c. All goods or services provided under this contract or purchase order, that are to be paid for with public funds, shall be billed by the contractor at the contract price, regardless of which public agency is being billed.

d. The following shall be deemed to be the date of payment: the date of postmark in all cases where payment is made by mail, or the date of offset when offset proceedings have been instituted as authorized under the Virginia Debt Collection Act.

e. Unreasonable Charges. Under certain emergency procurements and for most time and material purchases, final job costs cannot be accurately determined at the time orders are placed. In such cases, contractors should be put on notice that final payment in full is contingent on a determination of reasonableness with respect to all invoiced charges. Charges which appear to be unreasonable will be



researched and challenged, and that portion of the invoice held in abeyance until a settlement can be reached. Upon determining that invoiced charges are not reasonable, the Commonwealth shall promptly notify the contractor, in writing, as to those charges which it considers unreasonable and the basis for the determination. A contractor may not institute legal action unless a settlement cannot be reached within thirty (30) days of notification. The provisions of this section do not relieve an agency of its prompt payment obligations with respect to those charges which are not in dispute (Code of Virginia, § 2.2-4363).

2. To Subcontractors:

a. A contractor awarded a contract under this solicitation is hereby obligated:

(1) To pay the subcontractor(s) within seven (7) days of the contractor’s receipt of payment from the Commonwealth for the proportionate share of the payment received for work performed by the subcontractor(s) under the contract; or

(2) To notify the agency and the subcontractor(s), in writing, of the contractor’s intention to withhold payment and the reason.

b. The contractor is obligated to pay the subcontractor(s) interest at the rate of one percent per month (unless otherwise provided under the terms of the contract) on all amounts owed by the contractor that remain unpaid seven (7) days following receipt of payment from the Commonwealth, except for amounts withheld as stated in (2) above. The date of mailing of any payment by U. S. Mail is deemed to be payment to the addressee. These provisions apply to each sub-tier contractor performing under the primary contract. A contractor’s obligation to pay an interest charge to a subcontractor may not be construed to be an obligation of the Commonwealth.

3. Each prime contractor who wins an award in which provision of a SWaM procurement plan is a condition to the award, shall deliver to the contracting agency or institution, on or before request for final payment, evidence and certification of compliance (subject only to insubstantial shortfalls and to shortfalls arising from subcontractor default) with the SWaM procurement plan. Final payment under the contract in question may be withheld until such certification is delivered and, if necessary, confirmed by the agency or institution, or other appropriate penalties may be assessed in lieu of withholding such payment.

4. The Commonwealth of Virginia encourages contractors and subcontractors to accept electronic and credit card payments.

K. PRECEDENCE OF TERMS: The following General Terms and Conditions VENDORS MANUAL, APPLICABLE LAWS AND COURTS, ANTI-DISCRIMINATION, ETHICS IN PUBLIC CONTRACTING, IMMIGRATION REFORM AND CONTROL ACT OF 1986, DEBARMENT STATUS, ANTITRUST, MANDATORY USE OF STATE FORM AND TERMS AND CONDITIONS, CLARIFICATION OF TERMS, PAYMENT shall apply in all instances. In the event there is a conflict between any of the other General Terms and Conditions and any Special Terms and Conditions in this solicitation, the Special Terms and Conditions shall apply.

L. QUALIFICATIONS OF OFFERORS: The Commonwealth may make such reasonable investigations as deemed proper and necessary to determine the ability of the offeror to perform the services/furnish the goods and the offeror shall furnish to the Commonwealth all such information and data for this purpose as may be requested. The Commonwealth reserves the right to inspect offeror’s physical facilities prior to award to satisfy questions regarding the offeror’s capabilities. The Commonwealth further reserves the right to reject any proposal if the evidence submitted by, or investigations of, such offeror fails to satisfy the Commonwealth that such offeror is properly qualified to carry out the obligations of the contract and to provide the services and/or furnish the goods contemplated therein.



M. TESTING AND INSPECTION: The Commonwealth reserves the right to conduct any test/inspection it may deem advisable to assure goods and services conform to the specifications.

N. ASSIGNMENT OF CONTRACT: A contract shall not be assignable by the contractor in whole or in part without the written consent of the Commonwealth.

O. CHANGES TO THE CONTRACT: Changes can be made to the contract in any of the following ways:

1. The parties may agree in writing to modify the terms, conditions, or scope of the contract. Any additional goods or services to be provided shall be of a sort that is ancillary to the contract goods or services, or within the same broad product or service categories as were included in the contract award. Any increase or decrease in the price of the contract resulting from such modification shall be agreed to by the parties as a part of their written agreement to modify the scope of the contract.

2. The Purchasing Agency may order changes within the general scope of the contract at any time by written notice to the contractor. Changes within the scope of the contract include, but are not limited to, things such as services to be performed, the method of packing or shipment, and the place of delivery or installation. The contractor shall comply with the notice upon receipt, unless the contractor intends to claim an adjustment to compensation, schedule, or other contractual impact that would be caused by complying with such notice, in which case the contractor shall, in writing, promptly notify the Purchasing Agency of the adjustment to be sought, and before proceeding to comply with the notice, shall await the Purchasing Agency's written decision affirming, modifying, or revoking the prior written notice. If the Purchasing Agency decides to issue a notice that requires an adjustment to compensation, the contractor shall be compensated for any additional costs incurred as the result of such order and shall give the Purchasing Agency a credit for any savings. Said compensation shall be determined by one of the following methods:

a. By mutual agreement between the parties in writing; or

b. By agreeing upon a unit price or using a unit price set forth in the contract, if the work to be done can be expressed in units, and the contractor accounts for the number of units of work performed, subject to the Purchasing Agency’s right to audit the contractor’s records and/or to determine the correct number of units independently; or

c. By ordering the contractor to proceed with the work and keep a record of all costs incurred and savings realized. A markup for overhead and profit may be allowed if provided by the contract. The same markup shall be used for determining a decrease in price as the result of savings realized. The contractor shall present the Purchasing Agency with all vouchers and records of expenses incurred and savings realized. The Purchasing Agency shall have the right to audit the records of the contractor as it deems necessary to determine costs or savings. Any claim for an adjustment in price under this provision must be asserted by written notice to the Purchasing Agency within thirty (30) days from the date of receipt of the written order from the Purchasing Agency. If the parties fail to agree on an amount of adjustment, the question of an increase or decrease in the contract price or time for performance shall be resolved in accordance with the procedures for resolving disputes provided by the Disputes Clause of this contract or, if there is none, in accordance with the disputes provisions of the Commonwealth of Virginia Vendors Manual. Neither the existence of a claim nor a dispute resolution process, litigation or any other provision of this contract shall excuse the contractor from promptly complying with the changes ordered by the Purchasing Agency or with the performance of the contract generally.

P. DEFAULT: In case of failure to deliver goods or services in accordance with the contract terms and conditions, the Commonwealth, after due oral or written notice, may procure them from other sources and hold the contractor responsible for any resulting additional purchase and administrative costs. This remedy shall be in addition to any other remedies which the Commonwealth may have.



Q. OMIT

R. OMIT

S. OMIT

T. INSURANCE: By signing and submitting a bid or proposal under this solicitation, the offeror certifies that if awarded the contract, it will have the following insurance coverage at the time the contract is awarded. For construction contracts, if any subcontractors are involved, the subcontractor will have workers’ compensation insurance in accordance with §§ 2.2-4332 and 65.2-800 et seq. of the Code of Virginia. The offeror further certifies that the contractor and any subcontractors will maintain these insurance coverage during the entire term of the contract and that all insurance coverage will be provided by insurance companies authorized to sell insurance in Virginia by the Virginia State Corporation Commission.

MINIMUM INSURANCE COVERAGES AND LIMITS REQUIRED FOR MOST CONTRACTS:

1. Workers’ Compensation - Statutory requirements and benefits. Coverage is compulsory for employers of three or more employees, to include the employer. Contractors who fail to notify the Commonwealth of increases in the number of employees that change their workers’ compensation requirements under the Code of Virginia during the course of the contract shall be in noncompliance with the contract.

2. Employer’s Liability - $100,000.3. Commercial General Liability - $1,000,000 per occurrence and $2,000,000 in the aggregate. Commercial

General Liability is to include bodily injury and property damage, personal injury and advertising injury, products and completed operations coverage. The Commonwealth of Virginia must be named as an additional insured and so endorsed on the policy.

4. Automobile Liability - $1,000,000 combined single limit. (Required only if a motor vehicle not owned by the Commonwealth is to be used in the contract. Contractor must assure that the required coverage is maintained by the Contractor (or third party owner of such motor vehicle.)

Profession/Service Limits

Accounting $1,000,000 per occurrence, $3,000,000 aggregateArchitecture $2,000,000 per occurrence, $6,000,000 aggregateAsbestos Design, Inspection or Abatement Contractors 1,000,000 per occurrence, $3,000,000 aggregateHealth Care Practitioner (to include Dentists, Licensed Dental

Hygienists, Optometrists, Registered or Licensed Practical Nurses, Pharmacists, Physicians, Podiatrists, Chiropractors, Physical Therapists, Physical Therapist Assistants, Clinical Psychologists,Clinical Social Workers, Professional Counselors, Hospitals, or Health Maintenance Organizations.) $2,150,000 per occurrence, $4,250,000 aggregate (Limits increase each July 1 through fiscal year 2031per Code of Virginia § 8.01-581.15.

Insurance/Risk Management $1,000,000 per occurrence, $3,000,000 aggregateLandscape/Architecture $1,000,000 per occurrence, $1,000,000 aggregateLegal $1,000,000 per occurrence, $5,000,000 aggregateProfessional Engineer $2,000,000 per occurrence, $6,000,000 aggregateSurveying $1,000,000 per occurrence, $1,000,000 aggregate

U. ANNOUNCEMENT OF AWARD: Upon the award or the announcement of the decision to award a contract as a result of this solicitation, the purchasing agency will publicly post such notice on the DGS/DPS eVA VBO (www.eva.virginia.gov) for a minimum of 10 days.



http://www.eva.state.va.us/

V. DRUG-FREE WORKPLACE: During the performance of this contract, the contractor agrees to (i) provide a drug-free workplace for the contractor's employees; (ii) post in conspicuous places, available to employees and applicants for employment, a statement notifying employees that the unlawful manufacture, sale, distribution, dispensation, possession, or use of a controlled substance or marijuana is prohibited in the contractor's workplace and specifying the actions that will be taken against employees for violations of such prohibition; (iii) state in all solicitations or advertisements for employees placed by or on behalf of the contractor that the contractor maintains a drug-free workplace; and (iv) include the provisions of the foregoing clauses in every subcontract or purchase order of over $10,000, so that the provisions will be binding upon each subcontractor or vendor.

For the purposes of this section, “drug-free workplace” means a site for the performance of work done in connection with a specific contract awarded to a contractor, the employees of whom are prohibited from engaging in the unlawful manufacture, sale, distribution, dispensation, possession or use of any controlled substance or marijuana during the performance of the contract.

W. NONDISCRIMINATION OF CONTRACTORS : A bidder, offeror, or contractor shall not be discriminated against in the solicitation or award of this contract because of race, religion, color, sex, national origin, age, disability, faith-based organizational status, any other basis prohibited by state law relating to discrimination in employment or because the offeror employs ex-offenders unless the state agency, department or institution has made a written determination that employing ex-offenders on the specific contract is not in its best interest. If the award of this contract is made to a faith-based organization and an individual, who applies for or receives goods, services, or disbursements provided pursuant to this contract objects to the religious character of the faith-based organization from which the individual receives or would receive the goods, services, or disbursements, the public body shall offer the individual, within a reasonable period of time after the date of his objection, access to equivalent goods, services, or disbursements from an alternative provider.

X. eVA BUSINESS-TO-GOVERNMENT VENDOR REGISTRATION , CONTRACTS, AND ORDERS : The eVA Internet electronic procurement solution, web site portal www.eVA.virginia.gov, streamlines and automates government purchasing activities in the Commonwealth. The eVA portal is the gateway for vendors to conduct business with state agencies and public bodies. All vendors desiring to provide goods and/or services to the Commonwealth shall participate in the eVA Internet e-procurement solution by completing the free eVA Vendor Registration. All bidders or offerors must register in eVA and pay the Vendor Transaction Fees specified below; failure to register will result in the bid/proposal being rejected.

Vendor transaction fees are determined by the date the original purchase order is issued and the current fees are as follows:

a. For orders issued July 1, 2014, and after, the Vendor Transaction Fee is:(i) DSBSD-certified Small Businesses: 1%, capped at $500 per order.(ii) Businesses that are not DSBSD-certified Small Businesses: 1%, capped at $1,500 per order.

b. Refer to Special Term and Condition “eVA Orders and Contracts” to identify the number of purchase orders that will be issued as a result of this solicitation/contract with the eVA transaction fee specified above assessed for each order.

For orders issued prior to July 1, 2014, the vendor transaction fees can be found at www.eVA.virginia.gov.

The specified vendor transaction fee will be invoiced, by the Commonwealth of Virginia Department of General Services, typically within 60 days of the order issue date. Any adjustments (increases/decreases) will be handled through purchase order changes.

Y. AVAILABILITY OF FUNDS: It is understood and agreed between the parties herein that the agency shall be bound hereunder only to the extent of the funds available or which may hereafter become available for the purpose of this agreement.



http://www.eVA.virginia.gov/

Z. SET-ASIDES IN ACCORDANCE WITH THE SMALL BUSINESS ENHANCEMENT AWARD PRIORITY: This solicitation is set-aside for award priority to DSBSD-certified micro businesses or small businesses when designated “Micro Business Set-Aside Award Priority” or “Small Business Set-Aside Award Priority” accordingly in the solicitation. DSBSD-certified micro business or small businesses this include DSBSD-certified women-owned and minority-owned businesses when they have received the DSBSD small business certification. For purposes of award, bidders/offerors shall be deemed micro businesses or small businesses if and only if they are certified as such by DSBSD on the due date for receipt of bids/proposals.

AA. PRICE CURRENCY: Unless stated otherwise in the solicitation, offerors shall state offered prices in US dollars.

BB. AUTHORIZATION TO CONDUCT BUSINESS IN THE COMMONWEALTH : A contractor organized as a stock or nonstock corporation, limited liability company, business trust, or limited partnership or registered as a registered limited liability partnership shall be authorized to transact business in the Commonwealth as a domestic or foreign business entity if so required by Title 13.1 or Title 50 of the Code of Virginia or as otherwise required by law. Any business entity described above that enters into a contract with a public body pursuant to the Virginia Public Procurement Act shall not allow its existence to lapse or its certificate of authority or registration to transact business in the Commonwealth, if so required under Title 13.1 or Title 50, to be revoked or cancelled at any time during the term of the contract. A public body may void any contract with a business entity if the business entity fails to remain in compliance with the provisions of this section.

VII. SPECIAL TERMS AND CONDITIONS

The following Special Terms and Conditions will be incorporated into any contract resulting from this solicitation. If an Offeror includes any other terms and conditions in its proposal, the VCCS reserves the right to accept or reject any such terms and conditions, to modify them through the negotiation process, and/or to consider those in the evaluation scoring of the proposals.

1. AUDIT : The contractor shall retain all books, records, and other documents relative to this contract for five (5) years after final payment, or until audited by the Commonwealth of Virginia, whichever is sooner. The agency, its authorized agents, and/or state auditors shall have full access to and the right to examine any of said materials during said period.

2. CANCELLATION OF CONTRACT : The purchasing agency reserves the right to cancel and terminate any resulting contract, in part or in whole, without penalty, upon 60 days written notice to the contractor. In the event the initial contract period is for more than 12 months, the resulting contract may be terminated by either party, without penalty, after the initial 12 months of the contract period upon 60 days written notice to the other party. Any contract cancellation notice shall not relieve the contractor of the obligation to deliver and/or perform on all outstanding orders issued prior to the effective date of cancellation.

3. RENEWAL OF CONTRACT: Design, development, and implementation of the contracted solution should be completed within the original term of the contract. Upon completion and final acceptance of the contracted solution, renewal may be considered by the Commonwealth upon written agreement of both parties, under the terms of the current contract, and at a reasonable time (approximately 90 days) prior to the expiration for those components necessary to operate, support, license, and maintain the implemented solution. Renewals may be proposed by the agency provided the system continues to be functional and is of benefit to the Agency. Any renewed contract term shall include annual licensing, ongoing support and maintenance, any system and/or software upgrades, and any newly developed modules or enhancements to the core product. Any and all components may be made available to the VCCS at a negotiated discount off of prevailing list price.

4. PRICE ESCALATION / DE-ESCALATION: Discounts are to be considered the minimum for the entire term of the resulting contract. Prices may be negotiated on an annual basis only at the time of renewal. Price



adjustments and/or discount adjustments may be permitted for changes in the contractor's cost of materials or services. The Consumer Price Index and the Producer Price Index of the United States Department of Labor, Bureau of Labor Statistics will be used by the Commonwealth as a guide in reviewing any Rate/Price increase requests. Price escalation may be authorized annually only at the time of contract renewal and only where verified to the satisfaction of the purchasing office. However, "across the board" price decreases are subject to implementation at any time and shall be immediately conveyed to the Commonwealth.

5. eVA ORDERS AND CONTRACTS : The solicitation/contract will result in one or more purchase order(s) with the applicable eVA transaction fee assessed for each order.

Vendors desiring to provide goods and/or services to the Commonwealth shall participate in the eVA Internet e-procurement solution and agree to comply with the following: If this solicitation is for a term contract, failure to provide an electronic catalog (price list) or index page catalog for items awarded will be just cause for the Commonwealth to reject your bid/offer or terminate this contract for default. The format of this electronic catalog shall conform to the eVA Catalog Interchange Format (CIF) Specification that can be accessed and downloaded from www.eVA.virginia.gov. Contractors should email Catalog or Index Page information to [email protected]

6. SMALL BUSINESS SUBCONTRACTING AND EVIDENCE OF COMPLIANCE :

1. It is the goal of the Commonwealth that 42% of its purchases be made from small businesses. This includes discretionary spending in prime contracts and subcontracts. All bidders/offerors are required to submit a Small Business Subcontracting Plan. Unless the bidder/offeror is registered as a DSBSD-certified small business and where it is not practicable for any portion of the awarded contract to be subcontracted to other suppliers, the contractor is encouraged to offer such subcontracting opportunities to DSBSD-certified small businesses. This shall include DSBSD-certified women-owned and minority-owned businesses when they have received DSBSD small business certification. No bidder/offeror or subcontractor shall be considered a small business unless certified as such by the Department of Small Business and Supplier Diversity (DSBSD) by the due date for receipt of bids or proposals. If small business subcontractors are used, the prime contractor agrees to report the use of small business subcontractors by providing the purchasing office at a minimum the following information: name of small business with the DSBSD certification number, phone number, total dollar amount subcontracted, category type (small, women-owned, or minority-owned), and type of product/service provided.

2. Each prime contractor who wins an award in which a small business subcontracting plan is a condition of the award, shall deliver to the contracting agency or institution on an annual basis, evidence of compliance (subject only to insubstantial shortfalls and to shortfalls arising from subcontractor default) with the small business subcontracting plan. Upon completion of the contract, the contractor agrees to furnish the purchasing office at a minimum the following information: name of firm with the DSBSD certification number, phone number, total dollar amount subcontracted, category type (small, women-owned, or minority-owned), and type of product or service provided. Payment(s) may be withheld until compliance with the plan is received and confirmed by the agency or institution. The agency or institution reserves the right to pursue other appropriate remedies for non-compliance to include, but not be limited to, termination for default.

3. Each prime contractor who wins an award valued over $200,000 shall deliver to the contracting agency or institution on an annual basis, information on use of subcontractors that are not DSBSD-certified small businesses. Upon completion of the contract, the contractor agrees to furnish the purchasing office at a minimum the following information: name of firm, phone number, total dollar amount subcontracted, and type of product or service provided.

7. PRIME CONTRACTOR RESPONSIBILITIES : The contractor shall be responsible for completely supervising and directing the work under this contract and all subcontractors that he may utilize, using his best skill and attention. Subcontractors who perform work under this contract shall be responsible to the prime contractor. The



mailto:[email protected]

mailto:[email protected]

contractor agrees that he is as fully responsible for the acts and omissions of his subcontractors and of persons employed by them as he is for the acts and omissions of his own employees.

8. SUBCONTRACTS : No portion of the work shall be subcontracted without prior written consent of the purchasing agency. In the event that the contractor desires to subcontract some part of the work specified herein, the contractor shall furnish the purchasing agency the names, qualifications and experience of their proposed subcontractors. The contractor shall, however, remain fully liable and responsible for the work to be done by its subcontractor(s) and shall assure compliance with all requirements of the contract.

9. INDEMNIFICATION : Contractor agrees to indemnify, defend and hold harmless the Commonwealth, agency, their officers, directors, agents and employees (collectively, “Commonwealth’s Indemnified Parties”) from and against any and all losses, damages, claims, demands, proceedings, suits and actions, including any related liabilities, obligations, losses, damages, assessments, fines, penalties (whether criminal or civil), judgments, settlements, expenses (including attorneys’ and accountants’ fees and disbursements) and costs (each, a “Claim” and collectively, “Claims”), incurred by, borne by or asserted against any of Commonwealth’s Indemnified Parties to the extent such Claims in any way relate to, arise out of or result from: (i) any intentional or willful misconduct or negligence of any employee, agent, or Subcontractor of Contractor, (ii) any act or omission of any employee, agent, or Subcontractor of Contractor, (iii) breach of any representation, warranty or covenant of Contractor contained herein, (iv) any defect in the Application or the Licensed Services, (v) any actual or alleged infringement or misappropriation of any third party’s intellectual property rights by the Application or any of the Licensed Services, or (vi) loss of Content provided to Contractor due to Contractor’s failure to back up Content in accordance with the Contract. Selection and approval of counsel and approval of any settlement shall be accomplished in accordance with all applicable laws, rules and regulations. For state agencies the applicable laws include §§ 2.2-510 and 2.2-514 of the Code of Virginia. In all cases the selection and approval of counsel and approval of any settlement shall be satisfactory to the Commonwealth.

In the event that a Claim is commenced against any of Commonwealth’s Indemnified Parties alleging that use of the Application or that the provision of Licensed Services under this Contract infringes any third party’s intellectual property rights, and Contractor is of the opinion that the allegations in such Claim in whole or in part are not covered by this indemnification provision, Contractor shall immediately notify Agency in writing, via certified mail, specifying to what extent Contractor believes it is obligated to defend and indemnify under the terms and conditions of this Contract. Contractor shall in such event protect the interests of the Commonwealth’s Indemnified Parties and secure a continuance to permit to appear and defend their interests in cooperation with Contractor as is appropriate, including any jurisdictional defenses Agency may have.

In the event of a Claim pursuant to any actual or alleged infringement or misappropriation of any third party’s intellectual property rights by the Application or any of the Licensed Services, and in addition to all other obligations of Contractor in this Section, Contractor shall at its expense, either (a) procure for the agency and its Application Users the right to continue use of such infringing Application or Licensed Services, or any component thereof; or (b) replace or modify such infringing Application or Licensed Services, or any component thereof, with non-infringing products or services satisfactory to Agency. And in addition, Contractor shall provide any Participating Agency with a comparable temporary replacement Application or reimburse Agency for the reasonable costs incurred by Agency in obtaining an alternative product or service in the event such Agency cannot use the affected Application. If Contractor cannot accomplish any of the foregoing within a reasonable time and at commercially reasonable rates, then Contractor shall accept the return of the infringing component of the Application or Licensed Services, along with any other components of any products rendered unusable by any Agency as a result of the infringing component, and refund the price paid to Contractor for such components.

10. STATE CORPORATION COMMISSION IDENTIFICATION NUMBER: Pursuant to Code of Virginia, §2.2-4311.2 subsection B, a offeror organized or authorized to transact business in the Commonwealth pursuant to Title 13.1 or Title 50 is required to include in its bid or proposal the identification number issued to it by the State Corporation Commission (SCC). Any offeror that is not required to be authorized to transact business in the



Commonwealth as a foreign business entity under Title 13.1 or Title 50 or as otherwise required by law is required to include in its bid or proposal a statement describing why the offeror is not required to be so authorized. Indicate the above information on the SCC Form provided. Contractor agrees that the process by which compliance with Titles 13.1 and 50 is checked during the solicitation stage (including without limitation the SCC Form provided) is streamlined and not definitive, and the Commonwealth’s use and acceptance of such form, or its acceptance of Contractor’s statement describing why the offeror was not legally required to be authorized to transact business in the Commonwealth, shall not be conclusive of the issue and shall not be relied upon by the Contractor as demonstrating compliance.

11. CONTRACT CLOSEOUT : Prior to the Contract’s expiration date, Contractor may be provided Contract close out documentation and shall complete, sign and return to the agency within 30 days of receipt. This documentation may include, but not be limited to: Patent/Royalty Certificate, Tangible Property/Asset Certificate, Escrow Certificate, SWaM Reports, Completion Certificate, Sales Reports/IFA Payments Completion Certificate, and Final Payment Certificate. Contractor is required to process these as requested to ensure completion of close-out administration and to maintain a positive performance reputation with the Commonwealth of Virginia. Any closeout documentation not received within 30 days of Contractor’s receipt of our request will be documented in the Contract file as Contractor non-compliance. Contractor’s non-compliance may affect any pending payments due the Contractor, including final payment, until the documentation is returned.

12. IMPORT / EXPORT : In addition to compliance by Contractor with all export laws and regulations, the agency requires that any data deemed “restricted” or “sensitive” by either federal or state authorities, must only be collected, developed, analyzed, or otherwise used or obtained by persons or entities working within the boundaries of the United States. Unless otherwise specified in an applicable scope of work, the application and licensed services shall be provided and all content stored by Contractor on servers, storage or nodes physically located in the continental United States

13. INSURANCE (SECURITY) : In addition to the insurance coverage required by law, Contractor shall carry:

Errors and omissions insurance coverage in the amount of $2,000,000 per occurrence.

Cyber Security Liability insurance coverage in the amount of $2,000,000 per occurrence.

14. SCALABILITY : The agency may make a written request to increase or decrease the scope (e.g., number of USERIDs) of Licensed Services (“revised usage”) under a statement of work or charter. The revised usage shall be effective as specified in the service levels agreed to. Pricing for the revised usage of licensed services shall be calculated as provided, and shall be prorated on a daily basis for remaining portion of the current monthly billing period.

15. ACCEPTABLE USE POLICY : In the event of conflict between this Contract and any Acceptable Use Policy (AUP), the Contract shall control.

16. RIGHT TO AUDIT : VCCS retains the right to monitor and revoke any activity related to VCCS assets. VCCS retains the right to audit responsibilities defined in any resulting contract or agreement, to have those audits carried out by a third-party, and to enumerate the statutory rights of auditors.

17. CONFIDENTIALITY OF PERSONALLY IDENTIFIABLE INFORMATION: The contractor assures that information and data obtained as to personal facts and circumstances related to patients or clients will be collected and held confidential, during and following the term of this agreement, and unless disclosure is required pursuant to court order, subpoena or other regulatory authority, will not be divulged without the individual’s and the agency’s written consent and only in accordance with federal law or the Code of Virginia. Contractors who utilize, access, or store personally identifiable information as part of the performance of a contract are required to safeguard this information and immediately notify the agency of any breach or suspected breach in the security of



such information. Contractors shall allow the agency to both participate in the investigation of incidents and exercise control over decisions regarding external reporting. Contractors and their employees working on this project may be required to sign a confidentiality statement.

Contractor shall comply with federal laws and regulations including, but not limited to:

• The Privacy Act of 1974• Computer Matching and Privacy Protection Act of 1988• E-Government Act of 2002• Us Internal Revenue Service (IRS) 1075 “Tax Information Security Guidelines for Federal, State, and

Local Agencies• National Institute of Standards and Technology (NIST) Guide for Protecting PII

Contractor shall comply with state laws and regulations including, but not limited to:

• Code of VA Title 59.1 Trade and Commerce – Chapter 35 –Personal Information Privacy Act• Virginia Department of Human Resources Management Policy 6.05 – Personnel Records Disclosure • The Code of Virginia §2-2.2009

18. CONFIDENTIALITY – EXCLUSIONS: The term “Confidential Information” shall not include information that is:

i. in the public domain through no fault of the receiving Party or of any other person or entity that is similarly contractually or otherwise obligated;

ii. obtained independently from a third-party without an obligation of confidentiality to the disclosing Party and without breach of this Contract;

iii. developed independently by the receiving Party without reference to the Confidential Information of the other Party; or

iv. required to be disclosed under The Virginia Freedom of Information Act (§§2.2-3700 et seq. of the Code of Virginia) or similar laws or pursuant to a court order.

19. RETURN OR DESTRUCTION : Upon the termination or expiration of this Contract or upon the earlier request of the agency, Contractor shall (i) at its own expense, (a) promptly return to the agency all tangible Confidential Information (and all copies thereof except the record required by law), or (b) upon written request, destroy such Confidential Information and provide the agency with written certification of such destruction, and (ii) cease all further use of the agency’s confidential information, whether in tangible or intangible form.

The agency shall retain and dispose of Contractor’s Confidential Information in accordance with the Commonwealth of Virginia’s records retention policies or, if Participating Agency is not subject to such policies, in accordance with such Participating Agency’s own records retention policies.

20. TESTING AND INSPECTION: The agency reserves the right to conduct any test, inspection, and/or audit it may deem advisable to assure goods and services conform to the specifications.

21. OWNERSHIP OF INTELLECTUAL PROPERTY : All copyright and patent rights to all papers, reports, forms, materials, creations, or inventions created or developed in the performance of this contract shall become the sole property of the Commonwealth. On request, the contractor shall promptly provide an acknowledgment or assignment in a tangible form satisfactory to the Commonwealth to evidence the Commonwealth’s sole ownership of specifically identified intellectual property created or developed in the performance of the contract.



22. THIRD PARTY ACQUISITION OF SOFTWARE : The contractor shall notify the procuring agency in writing should the intellectual property, associated business, or all of its assets be acquired by a third party. The contractor further agrees that the contract’s terms and conditions, including any and all license rights and related services, shall not be affected by the acquisition. Prior to completion of the acquisition, the contractor shall obtain, for the Commonwealth’s benefit and deliver thereto, the assignee’s agreement to fully honor the terms of the contract.

23. BANKRUPTCY : If Contractor becomes insolvent, takes any step leading to its cessation as a going concern, fails to pay its debts as they become due, or ceases business operations continuously for longer than fifteen (15) business days, then the agency may immediately terminate this Contract on notice to Contractor unless Contractor immediately gives such agency adequate assurance of the future performance of this Contract or the applicable order. If bankruptcy proceedings are commenced with respect to Contractor, and if this Contract has not otherwise terminated, then the agency may suspend all further performance of this Contract until Contractor assumes this Contract and provides adequate assurance of performance thereof or rejects this Contract pursuant to Section 365 of the Bankruptcy Code or any similar or successor provision, it being agreed by the agency and Contractor that this is an executory Contract. Any such suspension of further performance by the agency pending Contractor’s assumption or rejection shall not be a breach of this Contract, and shall not affect the rights of the agency to pursue or enforce any of its rights under this Contract or otherwise.

24. TERMINATION FOR CONVENIENCE : The agency may terminate this Contract, in whole or in part, or any purchase order or scope of work issued hereunder, in whole or in part, upon not less than thirty (30) days prior written notice at any time for any reason. In addition, the agency may immediately terminate this Contract, in whole or in part, or any order issued hereunder, if Contractor becomes a party excluded from Federal Procurement and Non-procurement Programs. The agency will provide written notice to Contractor of such termination, and Contractor shall provide prompt written notice to the agency if federal debarment proceedings are instituted against Contractor.

25. TERMINATION FOR BREACH OR DEFAULT : Agency shall have the right to terminate this Contract, in whole or in part, or any order or SOW issued hereunder, in whole or in part, or a Participating Agency may terminate an order or SOW, in whole or in part, for breach and/or default of Contractor. Contractor shall be deemed in breach and/or default in the event that Contractor fails to meet any material obligation set forth in this Contract or in any order or SOW issued hereunder.

26. TERMINATION FOR NON-APPROPRIATION OF FUNDS : All payment obligations under this Contract are subject to the availability of legislative appropriations at the federal, state, or local level, for this purpose. In the event of non-appropriation of funds, irrespective of the source of funds, for the items under this Contract, agency may terminate any order or SOW, in whole or in part, for those goods or services for which funds have not been appropriated. Written notice will be provided to the Contractor as soon as possible after legislative action is completed.

27. EFFECT OF TERMINATION FOR APPLICATION AND LICENSED SERVICES : Upon termination, neither the Commonwealth, nor agency shall have any future liability except for Licensed Services rendered or Application components delivered by Contractor prior to the termination date.

In the event of a Termination for Breach or Termination for Default, the affected agency shall not be liable for any cost related to the terminated Contract, purchase order, SOW, or portion thereof. Contractor shall accept return of any products or software provided to the affected agency, and Contractor shall refund any monies paid the agency for Licensed Services not accepted pursuant to the Contract, purchase order, SOW, or portion thereof terminated for breach and/or default. All costs of de-installation and return of product or software shall be borne by Contractor. Contractor shall be paid for all portions of goods and services delivered prior to the date of any termination, cancellation, or expiration of the Contract.



In the event of termination, cancellation or expiration of the Contract by either party, and for any reason, Contractor agrees to deliver to the agency a copy of the source code underlying the solution and all relevant documentation, in English, to enable the agency, or its designee, to maintain, upgrade and operate the product and services. In addition, the parties will use commercially reasonable efforts, in accordance with applicable law, to effect an orderly conversion and transfer of End User Data to Authorized User. Authorized User will be able to use the source code, documentation and End User Data for purposes of maintaining, upgrading, and operating the product and services outlined in the Contract, Statement of Work or Charter.

VIII. CONTENT PRIVACY AND SECURITY

1. Contractor shall provide a secure environment for Content and any hardware and software, including servers, network and data components provided by Contractor as part of its performance under this Contract. Contractor shall provide a secure environment for Content and any hardware and software in accordance with VITA’s Security Standards located at: http://www.vita.virginia.gov/library /default.aspx?id=537#securityPSGs in order to prevent unauthorized access to and use or modification of, and to protect, the Application and Content. Contractor agrees that all Content of the Agency is intended solely for the business of the agency and is considered private data. Therefore, Contractor shall, at a minimum, implement the following procedures designed to protect the privacy and security of Content:

i). User identification and access controls designed to limit access to Content to Application Users;

ii). External connections to the World Wide Web which will have appropriate security controls including industry standard intrusion detection and countermeasures that will detect and terminate any unauthorized activity prior to entering the firewall maintained by Contractor;

iii). Industry standard firewalls regulating all data entering Contractor’s internal data network from any external source which will enforce secure connections between internal and external systems and will permit only specific types of data to pass through;

iv). Industry standard encryption techniques which will be used when Content is transmitted by Contractor on behalf of the agency;

v). Physical security measures, including securing all Content on a secure server, in locked data cabinets within a secure facility located within the United States. Access to facilities housing the Application and Content restricted to only allow access to personnel and agents of Contractor who have a need to know in connection with operation and support of the Application;

vi). A backup of Content, for an orderly and timely recovery of such data in the event that the Licensed Services may be interrupted. Unless otherwise described in a Statement of Work, Service Provider shall maintain a backup of Content that can be recovered as per the stated Service Levels. Additionally, Service Provider shall store a backup of Customer Data in an off-site “hardened” facility, located within the United States no less than daily, maintaining the security of Customer Data, the security requirements of which are further described herein.

vii). Contractor agrees to maintain and follow a disaster recovery plan designed to maintain Application User access to the Application and Licensed Services, and to prevent the unintended destruction or loss of Content; and which plan, unless otherwise specified herein, shall provide for daily back-up of Content and archival of such Content at a secure facility located within the United States. The disaster recovery plan shall provide for and be followed by Contractor such that in no event shall the Application, Licensed Services, Contractor Product and/or Content be



unavailable to any Application User for a period in excess of twenty-four (24) to seventy-two (72) hours;

viii). Contractor agrees that during the term of this Contract, Contractor will retain the agency’s Content for the full term of the Contract.

ix). Contractor, its employees, agents and Subcontractors, shall immediately notify the agency, of any degradation, potential breach or breach of Content and Application privacy or security in any systems supporting the Licensed Services. Contractor shall provide the agency the opportunity to participate in the investigation of the reported situation and to exercise control over reporting the unauthorized disclosure, to the extent permitted by law.

x). Contractor shall be required to notify the agency in writing thirty (30) days prior to its intention to replace or add any third-party that will be provided access to Content whether that access is provided by Contractor or Contractor’s Subcontractors. The agency may reject any additional or new third parties who may be provided access to Content.

xi). Contractor shall, at all times, remain compliant with the privacy and security requirements mandated by federal, state and local laws and regulations.

xii). Contractor shall ensure performance of a SOC2 Type II audit (or equivalent) at least once annually of Contractor's environment. Upon request from the agency (not more than once annually), Contractor shall provide the agency with a copy of Contractor’s final SOC2 Type II audit report. Contractor shall also assist VITA in obtaining the current SOC2 Type II audit report from any third-party providing services to Contractor, if said third-party services involve the processing or storage of Participating Agency’s’ Content.

xiii). Contractor’s failure to comply with the provisions in items (i) through (xii) shall constitute a breach of this Contract.

xiv). Within fifteen (15) business days after the expiration or termination of this Contract, Contractor shall confirm in writing to the agency that all Content has been removed from all systems where the Content resided during performance of this Contract in a manner that complies with and/or exceeds the Commonwealth Data Removal standard located at the then-current data removal standard: ITRM standard SEC 514-04. The written confirmation shall include (i) sufficient detail describing the processes and procedures used in removing the Content, (ii) information about the locations of where it was removed from within the Application and storage and other locations, and (ii) the date the removals were performed. All metadata, in its original form, shall be returned to the respective Participating Agency(s).

xv). Any Participating Agency of this Contract agrees to notify Contractor of any degradation, potential breach, or breach of the Content and Application privacy or security as soon as possible after discovery. Any Participating Agency further agrees to provide Contractor the opportunity to participate in the investigation of the reported situation.

xvi). Regular training for Contractor personnel regarding the security and data recovery programs referenced in this Section;

xvii). Regular testing of the systems and procedures outlined in this Section; and

xviii). Audit controls that record and monitor Application and Licensed Services activity continuously.



2. SECURITY COMPLIANCE

Contractor agrees to comply with all provisions of the then-current Commonwealth of Virginia security procedures, published by the Virginia Information Technologies Agency (VITA) and which may be found at (http://www.vita.virginia.gov/library/default.aspx?id=537#securityPSGs ) or a successor URL(s), as are pertinent to Contractor's operation. Contractor further agrees to comply with all provisions of the relevant agency’s then-current security procedures as are pertinent to Contractor’s operation and which have been supplied to Contractor. Contractor shall also comply with all applicable federal, state and local laws and regulations. For any individual agency location, security procedures may include but not be limited to: background checks, records verification, photographing, and fingerprinting of Contractor’s employees or agents. Contractor may, at any time, be required to execute and complete, for each individual Contractor employee or agent, additional forms which may include non-disclosure agreements to be signed by Contractor’s employees or agents acknowledging that all agency information with which such employees and agents come into contact while at the agency site is confidential and proprietary. Any unauthorized release of proprietary or personal information by the Contractor or an employee or agent of Contractor shall constitute a breach of its obligations under this Section and the Contract.

Contractor shall immediately notify the agency of any Breach of Unencrypted and Unredacted Personal Information, as those terms are defined in Virginia Code 18.2- 186.6, and other personal identifying information, such as insurance data or date of birth, provided by the agency to Contractor. Contractor shall provide the agency the opportunity to participate in the investigation of the Breach and to exercise control over reporting the unauthorized disclosure, to the extent permitted by law.

Contractor shall indemnify, defend, and hold the Commonwealth, Agency, their officers, directors, employees and agents harmless from and against any and all fines, penalties (whether criminal or civil), judgments, damages and assessments, including reasonable expenses suffered by, accrued against, or charged to or recoverable from the Commonwealth, Agency, their officers, directors, agents or employees, on account of the failure of Contractor to perform its obligations pursuant this Section.

Agency shall have the right to review Contractor’s information security program prior to the commencement of Licensed Services and from time to time during the term of any resulting contract or agreement. During the performance of the Licensed Services, on an ongoing basis from time to time, Agency shall be entitled to perform, or to have performed, an on-site audit of Contractor’s information security program. In lieu of an on-site audit, upon request by Agency, Contractor agrees to complete, within forty-five (45 days) of receipt, an audit questionnaire provided by Agency regarding Contractor’s information security program. Contractor shall implement any reasonably required safeguards as identified by any program audit.

IX. GENERAL WARRANTY

Contractor warrants and represents to the agency the Licensed Services and the Application described as follows:

1. Ownership Contractor has the right to provide the Licensed Services, including access by the agency and its application users, without violating or infringing any law, rule, regulation, copyright, patent, trade secret or other proprietary right of any third party.

2. Licensed Services, Application, and Documentation Contractor warrants the following with respect to the Licensed Services and the Application:



i). Contractor represents and warrants (i) that it shall perform the Licensed Services in conformity to the specifications set forth in a professional and workmanlike manner and (ii) that the Licensed Services shall not infringe any third party proprietary rights including (without limitation) any trademark, trade name, trade secret, copyright, moral rights, patents or similar intellectual property rights.

ii). Contractor warrants that the Application and Licensed Services will conform in all material respects to the requirements set forth in this solicitation, any resulting contract, purchase order, or scope of work issued hereunder. Contractor warrants that the Application Licensed Services will conform to the applicable specifications and documentation, not including any post-acceptance modifications or alterations to the documentation which represent a material diminishment of the functionality of the Application, Licensed Services or contractor product. Contractor also warrants that such Application and Licensed Services are compatible with and will operate successfully when used on the equipment in accordance with the documentation and all of the terms and conditions hereof.

iii). The Application provided hereunder is at the current release level unless the agency specifies an older version in its order;

iv). No corrections, work-arounds or future Application releases provided by Contractor shall degrade the Application, cause any other warranty to be breached, or require the agency to acquire additional hardware equipment or software;

v). Contractor warrants that all post-acceptance updates, changes, alterations or modifications to the Application, Licensed Services and documentation by Contractor will be compatible with, and will not materially diminish the features or functionality of the Application, Licensed Services and/or contractor product when used on the equipment in accordance with the documentation and all of the terms and conditions hereof.

vi). Contractor warrants that the documentation and all modifications or amendments thereto which Contractor is required to provide under any resulting contract shall be sufficient in detail and content to allow a user to understand and utilize fully the Application without reference to any other materials or information.

3. Data Use and Ownership VCCS data remains the property of the VCCS, college, or organization for which the data was created. VCCS data may not be used for any purpose other than that for which it was collected except when used in aggregate by the VCCS or other authorized entity without personally identifiable information. At the end of any contract period or in the event of termination of the any contract or agreement by either party the contractor shall transfer all data back to the VCCS in machine readable or other agreed to format. The contractor shall destroy all remaining copies of the data upon confirmation from the VCCS that the original data has been verified and archived or transferred successfully to an alternate processing system

4. Malicious Code Contractor has used its best efforts through quality assurance procedures to ensure that there are no computer viruses or undocumented features in the Application accessed by the agency or its application users; and the Application does not contain any embedded device or code (e.g., time bomb) that is intended to obstruct or prevent any use of or access to the Application.. Notwithstanding any rights granted under any resulting contract, agreement, purchase order, or scope of work or at law, Contractor hereby waives under any and all circumstances any right it may have or may hereafter have to exercise Electronic Self-Help or Acceptance Use Policy. Contractor agrees that the agency may pursue all remedies provided under law in the event of a breach or threatened breach of this Section, including injunctive or other equitable relief.

5. Privacy and Security



Contractor warrants that Contractor and its employees, Subcontractors, partners and third party providers have taken all necessary and reasonable measures to ensure that the Application, Licensed Services, contractor product, and any related deliverables do not include any degradation, known security vulnerabilities, or breach of privacy or security. Contractor agrees to notify the agency of any occurrence of such as soon as possible after discovery and provide the agency with fixes or upgrades for security vulnerabilities within 90 days of discovery.

6. Operating System and Software Supportability Contractor warrants that Contractor and its employees, Subcontractors, partners and third party providers have taken all necessary and reasonable measures to ensure that the Application, Licensed Services, contractor product, and any deliverables do not have dependencies on other operating systems or software that are no longer supported by Contractor, or its Subcontractors, partners and third-party providers.

7. Access to Product and Passwords Contractor warrants that the Application and Licensed Services do not contain disabling code or any program device or other undisclosed feature, including but not limited to, viruses, worms, trojan horses, or other code which is designed to permit unauthorized access, delete, disable, deactivate, interfere with or otherwise harm the Application, Licensed Services or the hardware or software of the agency or its application users. In addition, Contractor warrants that the agency and its application users will be provided commercially reasonable uninterrupted access to the Application. Contractor also warrants that it will not cancel or otherwise terminate access to the Application by disabling passwords, keys or tokens that enable continuous use of the Application by the agency and its application users during the term of any Contract or any purchase order or scope of work issued hereunder. Contractor further warrants that the Application and Licensed Services are compatible with and will operate successfully on the equipment.

8. Open Source Contractor will notify the agency if the Application contains any Open Source code.

9. Contractor’s Viability Contractor warrants that it has the financial capacity to perform and continue to perform its obligations under this Contract; that Contractor has no constructive or actual knowledge of any potential legal proceeding being brought against Contractor that could materially adversely affect performance of any resulting contract, purchase order or scope of work, and that entering into a Contract is not prohibited by any Contract, or order by any court of competent jurisdiction.

10. Contractor’s Past Experience Contractor warrants that Contractor has provided the Licensed Services to a non-related third party customer of Contractor without significant problems due to the Licensed Services, the Application, or Contractor.

11. Vulnerability Testing The security perimeter must be penetration tested on an annual basis by an independent third party for both infrastructure and application vulnerabilities. The hosted application must be tested for vulnerabilities during all stages of the quality assurance and testing processes before, during, and after deployment. Operating system and application platform software (middleware) must be tested for vulnerabilities on an ongoing basis to detect newly identified technical vulnerabilities

12. Certification Contractor must provide a copy of an independent security audit of the hosting facility attesting to the compliance of the facility with all applicable information security standards referenced in the agreement.



THE OBLIGATIONS OF CONTRACTOR UNDER THIS GENERAL WARRANTY SECTION ARE MATERIAL. CONTRACTOR MAKES NO OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY CONCERNING MERCHANTABILITY OR FITNESS FOR ANY OTHER PARTICULAR PURPOSE.

X. METHOD OF PAYMENT

Payments for any resulting contract will be made by the VCCS in Accordance with Article 4 of the Virginia Public Procurement Act, Article 4 “Prompt Payment” (Code of Virginia §2.2-4347 et. seq.)

Vendors shall submit proper invoices to the billing address indicated on the eVA purchase order.

XI. PRICING SCHEDULE

The offeror shall provide a proposed pricing schedule to include pricing for the specific work identified in the Statement of Needs section and identify any associated deliverable(s) if applicable. Pricing schedule may be submitted with appropriate line item detail, however, a firm price must be provided encompassing all fees, charges and deliverables.

Please provide pricing for design, development, and implementation of the proposed solution. Provide separate detailed pricing structure for annual licensing, ongoing maintenance and support after implementation.

Any newly developed modules or enhancements to the core product may be made available to the VCCS at a negotiated discount off of prevailing list price.

Pricing MUST be submitted in a separate SEALED envelope. Only one copy of the pricing portion of the proposal is required.

XII. ORDERING PROCEDURES

The VCCS will issue any/all purchase orders through eVA.

The VCCS intends on issuing one purchase order for the specific work identified in the Statement of Needs annually. Separate purchase orders may be placed for annual renewals and ancillary needs.

XIII. ATTACHMENTS

The following attachments must be completed and submitted as part of the proposal.

1. Attachment 1 – Non-Disclosure Agreement

2. Attachment 2 - Vendor Data Sheet

3. Attachment 3 – State Corporation Commission Form

4. Attachment 4 – Proprietary and Confidential Information Form

5. Attachment 5 - Small Business Subcontracting Plan



The following attachments are informational and available for reference where applicable.

6. Attachment 6 – High Level Overview of VCCS Enterprise Systems and Services

7. Attachment 7 – VCCS Technical Standards

8. Attachment 8 - VCCS Interface Standards



Documents

Web viewRequest for Proposals. Issue Date:September 30, 2016. RFP Number: VCCS-ASR-17-124. Title:Online Admissions Application. Commodity Code:92003: Application Service