RFQ 17-317 IT Security Policy Enchancements

XAVIER BECERRA State of California
Attorney General DEPARTMENT OF JUSTICE
Request for Quotation

for Information Technology
Goods and/or Services
QUOTE DUE DATE: 04/23/2018 SOLICITATION # RFQ 17-317 REV. # _____
Quotes must be delivered by 10:00 AM PST on or before the due date.
Bidder name and address: Department Contact ARE YOU CLAIMING PREFERENCE
AS A SMALL BUSINESS?
Name: MaryLou Moreno YES ________ NO ________
IF YES, MANUFACTURER?
Email: marylou.moreno@doj.ca.gov YES ________ NO ________
Contact: Phone #: 916-210-5378 ARE YOU A NON-SMALL BUSINESS

CLAIMING AT LEAST 25% SMALL
Email: BUSINESS SUBCONTRACTOR
PREFERENCE?
Phone: YES ________ NO ________
Fax:
Name (Print): Return RFQ response SECTION 14838 ET SEQ. OF
THE CALIFORNIA
_______________________________ Bidder, clearly state on outside of each GOVERNMENT CODE
REQUIRES THAT A 5%
bid container:
PREFERENCE BE GIVEN TO
Title: BIDDERS WHO QUALIFY AS A
Department of Justice SMALL BUSINESS AS A NON-
_______________________________ Request for Quote 17-317 SMALL BUSINESS CLAIMING
ITCPU, Room D232 AT LEAST 25% CALIFORNIA
Signature: Bidder, please sign and date. 4949 Broadway CERTIFIED SMALL BUSINESS
Sacramento, CA 95820-1528 PARTICIPATION FOR
_______________________ Attention: MaryLou Moreno, 916-210-3258 REQUIREMENTS SEE TITLE 2,
CALIFORNIA CODE OF
REGULATIONS SECTION 1896
Date: ___________ Response to the RFQ administrative and ET SEQ. THE REQUIREMENTS
technical requirements must be FOR NONPROFIT VETERAN
Federal Employer Identification Number: submitted in a separate container from SERVICE AGENCIES
the RFQ Cost Sheet. QUALIFYING AS A SMALL
_______________________________ BUSINESS ARE CONTAINED IN
Each container must be sealed and SECTION 999.50 ET SEQ. OF
labeled with the contents RFQ 17-317 THE MILITARY AND
VETERANS CODE.
administrative, RFQ 17-317 technical
requirements or RFQ 17-317 Cost
Worksheet.
Bidder must notify the Department

Contact by phone or email that the bid
was delivered on or prior to the due date
and time.
Bidder, offers and agrees, if this response is accepted within 45 calendar days following the date the response is due to furnish all
the items upon which prices are quoted, at the prices set opposite each item, delivered at the designated point(s) by the method of
delivery and within the times specified and subject to the attached General Provisions. DECLARATIONS UNDER PENALTY OF
PERJURY; By signing above, with inclusion of the date of signature, the above signed bidder DECLARES UNDER
PENALTY OF PERJURY under the laws of the State of California as follows: (1) (STATEMENT OF COMPLIANCE). The
above signed as complied with the non-discrimination program requirements of Government Code 12990 and Title 2,
California Administrative Code Section 8103, and such declaration is true and correct. (2) The National Labor Relations
Board declaration set forth in Paragraph 48 of the General Provisions is true and correct. (3) If a claim is made for the
Small Business or Disabled Veterans Business preference, the information set forth within is true and correct.
By signing above, with inclusion of the date of signature, the above signed bidder accepts the terms and conditions
referenced in the description section below which may be viewed via the referenced links. These terms and conditions
are non-negotiable and no other terms and conditions will be accepted.
1 of 30
State of California RFQ 17-317
Department of Justice
DESCRIPTION
The purpose of this Request for Quote is to acquire consulting personnel with specialized expertise to assist the
Department of Justice (DOJ) in its’ efforts to conduct a thorough and complete review and analysis of existing
Information Technology (IT) security policies, standards, and procedures, coupled with determining areas of
vulnerability, incompleteness, or deficiency as it relates specifically to DOJ’s hardware, software, applications,
communications network and data. This effort will also include the development of new as well as the modification,
improvement, and refinement of existing policies, standards and procedures to further reduce risk and provide greater
levels of protection. In addition, the DOJ is seeking assistance in aligning its’ IT security policies with the National
Institute of Technology Cybersecurity Framework (NIST CSF) to enhance its’ ability to prevent, detect, and respond
to cyber-attacks.
Be advised, your response will become public record once the award becomes final. DOJ will provide access
to all records upon request unless the law provides an exemption from mandatory disclosure or a court
order is provided.
The following documents are attached and part of this solicitation: Exhibit A, Statement of Work and
Exhibit B, Cost Sheet.
The following documents are incorporated by reference and may be viewed at the website listed.
 Bidders Instructions (GSPD-451), Effective 11/09/11

http://www.documents.dgs.ca.gov/pd/modellang/GSPD451-110911.pdf
Note: Bidders Instructions, Item 21, Protests is not applicable to acquisitions less than $100,000. See RFQ,
Section VI, Award of Contract for applicable protest language.
 General Provisions-Information Technology (GSPD-401IT), Effective 9/5/14

http://www.documents.dgs.ca.gov/pd/poliproc/GSPD401IT14_0905.pdf
The electronic documentation shall not be altered in any manner. The State’s copy of the electronic
documentation developed for this RFQ, is for the purposes of issuing a binding contract, and shall be
considered the ORIGINAL.
2 of 30
You are invited to review and respond to this Request for Quote (RFQ) for goods and/or services, entitled
Department of Justice (DOJ) RFQ 17-317, IT Security Policy Enhancement Project. In submitting your
quote, you must comply with the instructions found herein. The goods and/or services required are
delineated in Exhibit A, Statement of Work (SOW). Please read the enclosed document carefully.
Quotes must be received no later than the date and time specified on the face of this RFQ and in the Key
Action Dates.
I. GENERAL INFORMATION
A. Purpose
The State of California, DOJ requires the services of a Contractor to provide consulting services in
support of the IT Security Policy Enhancement Project.
The IT Security Policy Enhancement Project addresses the need for a thorough and complete review
and analysis of existing IT security policies, standards, and procedures along with the evaluation and
assessment of these policies, standards and procedures to determine areas of vulnerability,
incompleteness, or deficiency as it relates specifically to DOJ’s hardware, software, applications,
communications network and data. This effort will also include the development of new as well as the
modification, improvement, and refinement of existing policies, standards and procedures. The
current budget for this engagement is $200,000.
B. Availability
The selected Contractor must be able to meet the requirements of this RFQ and be ready to begin
work within ten (10) business days of the contract award date specified in the Key Action Dates. If
personnel offered by the selected Contractor leave the contractor’s firm or are otherwise unable to
participate in this contract, they must be replaced with comparably qualified personnel who meet the
minimum qualifications as stated within this RFQ. All replacement personnel are subject to approval
by the State.
C. Travel
All travel costs for this contract will be the sole responsibility of the Vendor.
D. Background Check
The selected Contractor must submit and pass a DOJ fingerprint security background check. When
identifying resources in your response, you must provide their legal names to ensure an accurate
background investigation.
E. Proposed Resource
If your proposed resource(s) is working on another DOJ, Government (e.g. State, Federal, City, etc.)
or private sector contract, the attached proposed resource form must be completed and returned with
your bid.
F. Period of Performance
The term of this Agreement is estimated to begin on the date as indicated in the Key Action Dates
through May 30, 2019. The end date is an estimation and may be amended, if needed, after contract
award by mutual consent of both parties. All deliverables will begin before June 30, 2018.
The Contractor shall not be authorized to deliver or commence performance of goods and/or services
as described in the SOW until written approval has been obtained from all entities. No delivery or
performance of goods and/or services may commence prior to the execution of the contract.
3 of 30
G. Key Action Dates

Listed below are the Key Action Dates and times by which the actions must be taken or completed. If
the State finds it necessary to change the Submission of Quote date and any dates prior, it may be
accomplished via an addendum to this RFQ.
Key Action Dates Date

1. Release of RFQ 3/30/2018
2. Submission of written questions 4/10/2018 by
10:00 AM PST
3. Submission of Quotes 4/23/2018 by
10:00 AM PST
4. Interviews 4/26-5/1/2018
5. Notice of Intent to Award 5/7/2018
6. Estimated Contract Award (date PO is issued to Contractor) 5/14/2018

7. Estimated Contractor Start Date 5/21/2018
All dates after the Submission of Quotes (date and time) are approximate and may be changed if
needed without addendum to allow the State additional time for evaluation and contract execution.
H. Written Questions
All questions and concerns regarding the content of this RFQ must be submitted in writing by the Key
Action Date for submission of written questions. You must reference the section and page number
you are inquiring or concerned about. Questions must be submitted in writing via electronic mail to
the department contact listed on the RFQ cover page and must be received by the Key Action Date
identified above. Questions not submitted in writing by the Key Action Date for submission of written
questions shall be answered at the State’s option.
When the State has completed its review of the questions, the questions and answers will be posted
on the State’s Cal eProcure http://www.dgs.ca.gov/pd/Programs/caleprocure.aspx
I. Interviews
DOJ will request an interview from the top scoring vendor resources prior to contract award.
II. RFQ ADMINISTRATIVE REQUIREMENTS

The following documents must be submitted in the bidder’s RFQ response and are the Administrative
Requirements to be evaluated.
A. RFQ Cover Page – Bidder must complete, sign and return the State’s RFQ form (page 1) with
their response. The form shall be signed by an individual who is authorized to bind the bidding
firm contractually. The signature must indicate the title or position that the individual holds in
the company. AN UNSIGNED FINAL QUOTE SHALL BE REJECTED.
B. Payee Data Record, STD. 204 – Exhibit 1

Bidder’s are required to submit a Payee Data Record, STD. Form 204 listing their Taxpayer
Identification Number with their RFQ response.
C. Bidder Declaration Form, GSPD 05-105 – Exhibit 2

Bidder’s must complete the Bidder Declaration GSPD 05-105 and include with their RFQ
response. When completing the declaration, bidders must identify all subcontractors
proposed for participation in the contract. Bidders awarded a contract are contractually
obligated to use the subcontractors for the corresponding work identified unless the State
agrees to a substitution and it is incorporated by amendment to the contract.
4 of 30
D. Confidentiality Statement – Exhibit 3

The Confidentiality Statement must be signed and dated by the bidder, and submitted with
the bidder’s RFQ response. Once the contract is issued, DOJ may require the Contractor to
submit a Confidential Statement for each of its employees and subcontractor employees
working on this project during the term of the contract. Any approved substitutions made
during the term of the contract may also be required to sign a Confidentiality Statement.
E. Security and Disclosure Certification - Exhibit 4

As an authorized representative and/or corporate officer of the company, who has the
authority to bind the company, a Security and Disclosure Certification must be signed and
dated by the bidder, and submitted with the bidder’s RFQ response. Once the contract is
issued, DOJ may require the Contractor to submit a Security and Disclosure Certification for
each of its employees and subcontractor employees (including any substitutions and
additional staff) working on this project during the term of the contract.
F. CA Disabled Veteran Business Enterprise Requirement

For the purpose of this solicitation, the DVBE participation requirement was waived; however,
this solicitation does provide an incentive for DVBE participation.
G. DVBE PARTICIPATION – Exhibit 5

The State has established goals for DVBE participating in State contracts. The California
DVBE Program Requirements packet, Exhibit 5, includes information about the DVBE
incentive.
Bidders who have been certified by California as a DVBE (or who are bidding rental
equipment and have obtained the participation of subcontractors certified by California as a
DVBE) must also submit a completed form(s) STD. 843 (Disabled Veteran Business
Enterprise Declaration). All disabled veteran owners and disabled veteran managers of the
DVBE(s) must sign the form(s). Should the form not be included with the solicitation, contact
the State contracting official or obtain a copy online from the Department of General Services
Procurement Division, Office of Small Business and DVBE Services (OSDS) website at. The
completed form should be included with the bidder’s RFQ response.
DVBE Subcontractor
Contractor understands and agrees that should award of this contract be based in
part on their commitment to use the Disabled Veteran Business Enterprise (DVBE)
subcontractor(s) identified in their bid or offer, per Military and Veterans Code section
999.5 (e), a DVBE subcontractor may only be replaced by another DVBE
subcontractor and must be approved by the Department of General Services
(DGS). Changes to the statement of work that impact the DVBE subcontractor(s)
identified in the bid or offer and approved DVBE substitutions will be documented by
contract amendment.
Failure of Contractor to seek substitution and adhere to the DVBE participation level
identified in the bid or offer may be cause for contract termination, recovery of
damages under rights and remedies due to the State, and penalties as outlined in
M&VC section 999.9; Public Contract Code (PCC) section 10115.10.
5 of 30
Contract Audit
When a department awards a contract subject to participation goals in accordance with

Public Contract Code § 10115.2, the Contractor agrees that the awarding department or its
designee will have the right to review, obtain, and copy all records pertaining to performance
of the contract. Contractor agrees to provide the awarding department or its designee with
any relevant information requested and shall permit the awarding department or its designee
access to its premises, upon reasonable notice, during normal business hours for the
purpose of interviewing employees and inspecting and copying such books, records,
accounts, and other material that may be relevant to a matter under investigation for the
purpose of determining compliance with Public Contract Code §§ 10115 et seq. and §§
1896.60 et seq. of these regulations. Contractor further agrees to maintain such records for a
period of three (3) years after final payment under the contract.
H. TACPA CONTRACT PREFERENCE
NOTE TO BIDDER: The Bidder’s RFQ response need not contain the TACPA form if
there is no intention to claim this preference.
This solicitation contains the Target Area Contract Preference Act (TACPA) preference
request forms. Please carefully review the forms and requirements. If applying for this
preference, bidders must submit the preference request forms listed in the Attachments
section of this document. Denial of TACPA preference requests is not a basis for rejection of
the bid.
The State as part of its evaluation process reserves the right to verify, validate, and clarify all
information contained in the bid. This may include, but is not limited to, information from
bidders, manufacturers, subcontractors and any other sources available at the time of bid
evaluation. Bidder refusal to agree to and/or comply with these terms, or failure to provide
additional supporting information at the State’s request may result in the denial of the
preference requested.
Contracts awarded with applied preference will be monitored throughout the life of the contract
for compliance with statutory, regulatory, and contractual requirements. The State will take
appropriate corrective action and apply sanctions as necessary to enforce the preference
program.
Any questions regarding TACPA preference should be directed to the Department of General
Services, Procurement Division at Tacpa@dgs.ca.gov.
TACPA Standard Form 830

https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std830.pdf
Manufacturer’s Summary of Contract Activities and Labor Hours (Form DGS/PD 525)
https://www.documents.dgs.ca.gov/pd/dispute/mfgsum525.pdf
Bidder’s Summary of Contract Activities and Labor Hours (Form DGS/PD 526)
https://www.documents.dgs.ca.gov/pd/edip/bidsum526.pdf
I. SMALL BUSINESS REGULATIONS - The Small Business regulations, located in the

California Code of Regulations (Title 2, Division 2, Chapter 3, Subchapter 8, Section 1896 et.
seq.), concerning the application and calculation of the small business preference, small
business certification, responsibilities of small business, department certification, and appeals
are revised, effective 09/09/04. The new regulations can be viewed at
(www.pd.dgs.ca.gov/smbus). For those without Internet access, a copy of the regulations
can be obtained by calling the Office of Small Business and DVBE Services at (916) 375-
4940.
6 of 30
J. NON-SMALL BUSINESS SUBCONTRACTOR PREFERENCE - A 5% bid preference is

now available to a non-small business claiming 25% California certified small business
subcontractor participation. If applicable, claim the preference in the box on the RFQ cover
page.
K. SMALL BUSINESS NONPROFIT VETERAN SERVICE AGENCIES (SB/NVSA)

SB/NVSA prime bidders meeting requirements specified in the Military and Veterans Code
Section 999.50 et seq. and obtaining a California certification as a small business are eligible
for the 5% small business preference. If applicable, claim the preference in the box on the
RFQ cover page.
L. EXHIBIT WITH QUOTE REQUIRED IF CLAIMING THE SMALL BUSINESS

PREFERENCE- All bidders must complete and include the Bidder Declaration form GSPD
05-105. If claiming the non-small business subcontractor preference, the form must list all of
the California certified small businesses with which you commit to subcontract in an amount
of at least twenty-give percent (25%) of the net bid price. All certified small businesses must
perform a “commercially useful function” in the performance of the contract as defined in
Government Code Section 14837(d)(4).
http://www.documents.dgs.ca.gov/pd/delegations/GSPD105.pdf
M. SMALL BUSINESS CERTIFICATION - Bidders claiming the small business preference

must be certified by California as a small business or must commit to subcontract at least
25% of the net bid price with one or more California certified small businesses. Completed
certification applications and required support documents must be submitted to the Office of
Small Business and DVBE Services (OSDS) no later than 5:00 p.m. on the RFQ due date,
and the OSDS must be able to approve the application as submitted
Small business nonprofit veteran service agencies (SB/NVSA) claiming the small business
preference must possess certification by California prior to the day and time RFQ responses
are due.
Questions regarding certification should be directed to the OSDS at (916) 375-4940.
N. PROPOSED RESOURCES – Exhibit 6

Bidder must complete Exhibit 6 Proposed Resource Form identifying all proposed
resource(s) and their current employment on other contracts with DOJ, other Government
Entities (e.g. State, Federal, City, etc.) or Private Sector. If the proposed resource(s) is not
currently employed on other contracts complete the form stating N/A under the proposed
resource’s name. The form must be returned with their RFQ response.
O. COMMERCIALLY USEFUL FUNCTION (CUF) COMPLIANCE FORM – Exhibit 7

Bidder must provide a written, signed statement detailing the role and services the Bidder
and/or Subcontractor(s) will provide to meet the CUF requirement. A separate form (see
attached) must be provided for each small businesses, micro businesses, and DVBE.
P. CALIFORNIA CIVIL RIGHTS LAWS CERTIFICATION - Exhibit 8

Certification not required if the bid does not exceed $100,000. Bids exceeding $100,000,
Bidder must provide signed certification certifying they are in compliance with Unruh Civil
Rights Act (Section 51 of the Civil Code) and the California Fair Employment and Housing Act
(Chapter 7 (commencing with Section 12960) of Part 2.8 of Division 3 of Title 2 of the
Government Code).
Q. CALIFORNIA SECRETARY OF STATE (SOS) CERTIFICATION TO DO BUSINESS IN

THE STATE OF CALIFORNIA
1. Submit a certification, or proof that certification is in process to do business in the

State of California
7 of 30
2. SOS certification must be approved and in “Active” status prior to award
R. At the State’s option prior to award, bidders may be required to submit additional written
clarifying information. Failure to submit the required written information as specified may be
grounds for the RFQ response ejection.
III. RFQ RESPONSE CONTENT AND TECHNICAL REQUIREMENTS

It is the bidder’s responsibility to provide all required data and any other information deemed
necessary for the State’s evaluation team to determine and verify the bidder’s ability to perform the
activities defined in the bidder’s RFQ response.
This RFQ and the bidder’s quote in response to this document will be made a part of the contract.
Responses to this RFQ must contain all data/information requested and must conform to the format
described in this RFQ. Also, the documents identified as Technical must be submitted in the bidder’s
RFQ response and are the Technical Requirements to be evaluated.
A. Number of Responses
Bidders may submit one (1) quote.
B. Number of Copies
Bidders shall deliver one (1) Master hard copy (printed, three-hole punched and in a binder),
three (3) additional identical copies (printed, three-hole punched and in a binder) and one (1) soft
copy (CD or Thumb Drive) of their quote to the location specified in the RFQ on or before the
submission of quote due date and time. DO NOT INCLUDE A SOFT COPY OF THE COST
WORKSHEET. A HARDCOPY OF COSTS MUST BE SUBMITTED IN A SEPARATELY SEALED
CONTAINER.
C. Assumptions and Constraints

There shall be no assumptions, conditions, or constraints included in the bidder’s response. A bid
may be rejected if it is conditional or incomplete, or if it contains any alterations of form or other
irregularities of any kind. Any assumptions, conditions, or constraints must be addressed by
submitting written questions before the key action date deadline.
D. Quote Organization and Ordering

All Quotes (master and copies) must be printed on standard 8-½” x 11” paper (larger paper is
permissible for charts, spreadsheets, etc.) in a type size no smaller than 10 font, hole-punched and
placed within a binder with tabs delineating each section.
The Quotes must be organized and indexed in the following format and must contain, at
minimum, all listed items in the sequence indicated.
 RFQ Cover Page
 All other documents required to meet RFQ Administrative Requirements in Section II.
 Bidder’s Statement of Work, including the Required Qualifications table, the Desirable
Qualifications table, work product examples, and required certificate information
 Resources and Resumes
 Customer Experience References (Exhibit 9)
 High Level Project Timeline
 Literature (highly discouraged)
 Completed Cost Sheet (SEPARATELY SEALED)
All forms provided in the RFQ must be thoroughly completed and included in the appropriate
section of the quote. All discussion of proposed costs, rates or expenses must occur only within the
cost sheets and must be sealed separately. Any quote that does not adhere to these requirements
may be deemed non-responsive and rejected on that basis.
8 of 30
E. Statement of Work (Technical - Scored)

Bidder must prepare a Statement of Work that responds to the State’s SOW. The Statement of
Work will be used to evaluate responsiveness to the State’s technical requirements. The
Statement of Work must map back to the requirements listed in the State’s SOW and include any
additional information that the Bidder deems necessary to explain how the Bidder intends to meet
the State’s requirements.
F. Required Qualifications (Technical)

Bidder must provide a response to the Required Qualifications Table within the State’s SOW.
Bidder must indicate the location in their response where the required qualification (RQ) can be
substantiated (e.g., resume, other support material). Bidder must clearly demonstrate within their
response how each resource meets each RQ. The vendor must also supply examples of work
products produced by the resources when specified in the RQ. Any confidential information may
be redacted from the work product, as necessary. The vendor must also provide evidence of an
“active” certification when specified in the RQ for the resource satisfying the RQ. This may
include a hyperlink to the website publishing proof of the certification.
G. Desirable Qualifications (Technical - Scored)

Bidder must provide a response to the Desirable Qualifications Table within the State’s SOW.
Bidder must indicate the location in their response where the required qualification can be
substantiated (e.g., resume, other support material). Bidder must clearly demonstrate within their
response how each resource meets each required qualification.
H. Resources and Resumes (Technical)

For each proposed resource, provide his/her resume with descriptions and timeframes (start and
end dates) of the projects worked which show when that resource performed the relevant work.
The bidder must explain how that resource’s experience meets the State’s SOW Requirements.
When identifying resources in your response, you must provide their legal names to
ensure an accurate background investigation.
I. Customer Experience Reference Form – Exhibit 9 (Technical - Scored)

The bidder must submit the following resource (s) references. References may be contacted to
validate that the resource has experience in providing services for projects with similar scope,
schedule and resources to this project.
 Resource(s) – For each proposed resource, the bidder must submit at least two (2)
references that can validate each Required Qualification (RQ) within the timeframe
identified for each in the RQ.
The State may contact customer references to validate the accuracy of the information provided
by the bidder and to determine the customer’s overall satisfaction with the goods and/or services
provided. Therefore, it may prove beneficial to the bidder to contact its referenced customers to
ensure their contact information provided on the Customer Experience Reference Form is up to
date.
If DOJ is unable, after three phone and/or email attempts, to contact the bidder’s reference
for validation, the requirement will be considered non-responsive. Additionally, negative
feedback provided by a reference may cause a bidder’s response to be rejected.
9 of 30
J. High Level Project Timeline (Technical)

Bidder’s shall develop and submit a high level project timeline to include:
 All Deliverables along with estimated start/delivery dates

 Overall Engagement Timeline (estimated start date to estimated disengagement date)
The “awarded vendor” will be required to prepare a thorough project plan based on the Project
Management Body of Knowledge, and Project Management Institute Standards that includes but
is not limited to a detailed work breakdown structure.
K. Literature
Submitting additional literature that is not part of the administrative or technical requirements is
highly discouraged. Any supporting product literature containing costs or rates such as catalogs,
maintenance service rates must have all cost figures replaced with “XXXX”. BIDDERS SHOULD
BE AWARE THAT MARKING A DOCUMENT "CONFIDENTIAL" OR "PROPRIETARY" IN A FINAL
QUOTE WILL NOT KEEP THAT DOCUMENT FROM BEING RELEASED AFTER NOTICE OF
INTENT TO AWARD AS PART OF THE PUBLIC RECORD, UNLESS A COURT HAS ORDERED
THE STATE NOT TO RELEASE THE DOCUMENT.
L. Interviews
For the top scoring vendors that receive a numeric score for numerically scored components and
also received a passing score for all pass/fail components, interviews may be held. For vendors
that did not score in the top scoring and vendors that received a zero (0) score for any of the
numerically scored components or received a “fail” for any of the pass/fail components, interviews
will not be held.
M. Cost Sheet
Bidder must complete the cost sheet that identifies total cost per transaction as described and
using the State’s cost sheet format. Cost sheets must be completed with clear and legible figures
preferably typed. This cost sheet may include an entry for optional purchase of goods and/or
services costs. These costs would be valid should the State exercise its option to purchase
additional goods, and/or services. ALL COST INFORMATION (COST SHEET) SUBMITTED
WITH THE FINAL QUOTE MUST BE SEALED IN A SEPARATE CONTAINER.
Any other expenses such as delivery, tax, installation, safety inspection, license, travel, or training
associated with the implementation of the Statement of Work must be included in Bidder's firm
fixed cost. There shall be no assumptions, conditions, or constraints included in the
proposed cost.
Any proposed service that is not specifically priced or identified in the Bidder’s cost sheet, or that
is identified after contract award as necessary to meet the requirements of the RFQ, will be
assumed by the State to be included at no cost to the State. By submitting a cost, the Bidder
affirms their agreement to this provision.
IV. EVALUATION INFORMATION
This section presents the evaluation process and scoring guidelines the evaluation team will follow in
reviewing responses submitted in response to this RFQ.
A. Evaluation Process
1. Quote Opening and Validation Check
All quotes received by the time and date specified in the Key Action Dates, will be opened at that
time, except for cost information which will be kept sealed until all non-cost aspects of the quotes
have been evaluated. The quotes will then be checked for the presence of the required information
in conformance with this RFQ. Absence of required information may deem the quote non-
responsive and may cause rejection.
10 of 30
2. Disclosure of Quote Contents/Confidentiality

The contents of all quotes, correspondence, agenda, memoranda, working papers, or any other
medium, which discloses any aspect of a bidder’s quote, shall be held in the strictest confidence
until Notice of Intent to Award. BIDDERS SHOULD BE AWARE THAT MARKING A DOCUMENT
"CONFIDENTIAL" OR "PROPRIETARY" IN A FINAL QUOTE WILL NOT KEEP THAT
DOCUMENT FROM BEING RELEASED AFTER NOTICE OF INTENT TO AWARD AS PART OF
THE PUBLIC RECORD, UNLESS A COURT HAS ORDERED THE STATE NOT TO RELEASE
THE DOCUMENT.
3. Validation Against Requirements

All bidder quotes will be reviewed for compliance with the administrative, RFQ response content
and technical requirements stated within the RFQ. If a quote fails to meet an RFQ requirement,
the evaluation team, through group consensus, will be responsible for determining whether a
deviation exists in the bidder’s response and whether it is material or immaterial by using the
Deviation Worksheet, Exhibit 10. A material deviation will cause rejection of the quote. An
immaterial deviation will be examined to determine if the deviation will be accepted. If accepted,
the quote will be processed as if no deviation had occurred. The department contact may contact
the bidder for clarification of the response as specified in this RFQ.
4. Cost Envelope Opening

The cost envelope will not be opened until the evaluation team has completed the requirements
evaluation for each bidder. Bidders who are compliant in the administrative, RFQ response
content and technical requirements will have their sealed cost envelope opened at a public cost
opening.
5. Cost Evaluation
The evaluation team will reconvene to complete cost evaluation after the cost opening. The cost
sheet will be verified for mathematical accuracy. Errors will be resolved in accordance with the
Bidder Instructions. After verification of costs, points will be assigned.
If the cost sheet does not contain all required elements the bidder’s response may be disqualified
from further consideration.
6. Selection
Responsive and responsible quotes will be evaluated on the factors in this RFQ that have been
assigned a point value. Award of this Contract, if any, will be to the Responsive and Responsible
bidder with the highest total bid score that meets all requirements of the RFQ including cost. The
State reserves the right at any time to reject any or all quotes.
B. Evaluation Scoring Guidelines

Each bidders RFQ response will be evaluated and assigned points in accordance with this section.
1. Administrative Requirements
The State will examine the bidder’s response to the RFQ administrative requirements
identified in Section II.
The bidder’s response will be given a “fail” score if the required information is not included, is
incomplete or does not meet the administrative requirements. A material deviation on an
administrative requirement will result in a “fail” score. Only those bids that “Pass” the
administrative requirements will be evaluated further.
11 of 30
Administrative requirements will be scored as Pass/Fail. The following administrative

requirements will be evaluated.
RFQ Location Requirements Possible Result

Section II.A Signed RFQ Cover Page Pass/Fail
Section II.B Payee Data Record, STD. 204 Pass/Fail
Section II.C Bidder Declaration Form, GSPD 05-105 Pass/Fail
Section II.D Confidentiality Statement Pass/Fail
Section II.E Security and Disclosure Certification Pass/Fail
Section II.G DVBE Participation, STD. 843 (if applicable) Incentive
Section II.H TACPA STD. 830 (if applicable) Preference
Section II.L Small Business Preference (if applicable) Preference
Section II.N Proposed Resource Form Pass/Fail
Section II.O Commercially Useful Function (CUF) Pass/Fail
Compliance Form (if applicable)
Section II.P California Civil Rights Law Certification Pass/Fail
2. Technical Requirements
The State will examine the technical requirements of the responses that receive a passing
score on the administrative requirements.
Technical requirements will be scored pass/fail and/or assigned points as applicable. The
bidder’s response will be given a “fail” score if the required information is not included, is
incomplete or does not meet the technical requirements. A score of zero points for any of the
technical requirements will result in a “fail” score. A material deviation on a technical
requirement will result in a “fail” score.
Only those bids that “Pass” all technical requirements and who have been assigned
points above zero for each requirement will have their cost sheet envelope opened.
The total points available for technical requirements is 700 points. The following technical
requirements will be evaluated.
RFQ Location Requirements Possible Result

Section III.E. Statement of Work 150 Points
Section III.F. Required Qualification (RQ) 1 Pass/Fail
Section III.F. RQ 2 Pass/Fail
Section III.H. Resources and Resumes 60 Points
Section III.I Customer Experience References 150 Points
Section III.J High Level Project Timeline 40 Points
Section III.L Interviews 300 Points
Statement of Work (150 points)

Bidder’s SOW response will be scored using the following scoring guideline:
Score Scoring Guideline
0 points The response does not meet the requirement as outlined in the State’s
SOW.
100 points The response meets the requirement as outlined in the State’s SOW.
150 points The response exceeds the requirement as outlined in the State’s SOW.
12 of 30
Required Qualifications RQ 1, RQ 2, RQ 3, RQ 4, RQ 5 (Pass/Fail)

Each Required Qualification as outlined in the State’s SOW will be evaluated using the following
guidelines:
Pass/Fail All five (5) required qualifications must be met to receive a passing score.
Failure to meet one (1) of the five (5) required qualifications will result in
disqualification.
Pass/Fail RQ 1: At least one resource must have a minimum of five (5) years of
personal experience in the cyber security field developing and updating
security related documentation. This experience must be demonstrated
through the submission of examples of documentation personally
authored and prepared by the resource. Classified information may be
redacted as necessary.
Pass/Fail RQ 2: At least one resource must have personal experience in developing
and updating cyber security policies, standards and procedures within the
last two (2) years. This experience must be demonstrated through the
submission of examples of new policies, standards, and procedures
personally authored and documented by the resource. Classified
information may be redacted as necessary.
Pass/Fail RQ 3: The resource responsible for authoring revisions to existing policy
and formulating new policy language must possess an “active” CISSP
certification.
Pass/Fail RQ 4: At least one or a combination of resources must possess a strong
understanding of NIST Special Publications, FBI CJIS Security Policy, and
CA State Administrative Manual Section 5300.
Pass/Fail RQ 5: At least one resource must possess excellent technical oral and
written communication skills.
Resources and Resumes (60 points)

The response to the Resources and Resumes technical requirement will be scored using the following
scoring guideline:

0 Resumes and work products fail to demonstrate relevant work
experience.
30 The combined (if more than one resource proposed) resumes support the
relevant work experience described in the SOW.
60 The combined (if more than one resource proposed) resumes exceed the
level of relevant work experience described in the SOW.
Customer Experience References (150 points)

References for each resource will be scored based on the following scoring guidelines and then
averaged for one collective score.

0 points The response fails to complete the Customer Experience Reference, the
reference refutes the services were performed, or the reference gave a
rating of zero (0), Not Satisfied, on a scale on 0-2.
75 points The response meets the Customer Experience Reference requirement and
the reference gave a rating of one (1), Satisfied, on a scale of 0-2.
150 points The response meets the Customer Experience Reference requirement and
the reference gave a rating of two (2), Fully Satisfied, on a scale of 0-2.
DOJ reserves the right to contact customer references for each resource to score the references
submitted.
13 of 30
If DOJ is unable, after three phone and/or email attempts, to contact the bidder’s reference for
validation the requirement may result in a “fail" score.
High Level Project Timeline (40 points)

The response high level project timeline technical requirement will be scored using the following scoring
guideline:
0 points The response fails to address the requirement or the high level
project timeline was not submitted.
20 points
The response contains all Deliverables along with estimated
start/end date for each deliverable.
Note: Tasks pertaining to all deliverables begin prior to June 30,
2018.
40 points The response contains all Deliverables along with estimated

start/end date for each deliverable and the total length (start and
end) of the overall engagement is 12 months or less.
Note: Tasks pertaining to all deliverables begin prior to June 30,
2018.
Interviews (300 points)

The interview technical requirement will be scored using the following scoring guideline:

0 Resources interviewed failed to demonstrate sufficient level of a
understanding of the IT and information security domain.
150 Resources interviewed demonstrated a good level general understanding
of the IT and information security domain.
300 Resources interviewed demonstrated a superior level of understanding of
the IT and information security domain.
3. Desirable Qualification.
The State will examine the desirable qualification of the responses that receive a passing
score on the technical requirements. DOJ reserves the right to call the contact person(s) to
validate the information provided.
Desirable Qualifications are not mandatory. You are not required to include them in
your response, however they add value when determining award.
The total points available for the desirable qualification is 80 points.
14 of 30
Desirable Qualifications (80 points)

Each Desirable Qualification as outlined in the State’s SOW will be scored using the following scoring
guideline.
0 points None of the desired qualifications are met.

20 points DQ 1: At least one resource(s) possesses a 4-year college degree in
computer science or cyber security from an accredited United States
college or university.
20 points DQ 2: At least one resource(s) possesses a strong knowledge of Open
Web Application Security Project (OWASP) and SAN/Center for Internet
Security (CIS) TOP 20 SECURITY CONTROLS.
20 points DQ 3: At least one resource(s) is a Computer Incident Advisory Capability
(CIAC) Security Expert(s).
20 points DQ 4: At least one resource(s) is a Global Information Assurance
Certification (GICA) strategic planning, policy and leadership expert(s).
4. Cost
Each bidders cost score will be calculated based on the ratio of the lowest bid cost evaluated
to the bidders bid cost, multiplied by the maximum number of cost points available. The
bidder with the lowest cost evaluated amount will receive the maximum of 700 cost points
available. All other bidders will be awarded a cost score calculated using the equation below:
Lowest Bid Cost Evaluated x 700 (max points) = Bidder’s Total Cost Score
Bidder’s Bid Cost
The total points available for cost evaluation is 700 points.
V. Scoring
A. Administrative Score
The administrative requirements will be scored pass/fail, except incentive and preferences.
B. Bidder’s Total Technical Score

Prior to interviews, the technical requirements will be evaluated and assigned points. The
technical points will be added together to determine each bidder’s pre-interview technical
score.
The following table provides an example of how the bidder’s pre-interview technical score is
determined.
Bidder Administrative Required Response Resources Customer Project Interview Bidders’

Requirements Qualifications to SOW and Experience Timeline Pre-
Resumes References Interview
Technical
Score
A Pass Pass 150 60 150 40 400
B Pass Pass 100 30 75 20 225
C Pass Pass 100 30 75 40 245
After the interviews have been conducted and assigned points, the interview score will be
added in with the pre-interview technical points to determine each bidder’s total technical
score.
15 of 30
The following table provides an example of how the bidder’s total technical score is
determined.
Bidder Administrative Required Response Resources Customer Project Interview Bidders’

Requirements Qualifications to SOW and Experience Timeline Total
Resumes References Technical
Score
A Pass Pass 150 60 150 40 300 700
B Pass Pass 100 30 75 20 300 525
C Pass Pass 100 30 75 40 150 395
C. Bidder’s Total Cost Score

The following table provides an example of how the bidder’s total cost score is determined
before application of any preference or incentive points.
Bidder Bid Amount Calculation Bidder’s Total

Cost Score
A $800,000 ($470,000 / $800,000) x 700 411.25
B $470,000 ($470,000 / $470,000) x 700 700
C $525,000 ($470,000 / $525,000) x 700 626.67
D. Preference Programs Scoring

This section discusses how preference programs will be factored into the scoring. See
Section II for more details regarding the various preference programs.
1. Small Business (SB) Preference

The small business preference will be determined as follows:
Step 1: Identify the bidder with the #1 ranked bid (the responsive bid with the highest
total score).
Step 2: Multiply the total score of the #1 ranked bid by 5% to determine the preference
amount.
Step 3: Add the preference amount to the total score of responsive bids eligible to
receive the preference.
2. Non- Small Business (Non-SB) Preference

A five percent (5%) bid preference is available to a non-small business claiming twenty-
five percent (25%) California certified small business subcontractor participation.
The non-small business preference will be determined as follows:
Step 1: Identify the bidder with the #1 ranked bid (the responsive bid with the highest
total score).
Step 2: Multiply the total score of the #1 ranked bid by 5% to determine the preference
amount.
Step 3: Add the preference amount to the total score of responsive bids eligible to
receive the preference.
16 of 30
3. TACPA Preference
Preference will be applied in accordance with the State procurement rules.
The following table provides an example of how the bidder’s preference score is determined.
Bidder Preference Technical Cost Combined Preference

Category Score Score Technical and Score
Cost Score
A SB 700.00 411.25 1111.25 61.25
B None 525.00 700.00 1225.00 0.00
C Non-SB 395.00 626.67 1021.67 61.25
E. DVBE Incentive Points

DVBE incentive points will be awarded based on the following table.
Confirmed DVBE Participation DVBE Incentive Points

of:
5% or over 70 points
4% to 4.99% 56 points
3% to 3.99% 42 points
2% to 2.99% 28 points
1% to 1.00% 14 points
F. Final Bid Score
The final bid score will be calculated by adding the combined technical and cost score,
preference score, and DVBE incentive points, and desirable qualification points.
The following table provides an example of how the bidder’s final bid score is determined. In
this case the highest scored RFQ response from Bidder B would be the intended awardee.
Bidder Combined Preference DVBE Incentive Desirable Bidder’s Final

Technical and Score Score Score Score
Cost Score
A 1111.25 61.25 70 80 1322.50
(5%
participation)
B 1225.00 0.00 0 60 1285.00
C 1021.67 61.25 56 0 113.92

(4.5%
participation)
G. Tie Break Process

In the event of a precise tie, if GC §14838(f) does not apply to the Bidders, a witnessed
drawing of vendor names will be conducted by the Procurement Official. If a drawing of
vendor name is needed, the Procurement Official will schedule and arrange for the drawing
and non-partisan witnesses; notifying the participating Bidders of the outcome of the drawing.
VI. Award of Contract

Award of contract, if made, will be in accordance with the RFQ information on Evaluation to a
responsible bidder whose RFQ response complies with all the requirements of the RFQ
documents and an addenda thereto, except for such immaterial defects as may be waived by the
State. Award, if made, will be made within forty-five (45) days after the scheduled date for
Contract Award as specified in the RFQ; however, a bidder may extend the offer beyond 45 days
in the event of a delay of contract award.
17 of 30
The State reserves the right to determine the successful bidder(s) either on the basis of individual
items or on the basis of all items included in its RFQ, unless otherwise expressly provided in the
State’s RFQ. Unless the bidder specifies otherwise in its RFQ response, the State may accept
any item or group of items of any RFQ response. The State reserves the right to modify or cancel
in whole or in part its RFQ.
Written notification of the State’s intent to award will be made to all bidders. If a bidder, having
submitted an RFQ response, can show that its RFQ response, instead of the RFQ response
selected by the State, should be selected for contract award, the bidder will be allowed five (5)
working days to submit a protest to the Notice of Intent to Award, according to the instructions
contained in the paragraph titled “Protests” of this RFQ.
Protests
Any bidder’s issues regarding solicitation requirements must be resolved (or attempts to resolve
them must have been made) before a protest may be submitted according to the procedure
below. These issues will first be resolved by the contact for the solicitation or if they result in a
protest, the protest will be submitted to DGS Procurement Division Deputy Director to hear and
resolve issues and whose decision will be final.
If a bidder has submitted an RFQ response which it believes to be totally responsive to the
requirements of the RFQ and to be the RFQ response that should have been selected according
to the evaluation procedure in the solicitation section on Evaluation and the bidder believes the
State has incorrectly selected another bidder for award, the bidder may submit a protest of the
selection as described below. Protests regarding selection of the “successful Contractor” will be
heard and resolved by the Victim Compensation and Government Claims Board whose decision
will be final.
All protests of award must be made in writing, signed by an individual authorized to bind the
bidder contractually and financially, and contain a statement of the reason(s) for protest; citing the
law, rule, regulation or procedure on which the protest is based. The protester must provide facts
and evidence to support the claim. Protests must be mailed or delivered to:
Street and Mailing Address:

Department of General Services
Deputy Director
Procurement Division
707 Third Street, Second Floor South
West Sacramento, CA 95605
Facsimile No.: (916) 375-4611
All protests to the RFQ or protests concerning the evaluation, recommendation, or other aspects
of the selection process must be received by the DGS Procurement Division Deputy Director as
promptly as possible, but not later than the date indicated in the Notification of Intent to Award.
Certified or registered mail must be used unless delivered in person, in which case the protester
should obtain a receipt of delivery.
18 of 30
EXHIBIT 1
Payee Data Record, STD. 204
All Bidders must complete the Payee Data Record, STD. 204 and include it with their RFQ response.
Refer to the following website link for more details.
https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std204.pdf
19 of 30
EXHIBIT 2
Bidder Declaration Form GSPD 05-105
All Bidders must complete the Bidder Declaration GSPD-05-105 and include it with their RFQ response.
http://www.documents.dgs.ca.gov/pd/poliproc/MASTEr-BidDeclar08-09.pdf
20 of 30
EXHIBIT 3
Confidentiality Statement
California Department of Justice
As an authorized representative and/or corporate officer of the company named below, who has the
authority to bind the company, I warrant my company and its employees will not disclose any documents,
diagrams, information and information storage media made available to us by the State for responding to
RFQ 17-317 or in conjunction with any Contract arising there from. I warrant that only those employees
who are authorized and required to use such materials will have access to them.
I further warrant that all materials provided by the State will be returned promptly after use and that all
copies or derivations of the materials will be physically and/or electronically destroyed. I will include with
the returned materials, a letter attesting to the complete return of materials, and documenting the
destruction of copies and derivations. Failure to so comply may subject this company to liability, both
criminal and civil, including all damages to the State and third parties. I authorize the State to inspect and
verify the above.
I warrant that if my company is awarded the contract, it will not enter into any agreements or discussions
with a third party, excluding the subcontractor(s) participating on the project team, concerning such
materials prior to receiving written confirmation from the State that such third party has an agreement with
the State similar in nature to this one.
(Signature of Representative) (Date)
(Typed Name of Representative)
(Typed Name of Company)
21 of 30
EXHIBIT 4
DEPARTMENT OF JUSTICE
SECURITY AND DISCLOSURE CERTIFICATION
To be completed by DOJ after contract award.

DOJ Contract Number
__________________________________
Company or Organization (Print or Type) Contractor's Name (Print or Type)
__________________________________
Contractor's Signature Date
The California Department of Justice (herein after referred to as the Department or DOJ) collects, stores,
and disseminates confidential and sensitive information from the law enforcement community and the
public to administer the various programs for which it has responsibility. This information is maintained
according to provisions of various laws and regulations including the Information Practices Act, the Public
Records Act, various California Codes, the State Administrative Manual (SAM), and Departmental
Administrative Manuals and policies. The Department is committed to protect its information and systems
from unauthorized access, use or disclosure. The following policies have been adopted to address
contractors' responsibilities for handling, protecting or disseminating information maintained in the
Department's data bases and files:
1. A Contractor is defined as any person, Vendor, organization (public or private), permanent or

designated employee of any such entity who works directly or indirectly for such person, Vendor, or
organization, to perform work on any Departmental network, system, or application whether in a
conceptual, pilot or operational form.
2. Based upon the degree of access required, and the sensitivity of the information, the Department may
require a background investigation of any contractor, sub-contractors, or individuals assigned to the
project. As a condition of employment, the initial or continued contractual relationship may be
contingent upon the successful completion of a background investigation.
3. A Contractor may access Department systems or information only when authorized by Department
management in order to fulfill contractual requirements. Contractors may not access or use
information from Departmental networks, system, or applications, or from any other database
accessible through the Department's systems, for any unauthorized purpose.
4. Contractors may disclose information from Departmental files or databases only when authorized in
writing by Departmental management authorized to release such information and only to individuals
who have been authorized to receive it. Contractors shall not divulge or make use of confidential or
proprietary information, data, or records of the Department for any unauthorized purpose. Such use
maybe subject to civil or criminal action.
5. Contractors may not deliberately enter false or incomplete data or delete existing data on any of the
Departmental databases or files. Contractors may not deliberately take any unauthorized action that
would adversely affect the performance or security of any Departmental system, or cause the
interruption of information technology services, or the destruction or alteration of any Departmental
network, system, or application.
6. As a precaution against misuse, destruction, or unauthorized disclosure of information, Contractors

will not remove any work related materials from the work site without prior written authorization from
the Project Manager. Work in progress is to be stored and maintained in areas designated for such
storage and maintenance.
22 of 30
7. Contractors must take precautions to protect Department information, networks, systems,

applications, or other resources from unauthorized access, use or disclosure. Precautions include,
but are not limited to, the following:
A. Ensuring that his/her terminal/workstation is inaccessible when unattended.

B. No unauthorized disclosure of any Departmental system access capability or technology.
C. Storage of internal program documentation in a secure place.
D. Prompt reporting of any and all suspicious circumstances or unauthorized individuals
observed in the work area, to the Department Network and System Security Administrator.
E. If you are using a non-DOJ assigned PC/Laptop, before connecting it to the DOJ Network,
Hawkins Data Center (HDC) Desktop Support staff must first evaluate it. DOJ standard
software such as CA Asset Management and virus detection software may be installed. See
your HDC Project Manager to assist you in getting this done.
F. Immediately notify HDC's Network Information Security Unit (NISU) of any security incident
involving data or any incident regarding breeches of data. If the breech involves criminal
offender record information or CLETS, the Communications Administration Program shall
also be notified.
G. Contractors shall obtain written approval from the Project Manager and the NISU before
downloading information to a PC/Laptop.
8. Upon conclusion of the authorized work interval, all designated equipment, software, information,
materials, or proprietary/intellectual property shall be returned to the Department or destroyed within
two working days with proof of destruction furnished to the Departmental manager with oversight
responsibility for the project.
By signing above, I acknowledge that I have read and understand, and received a copy of the security
policies stated above as well as the requirements set forth in DOJ Administrative Manual Chapter 15
Sections 15100 through 15784. I understand that failure to comply with these policies may constitute
grounds for disciplinary action up to and including contract termination and/or administrative, civil, or
criminal action in accordance with applicable statutes. In complying with the aforementioned I further
understand that there is no expectation of privacy when utilizing Department of Justice (DOJ) systems
and resources, as they are being audited and monitored.
Additional Certification Declaration for Contractors Accessing Criminal History Information

I hereby certify that I have read and am familiar with the contents of 1) the Security Addendum; 2) the
Criminal Justice Information Services Security Policy; and 3) Title 28, Code of Federal Regulations, Part
20, and agree to be bound by their provisions.
I recognize that criminal history record information and related data, by its very nature, is sensitive and
has potential for great harm if misused. I acknowledge that access to criminal history record information
and related data is therefore limited to the purpose(s) for which a government agency has entered in to
the contract incorporating the Security Addendum. I understand that misuse of the system by, among
other things: accessing it without authorization, accessing it by exceeding authorization, accessing it for
an improper purpose, using, disseminating, or re-disseminating information received as a result of this
contract for a purpose other than that envisioned by the contract, may subject me to administrative and
criminal penalties. I understand that accessing the system for an appropriate purpose and then using,
disseminating or re-disseminating the information received for another purpose other than execution of
the contract also constitutes misuse. I further understand that the occurrence of misuse does not depend
upon whether or not I receive additional compensation for such authorized activity. Such exposure for
misuse includes, but is not limited to, suspension or loss of employment and prosecution for state and
federal crimes.
23 of 30
EXHIBIT 5
California Disabled Veteran Business Enterprise Program Requirement Packet
For the purpose of this solicitation, the DVBE participation requirement was waived; however, this
solicitation does provide an incentive for DVBE participation.
CA DVBE Participation Requirement Packet
The following link directs you to the CA DVBE Participation Requirement Packet dated 10/24/15 which
includes the DVBE Incentive table.
http://www.documents.dgs.ca.gov/pd/smallbus/CUF/DVBEIncentiveRequireGoodIT.pdf
STD. 843 - Disabled Veteran Business Enterprise Declaration
Bidders who have been certified by California as a DVBE (or who are bidding rental equipment and have
obtained the participation of subcontractors certified by California as a DVBE) must also submit a
completed form(s) STD. 843 (Disabled Veteran Business Enterprise Declaration). All disabled veteran
owners and disabled veteran managers of the DVBE(s) must sign the form(s). The STD. 843 can be
found at:
http://www.documents.dgs.ca.gov/pd/poliproc/STD-843FillPrintFields.pdf
24 of 30
EXHIBIT 6
Proposed Resource Form
Bidder must identify all proposed resource(s) and their current employment on other contracts with DOJ,
other Government Entities (e.g. State, Federal, City, etc.) or Private Sector. If the proposed resource(s) is
not currently employed on other contracts complete the form stating N/A under the proposed resource’s
name and return with your RFQ response.
Resource Name:
Project Name:
Department/Company Name:
Department/Company t PO or Contract Number:
Contract Term:
Average Hours Worked Per Month:
Resource Name:
Project Name:
Department/Company PO or Contract Number:
Contract Term:
Resource Name:
Project Name:
Department/Company PO or Contract Number:
Contract Term:
25 of 30
EXHIBIT 7
Commercially Useful Function (CUF) Compliance Form
If neither a small business nor a DVBE will be participating in the bid, then this form is not required.
Under Military and Veterans Code 999.5 and Government Code 14837.4 (A/B), each solicitation must be
evaluated for Commercially Useful Function when the prime bidder is small, micro or DVBE certified, or a
prime bidder’s subcontractor is small, micro or DVBE certified. All small businesses, micro businesses,
and disabled veteran business enterprises (DVBE) are required to perform a “commercially useful
function” in any contract it performs for the State.
The Bidder must provide a written, signed statement below detailing the role, services and/or
goods the Bidder and/or Subcontractor(s) will provide to meet the Commercially Useful Function
requirement. A separate form must be provided for each small businesses, micro businesses, and
DVBE.
A business that is performing a commercially useful function is one that does all of the following (e.g. specific
roles of business for this project and/or goods or services to be provided as part of this project), please
respond to the following questions
1) Supplier must be responsible for the execution of a distinct element of the work.
_____________________________________________________________________________
_______________________________________________________________
2) Supplier must carry out their obligation by actually performing, managing or supervising the work
involved.
_____________________________________________________________________________
_______________________________________________________________
3) Supplier performs work that is normal for its business, services and function.
_____________________________________________________________________________
_______________________________________________________________
4) Supplier is responsible, with respect to products, inventories, materials, and supplies required for
the contract, for negotiating price, determining quality and quantity, ordering, installation, if
applicable, and making payment.
_____________________________________________________________________________
_______________________________________________________________
5) Supplier is not further subcontracting a portion of the work that is greater than that expected to be
subcontracted by normal industry practices.
_____________________________________________________________________________
_______________________________________________________________
Name of Bidder: ________________________
Signature of Bidder: ________________________ Date: __________
If the SB, MB or DVBE is a subcontractor:
Name of Subcontractor: Type of Business (SB, MB, DVBE):
26 of 30
EXHIBIT 8
CALIFORNIA CIVIL RIGHTS LAWS CERTIFICATION
Certification not required if the bid does not exceed $100,000.
Pursuant to Public Contract Code section 2010, if a bidder or proposer executes or renews a contract
over $100,000 on or after January 1, 2017, the bidder or proposer hereby certifies compliance with the
following:
1. CALIFORNIA CIVIL RIGHTS LAWS: For contracts over $100,000 executed or renewed after January
1, 2017, the contractor certifies compliance with the Unruh Civil Rights Act (Section 51 of the Civil Code)
and the Fair Employment and Housing Act (Section 12960 of the Government Code); and
2. EMPLOYER DISCRIMINATORY POLICIES: For contracts over $100,000 executed or renewed after
January 1, 2017, if a Contractor has an internal policy against a sovereign nation or peoples recognized
by the United States government, the Contractor certifies that such policies are not used in violation of the
Unruh Civil Rights Act (Section 51 of the Civil Code) or the Fair Employment and Housing Act (Section
12960 of the Government Code).
CERTIFICATION
I, the official named below, certify under penalty of perjury under the laws of the Federal ID Number
State of California that the foregoing is true and correct.
Proposer/Bidder Firm Name (Printed)
By (Authorized Signature)
Printed Name and Title of Person Signing
Date Executed Executed in the County and State of
27 of 30
EXHIBIT 9
Customer Experience Reference Form

Company □ Resource □
Bidder must provide two (2) resource references for each proposed resource for services they have
performed within the timeframe identified for each Required Qualification (see Statement of Work for
number of years) that are similar in size, scope, and type of goods and/or service as specified in this
RFQ. Complete this form for each reference.
Company Name: Resource Name (if applicable):
Subcontractor that provided the goods and/or services:

(if applicable, other than the bidder)
Company/Organization Name:
Contact Name and Signature (scanned signature acceptable):
Address:
Telephone:
Fax:
E-mail:
Please circle the rating below that best describes your experience with the Company and/or Resource
named above (to be completed by the Contact person signing above):
0: Not Satisfied 1: Satisfied 2: Fully Satisfied
Project Name and/or Description:
Bidder or Subcontractor’s involvement:
Start Date (mm/dd/yyyy): End Date (mm/dd/yyyy):
Total Length of Time (years/months/days):
Project Dollar Amount: $
28 of 30
EXHIBIT 10
Deviation Worksheet
RFQ/IFB/RFP #_______________BIDDER NAME: ________________________
Definition: A deviation exists when the response is not in substantial accord with the solicitation
requirement.
Mandatory _____ (“shall, must, will”) or Desirable ______ (“should, may”)
Solicitation Requirement:
Bidder Response:
Materiality Test
Is the requirement Mandatory or Desirable (see above)? If it is mandatory, proceed with answering the
following questions. If desirable, Stop; the deviation is immaterial (For Formal Procurements, reference
Section II, paragraph A.2.).
1. Is the response in substantial accord with the solicitation Yes* No

requirement? If YES, the deviation is NOT material for this reason. If NO, _______ _______
explain how the response deviates from the requirement.
2. Does the response provide the bidder an advantage over other Yes* No
bidders? If NO, the deviation is NOT material for this reason. If YES, _______ _______
explain how the response provides an advantage:
3. Does the response have a potentially significant effect on the delivery Yes* No
of the items bid? If NO, the deviation is NOT material for this reason. If _______ ______
YES, explain how delivery is affected:
29 of 30
4. Does the response have a potentially significant effect on the quantity Yes* No
of the items bid? If NO, the deviation is NOT material for this reason. If _______ _______
YES, explain how the quantity has been or will be affected:
5. Does the response have a potentially significant effect on the quality Yes* No
of the items bid? If NO, the deviation is NOT material for this reason. If _______ _______
YES, explain how the quality of the items bid is affected:
6. Does the response have a potentially significant effect on the amount Yes* No
paid to the vendor? If NO, the deviation is NOT material for this reason. _______ _______
If YES, explain how the amount to be paid the vendor is affected:
7. Does the response have a potentially significant effect on the cost to Yes* No
the State? If NO, the deviation is NOT material for this reason. If YES, _______ _______
explain how the cost to the State is affected:
* If the requirement is mandatory and any of these items are checked, the deviation must deemed
material (IV.Evaluation Information, A.3), and the bid rejected. “Material deviations cannot be
waived.”
Revised 02/22/11
30 of 30

RFQ 17-317 IT Security Policy Enchancements

Загружено:

Сведения о документе

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

RFQ 17-317 IT Security Policy Enchancements

Загружено:

Авторское право:

Доступные форматы

XAVIER BECERRA State of California

Attorney General DEPARTMENT OF JUSTICE

Request for Quotation

Quotes must be delivered by 10:00 AM PST on or before the due date.

Contact: Phone #: 916-210-5378 ARE YOU A NON-SMALL BUSINESS

Bidder must notify the Department

 Bidders Instructions (GSPD-451), Effective 11/09/11

 General Provisions-Information Technology (GSPD-401IT), Effective 9/5/14

G. Key Action Dates

Key Action Dates Date

6. Estimated Contract Award (date PO is issued to Contractor) 5/14/2018

II. RFQ ADMINISTRATIVE REQUIREMENTS

B. Payee Data Record, STD. 204 – Exhibit 1

C. Bidder Declaration Form, GSPD 05-105 – Exhibit 2

D. Confidentiality Statement – Exhibit 3

E. Security and Disclosure Certification - Exhibit 4

F. CA Disabled Veteran Business Enterprise Requirement

G. DVBE PARTICIPATION – Exhibit 5

When a department awards a contract subject to participation goals in accordance with

H. TACPA CONTRACT PREFERENCE

TACPA Standard Form 830

I. SMALL BUSINESS REGULATIONS - The Small Business regulations, located in the

J. NON-SMALL BUSINESS SUBCONTRACTOR PREFERENCE - A 5% bid preference is

K. SMALL BUSINESS NONPROFIT VETERAN SERVICE AGENCIES (SB/NVSA)

L. EXHIBIT WITH QUOTE REQUIRED IF CLAIMING THE SMALL BUSINESS

M. SMALL BUSINESS CERTIFICATION - Bidders claiming the small business preference

Questions regarding certification should be directed to the OSDS at (916) 375-4940.

N. PROPOSED RESOURCES – Exhibit 6

O. COMMERCIALLY USEFUL FUNCTION (CUF) COMPLIANCE FORM – Exhibit 7

P. CALIFORNIA CIVIL RIGHTS LAWS CERTIFICATION - Exhibit 8

Q. CALIFORNIA SECRETARY OF STATE (SOS) CERTIFICATION TO DO BUSINESS IN

1. Submit a certification, or proof that certification is in process to do business in the

2. SOS certification must be approved and in “Active” status prior to award

III. RFQ RESPONSE CONTENT AND TECHNICAL REQUIREMENTS

C. Assumptions and Constraints

D. Quote Organization and Ordering

E. Statement of Work (Technical - Scored)

F. Required Qualifications (Technical)

G. Desirable Qualifications (Technical - Scored)

H. Resources and Resumes (Technical)

I. Customer Experience Reference Form – Exhibit 9 (Technical - Scored)

J. High Level Project Timeline (Technical)

 All Deliverables along with estimated start/delivery dates

IV. EVALUATION INFORMATION

1. Quote Opening and Validation Check

2. Disclosure of Quote Contents/Confidentiality

3. Validation Against Requirements

4. Cost Envelope Opening

B. Evaluation Scoring Guidelines

Administrative requirements will be scored as Pass/Fail. The following administrative

RFQ Location Requirements Possible Result

RFQ Location Requirements Possible Result

Statement of Work (150 points)

Score Scoring Guideline

Required Qualifications RQ 1, RQ 2, RQ 3, RQ 4, RQ 5 (Pass/Fail)

Score Scoring Guideline

Resources and Resumes (60 points)

Score Scoring Guideline

Customer Experience References (150 points)

Score Scoring Guideline

High Level Project Timeline (40 points)

Score Scoring Guideline

40 points The response contains all Deliverables along with estimated

Interviews (300 points)

Signature of Bidder: ______________ Date:

RFQ/IFB/RFP #_BIDDER NAME: __________

Mandatory _ (“shall, must, will”) or Desirable __ (“should, may”)