Agenda packet — Finance Committee, April 29, 2024 (part 4 of 8)

So the questions do not need to be uploaded separately. (Answered: Jan 14, 2016 3:51:50 PM MST) Question 69
There are some sub-categories under the Saas, Paas and Iaas Service Types that we are not prepared to price today, but that are on our development roadmap; some to be released in as soon as 6 months, that could be pertinent to the services that Participating Entities are able to procure through this contract. The contract has a term of ten years, and certainly technology and service offerings will change over that period. Will there be a process to add capability to the scope of a vendor's contract offering(s) as new capabilities are developed? (Submitted: Jan 14, 2016 2:47:09 PM MST)
Answer
- Please see Section 2.8 that states: The awarded Master Agreement(s) may be modified as a result of technological upgrades for the procurement item(s). Any modification for upgraded technology must be substantially within the scope of the original procurement or contract, and if both parties agree to the modification, then the contract may be modified, but it may not extended beyond the term of the original awarded contract unless otherwise permitted by law. The awarded contract(s) may be modified for new technology related to the procurement item(s).

However, if an Offeror is not awarded a Service Category during this solicitation then an Offeror may attempt to be awarded a Service Category if the Lead State re-issues the solicitation, as permitted in 2.8. (Answered: Jan 15, 2016 11:56:21 AM MST)
Question 70
Section 5.3, Acknowledgement of Amendments, states: "If the RFP is amended, the Offeror must acknowledge each amendment with a signature on the acknowledgement form provided with each amendment. Failure to return a signed copy of each amendment acknowledgement form with the proposal may result in the proposal being found non-responsive.". We are not finding acknowledgement forms posted with the four amendments that are curenntly reflected in BidSync. Where can they be located? (Submitted: Jan 15, 2016 8:28:57 AM MST) Answer
- The acknowledgement form will be posted after all amendments to the RFP have been included in the final RFP documents. It is anticipated that the final RFP documents will be posted on February 5, 2016. The final RFP documents will not include new information, but will contain clarifications made as a result of the Q&A period. (Answered: Jan 15, 2016 11:56:21 AM MST)
Question 71
RFP Section 5.5.15 requires an Offeror to provide a statement certifying that it is willing to sign a Business Associate Agreement or any other agreement that may be necessary to protect data with a Purchasing Entity.

Statement: We cannot provide a blanket agreement to comply, as in the past, we have received certain HIPAA BAA's that are not relevant or applicable to our Cloud Services. Question: Will you please consider deleting the clause or revising the clause as written to be less restrictive? (Submitted: Jan 15, 2016 6:59:16 PM MST) Answer
- In the final version of the RFP document this section will be moved and deleted. It will not be in Section 8.9 and state: 8.9.2 Offeror must identify whether or not it is willing to sing relevant and applicable Business Associate Agreement or any other agreement that may be necessary to protect data with a Purchasing Entity.

Some Participating Entities want to know if an Offeror is willing to sign a BAA. (Answered: Jan 20, 2016 1:36:53 PM MST)
Question 72
Per RFP Section 3.10 Proposal Content and Format Requirements, reads in part, "Include a Table of Contents in the Technical Proposal identifying contents of each section, including page numbers of major sections.

Proposals should follow the numerical order of the RFP starting at the beginning and continuing through the end of the RFP, etc." AND, Per RFP Section 3.12 Submission of Proposal, covers the specific format for submitting Proposals. It reads in part, "Offerors should title each document with the names listed below." We will be submitting electronically only (not hard copy). Question: Do you want each proposal section to be uploaded as separate documents (i.e., Section 1 Signature Page, Section 2, Executive Summary, Section 3 Mandatory Minimums, Section 4 Business Profile) or do you want the core Proposal document to be contained in one document so that page numbers are consistently shown? Please clarify. Note: Section 3.12 does not mention the placement of the Cover Letter in terms of upload order. Please clarify or restate the upload criteria for the Proposal. ( We understand that all Attachments and Exhibits can be uploaded separately.) (Submitted: Jan 15, 2016 7:14:19 PM MST)
Answer
- A proposal can be uploaded as a single document or in multiple documents. If a proposal is uploaded as a ildt ththOffldtidtblf ttIf l ildd i
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 310
#2..
- 354 -
) yp
document so that page numbers are consistently shown? Please clarify. Note: Section 3.12 does not mention the placement of the Cover Letter in terms of upload order. Please clarify or restate the upload criteria for the Proposal. ( We understand that all Attachments and Exhibits can be uploaded separately.) (Submitted: Jan 15, 2016 7:14:19 PM MST)
Answer
- A proposal can be uploaded as a single document or in multiple documents. If a proposal is uploaded as a single document then the Offeror only needs to provide one table of contents page. If a proposal is uploaded in multiple documents then a table of contents should be created for each uploaded document.

However, Offerors should take into consideration that if an Offeror's proposal contains confidential information then the Offeror needs to upload two documents, an unredacted version and a redacted version. (Answered: Jan 20, 2016 1:36:53 PM MST)
Question 73
Please confirm that the recently posted "State of Utah Vendor Information" form is the RFP signature page, and also confirm that it replaces the original form provided in the RFP that was titled "State of Utah Request for Proposal." (Submitted: Jan 15, 2016 7:17:49 PM MST)
Answer
- The "State of Utah Vendor Information" is the RFP signature page. And it replaces the original form titled "State of Utah Request for Proposal." The original document did not format correctly when downloaded. (Answered: Jan 20, 2016 1:36:53 PM MST)
Question 74
Section 7.1 calls for the resume of the proposed "Contract Manager" with the only absolute requirement of 3 years experience managing cloud solution contracts. Section 5.5.1 describes a "Contracts Administrator" to manage compliance with the scope, terms, and conditions for the contract. Section 5.5.2 describes a "Usage Report Administrator" responsible for quarterly sales reporting as described in the MSA terms and conditions.

Request that the Government change "Contracts Administrator" and "Usage Report Administrator" to read "Contract Manager".

Request that the Government provide additional description of the expected roles and responsibilities, as well as any required skills and/or experience, for the "Contract Manager" position. (Submitted: Jan 18, 2016 12:04:51 PM MST) Answer
- Section 5.5.1 has been deleted from the final RFP document. However, 5.5.2 will remain the same. Offerors must provide a Usage Report Administrator to provide usage reports to NASPO ValuePoint and Participating Entities. The Usage Report Administrator can be the same person.

In order to meet the requirement of 5.5.2 an Offeror just needs to certify that it will, if awarded a contract, provide a Usage Report Administrator. (Answered: Jan 27, 2016 11:46:12 AM MST) Question 75
May other questions be answered via an attachment or an embedded document or embedded link? (Submitted:

Jan 18, 2016 1:57:51 PM MST)
Answer
- All questions will be answered through Bidsync. However, the RFP documents are subject to change based on the questions and answers. (Answered: Jan 20, 2016 1:36:53 PM MST) Question 76
Can we embed SLA attachments in our RFP response document? If not, how are they to be included in the response? (Submitted: Jan 18, 2016 1:58:43 PM MST)
Answer
- Please attach your SLA attachments to your RFP response. If in responding to a section a vendor needs to refer to its SLA attachments then it can simply reference the SLA attachments. (Answered: Jan 19, 2016 1:26:19 PM MST) Question 77
If multiple questions in the RFP, have essentially the same response details and that detail is 1-2 pages long, do you wish the vendor to a) repeat the answer after each question or b) refer back to the first time the answer appears in the RFP or c) provide full details once and provide highlights with reference back to the full answer in earlier question? e.g Security Policies. (Submitted: Jan 18, 2016 1:59:23 PM MST) Answer
- An Offeror can refer back to information as long as it is clear on which information it is referring back to. (Answered: Jan 20, 2016 1:36:53 PM MST)
Question 78
Two sections (7 & 8) refer to Personnel who will be involved at various stages (refer to the persons/roles identified in Section/Attachment D. Attachment D does not identify roles, please clarify.

Section 7:
7 ORGANIZATION AND STAFFING
This Section focuses on the individual persons and roles that will be involved in performance of the Master Agreement.Â The State has identified a number of roles that are necessary based on the requirements of Attachment D; these titles are not meant to be restrictive, but are used to identify key roles.Â The State recognizes that different Offerors may use different titles, have different organizational structures, and employ roles that have not been specifically identified by the State.Â For the roles that have been identified, provide the required information about the person/role that will meet the requirements identified by the State; feel free to provide the title your business uses for that roleÂ If multiple identified roles are performed by the same personbe sure to State of Utah Bid CH16012
3/22/2016 4:23 PM p. 311
#2..
- 355 -
7 ORGANIZATION AND STAFFING
This Section focuses on the individual persons and roles that will be involved in performance of the Master Agreement.Â The State has identified a number of roles that are necessary based on the requirements of Attachment D; these titles are not meant to be restrictive, but are used to identify key roles.Â The State recognizes that different Offerors may use different titles, have different organizational structures, and employ roles that have not been specifically identified by the State.Â For the roles that have been identified, provide the required information about the person/role that will meet the requirements identified by the State; feel free to provide the title your business uses for that role.Â If multiple identified roles are performed by the same person, be sure to include that information in your response.Â Â
Section 8:

8.3 (E) WORKING WITH PURCHASING ENTITIES
Describe in detail how you will work with Purchasing Entities before, during, and after a Data Breach, as defined in the Attachments and Exhibits.Â Include information such as:Â Â· Personnel who will be involved at various stages (refer to the persons/roles identified in Section 7);Â (Submitted:

Jan 18, 2016 2:01:12 PM MST)
Answer
- That paragraph in Section 7 has been deleted in the final RFP document.

Section 8.3 has been modified to state: "Personnel who will be involved at various stages, include detail on how the Contract Manager in Section 7 will be involved;" (Answered: Jan 27, 2016 11:46:12 AM MST) Question 79
Do we understand correctly that only Section 8 (Sections 8.1 - 8.24) must be answered SEPARATELY FOR EACH OFFERING BEING MADE for IaaS, SaaS, PaaS? If yes, then please confirm the proposal response will have two completed Sections 8, one following the other in the final Proposal. (Submitted: Jan 18, 2016 2:32:49 PM MST)
Answer
- If information can be provided for all three offering then an Offeror can provide one answer and identify that it applies to all three offerings. However, where an Offeror's proposal needs to identify different responses to the different sections for each offering then it can identify how it intends to respond. It can be done in one document or by splitting it out into multiple Section 8s. (Answered: Jan 20, 2016 1:36:53 PM MST) Question 80
Section 3.10 Proposal Content and Format Requirements Paragraph 1 states â€œInclude a Table of Contents in the Technical Proposal identifying the contents of each section, including page numbers of major sections.

Proposals should follow the numerical order of the RFP starting at the beginning and continuing through the end of the RFP. However in Section 3.12 submission of proposal paragraph 2 you mention â€œAll Proposals must be submitted in the following format. Offerors should title each document with the names listed below. Detailed information on submitting each of these sections is contained later sections of this RFP.â€ â€“ Do you require each proposal section to be uploaded as a separate document or should it be in one single document? Please confirm? (Submitted: Jan 19, 2016 10:34:18 AM MST)
Answer
- A proposal can be uploaded as a single document or in multiple documents. If a proposal is uploaded as a single document then the Offeror only needs to provide one table of contents page. If a proposal is uploaded in multiple documents then a table of contents should be created for each uploaded document.

The final version of the RFP document will not have the word "Technical". (Answered: Jan 20, 2016 1:36:53 PM MST) Question 81
RFP Section 3.10 states in part "Proposals should follow the numerical order of the RFP starting at the beginning and continuing through the end of the RFP. Proposal sections and subsections shall be identified with the corresponding numbers and headings used in the RFP." Question: Since no Vendor responses are required until Section 5. Mandatory Minimum Requirements, may the Proposal submittal begin with Section 5 (retaining the Section and Sub-Subsection numbering scheme as shown in the RFP)? (Submitted:

Jan 19, 2016 12:48:51 PM MST)
Answer
- Proposals should follow the format described in Section 3.12. (Answered: Jan 20, 2016 1:36:53 PM MST) Question 82
Section 1.a, would State please clarify whether State of Utah Standard Terms and Conditions take precedence over the master terms? (Submitted: Jan 20, 2016 10:01:30 AM MST) Answer
- A state's terms and conditions will take precedence over the master agreement terms and conditions if negotiated during the Participating Addendum stage. (Answered: Jan 20, 2016 1:36:53 PM MST) Question 83
Will the State entertain a reasonable limitation of liability, since global IT companies are very unlikely to enter into agreements which have no limitation on liability, especially given the nature of the cloud services to be provided under this RFP? (Submitted: Jan 20, 2016 10:02:08 AM MST) Answer
- Limitations of liability can be included in an Offeror's exceptions and/or additions to the Master Agreement Terms and Conditions. (Answered: Jan 20, 2016 1:36:53 PM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 312
#2..
- 356 -
Question 83
Will the State entertain a reasonable limitation of liability, since global IT companies are very unlikely to enter into agreements which have no limitation on liability, especially given the nature of the cloud services to be provided under this RFP? (Submitted: Jan 20, 2016 10:02:08 AM MST) Answer
- Limitations of liability can be included in an Offeror's exceptions and/or additions to the Master Agreement Terms and Conditions. (Answered: Jan 20, 2016 1:36:53 PM MST) Question 84
Section 2.3 Definitions
Eligible Users means every agency, political subdivision, or nonprofit that has the statutory authority to purchase from state cooperative contracts established by a Participating Entity to qualify for the cloud solutions described in the RFP. The Participating Entity will have sole discretion to determine who qualifies as an Eligible User.

Request that the Eligible Users be defined as those approved by the manufacturer. (Submitted: Jan 20, 2016 11:54:47

AM MST)
Answer
- Eligible Users of state cooperative contracts are determined by the Participating Entity/State. (Answered: Jan 20, 2016 1:36:53 PM MST)
Question 85
Sections 5.5.8, 5.5.9, and 5.5.10
o 5.5.8 Offeror must at a minimum complete, provide, and maintain a completed a Level 1 CSA STAR Registry Self-Assessment and submit a copy under this RFP. Offeror must represent and warrant that it will keep this CSA Star Self-Assessment current on an annual basis and must be provide it to a Purchasing Entity when requested.

Offeror must also represent and warrant the accuracy and currency of the information on the completed CSA Star Self-Assessment Form.
o 5.5.9 Offeror must provide a statement certifying that it agrees to adhere to the services, definitions, and deployment models identified in the Scope of Services, in Attachment D, during the term of the contract. o 5.5.10 Offeror must provide a statement that its auditing capabilities and reports are consistent with SAS 70 or later versions including, SSAE 16 6/2011, or greater.

Please confirm that the manufacturer/cloud service providerâ€™s ability to meet the requirements identified in these sections also satisfies the requirement for the reseller responding on the manufacturer/cloud service providerâ€™s behalf. (Submitted: Jan 20, 2016 11:56:21 AM MST) Answer
- Yes. If a provider can meet these requirements then it satisfies this requirement for resellers. (Answered: Jan 25, 2016 2:23:05 PM MST)
Question 86
Attachment B: Cloud Security Alliance Questionnaires
Please confirm whether the response requires both the CAIQ (Attachment B Exhibit 1) and CCM (Attachment B Exhibit 2) questionnaires, or if only one of the two is required. (Submitted: Jan 20, 2016 11:56:58 AM MST) Answer
- The final RFP document will require that both documents be attached to a proposal. (Answered: Jan 25, 2016 2:23:05 PM MST)
Question 87
Section 5.5.11
o 5.5.11 Offer must provide a statement acknowledging that all support and training shall be provided at no additional cost under the Master Agreement, except for customized support and training expressly requested by a Purchasing Entity.

Please delineate between â€œsupportâ€ and â€œtrainingâ€ and provide additional detail around expectations for each. (Submitted: Jan 20, 2016 11:57:33 AM MST) Answer
- Support may be technical support, while training is demonstrating a specific service so that a purchasing entity can use it. (Answered: Jan 20, 2016 1:52:45 PM MST)
Question 88
Section 5.5.14.
o Offeror must provide a statement acknowledging that no click-through, or other end user terms and conditions or agreements required by the Contract Vendor (â€œAdditional Termsâ€ ) provided with any Services hereunder shall be binding on Participating Entities or Purchasing Entities, even if use of such Services requires an affirmative â€œacceptanceâ€ of those Additional Terms before access is permitted, unless agree to in the Master Agreement Terms and Conditions or in a Participating Addendum.

Seeking clarification on â€œclick-throughâ€ terms. Please define â€œclick-throughâ€ terms. (Submitted: Jan 20, 2016 12:00:24 PM MST)
Answer
- The master agreement and participating addendums should contain all of the terms necessary for a purchasing entity and an awarded contractor to work together once a SLA is agreed upon.

Purchasing entities should not have to click through or agree to additional terms beyond what is in the master agreement and the relevant participating addendum. (Answered: Jan 20, 2016 1:52:45 PM MST) Question 89
Section 5613
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 313
#2..
- 357 -
Answer
- The master agreement and participating addendums should contain all of the terms necessary for a purchasing entity and an awarded contractor to work together once a SLA is agreed upon.

Purchasing entities should not have to click through or agree to additional terms beyond what is in the master agreement and the relevant participating addendum. (Answered: Jan 20, 2016 1:52:45 PM MST) Question 89
Section 5.6.13
o 5.6.13 Offeror must provide a statement certifying that its scale-up and scale-down is available 24x365, and that new instances can be added in one hour or less.

Please clarify what is intended by the â€œscale-up and scale-downâ€ requirement for non-metered subscription services, such as SaaS. (Submitted: Jan 20, 2016 12:01:16 PM MST) Answer
- This section will not apply to SaaS services. If a section is not applicable to its offering then an Offeror must identify and explain why it is not applicable. However, if an Offerors identifies a section as not applicable to its proposal then it could hinder an Offeror's contract award. (Answered: Jan 20, 2016 1:52:45 PM MST) Question 90
Section 5.6.12 and 5.6.15
o 5.6.12 Offeror must provide a statement certifying that its on-demand deployment is supported 24x365. o 5.6.15 Offeror must provide a statement certifying that on-demand support is provided 24x365.

Please explain the intended difference between these requirements. (Submitted: Jan 20, 2016 12:01:37 PM MST) Answer
- Section 5.6.15 will be deleted from the final version of the RFP document. (Answered: Jan 20, 2016 1:36:53 PM MST) Question 91
Currently we do not hold any 3rd party certifications (security, process, quality, etc). Are the certification mandatory to be considered for this bid? If so which ones must we have to submit an RFP that will be considered for review. (Submitted: Jan 20, 2016 12:16:12 PM MST)
Answer
- 3rd Party Certification are not required. If an Offeror does not have any certifications it must state so. However, if an Offeror does not have any third party certifications then it may affect the Offerors technical score. (Answered: Jan 27, 2016 11:46:12 AM MST)
Question 92
Section 5.7 and Section 8.2. Subcontractors
In the SaaS model, a manufacturer will provide cloud services. Because of this involvement, as a reseller, are we to classify the manufacturer/cloud service provider as our subcontractor, the cloud service provider, or both? (Submitted: Jan 20, 2016 12:29:52 PM MST)
Answer
- Can you define who "we" is in your question?
Thank you. (Answered: Jan 27, 2016 11:46:12 AM MST)
Question 93
Section 6.2 Scope of Experience
â€¢ 6.2.1 Describe in detail the businessâ€™ experience with government or large consortium contracts similar to the Master Agreements sought through this RFP. Provide the approximate dollar value of the businessâ€™ five (5) largest contracts in the last two (2) years, under which the business provided services identical or very similar to those required by this RFP. Government experience is preferred. â€¢ 6.2.2 Describe in detail the size and scope of the cloud solutions for which you have provided the types of services required by in this RFP.

Please confirm that the cloud service providerâ€™s experience can be utilized to satisfy this requirement for the reseller that is responding on behalf of the cloud service provider. (Submitted: Jan 20, 2016 12:30:36 PM MST) Answer
- Section 6.2 refers to the Offeror responding to the solicitation. (Answered: Jan 20, 2016 1:42:41 PM MST) Question 94
Section 2.12 and Attachment D: Scope of Services
o 2.12 During the term of the Master Agreement(s), Offerors may submit a request to update the awarded Services as services are introduced or removed from the Offerorâ€™s offerings. o Attachment D: A successful Offeror must provide at least one of the following cloud based service models [SaaS, PaaS, IaaS] in order to be considered for award.

Please confirm that if a bidder responds with only one cloud based service model, ex. SaaS, and if awarded a contract, it is acceptable to add other cloud based service models (PaaS and/or IaaS) to the contract, that were originally in scope of the RFP, at a later date. (Submitted: Jan 20, 2016 12:32:06 PM MST) Answer
- Section 2.12 allows awarded contractors the ability to update their price schedules or product lists for awarded categories. For example, if an awarded contractor is awarded a contract to provide only SaaS services then it can request to update its price schedule or product list for only SaaS services. An awarded contract cannot add on a new service model.

However, an awarded contractor can submit a proposal to include a new service model if the Lead State reissues a solicitation under Section 2.8. (Answered: Jan 20, 2016 1:41:12 PM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 314
#2..
- 358 -
Answer
- Section 2.12 allows awarded contractors the ability to update their price schedules or product lists for awarded categories. For example, if an awarded contractor is awarded a contract to provide only SaaS services then it can request to update its price schedule or product list for only SaaS services. An awarded contract cannot add on a new service model.

However, an awarded contractor can submit a proposal to include a new service model if the Lead State reissues a solicitation under Section 2.8. (Answered: Jan 20, 2016 1:41:12 PM MST) Question 95
Is there a tentative award date that can be shared? (Submitted: Jan 20, 2016 12:32:55 PM MST) Answer
- As soon as all of the proposals have been evaluated and scored then the State of Utah will award the contracts. (Answered: Jan 20, 2016 1:36:53 PM MST)
Question 96
If a cloud service providerâ€™s (CSP) business model is to sell its solutions to end users via agents whom represent the CSP, will the State/NASPO allow the CSP to add agents under them on their contract for fulfillment of their product? (Submitted: Jan 20, 2016 1:54:51 PM MST) Answer
- Yes. (Answered: Jan 25, 2016 11:40:18 AM MST)
Question 97
Section 5.8, Recertification. The section states that the vendor needs to commit to certify every year with the lead State (Utah) that we continue to meet the minimum requirements of the RFP.

Is there a requirement to also certify/recertify with individual State participants as well? (Submitted: Jan 20, 2016 1:56:19 PM MST)
Answer
- Currently there is no requirement to also have an awarded contract recertify with each state. However, a state may request recertification in its Participating Addendum. (Answered: Jan 21, 2016 4:24:21 PM MST) Question 98
How will or does the NASPO ValuePoint eMarket Center support the ordering and the provisioning of cloud based services (which are not simple drop-ship products/services)? (Submitted: Jan 20, 2016 2:28:06 PM MST) Answer
- Sections of the RFP will be modified as a result of this question including Section 39 of the Master Agreement Terms and Conditions, as follows:

The awarded cloud service contractors will not have any type of catalog within the eMarket Center, they will have Ordering Instructions. These instructions provide visibility to the contractor within the eMarket Center as well as provide information about the contractor and how to order directly from the contractor, outside of the eMarket Center.

39. NASPO ValuePoint eMarket Center: In July 2011, NASPO ValuePoint entered into a multi-year agreement with SciQuest, Inc. whereby SciQuest will provide certain electronic catalog hosting and management services to enable eligible NASPO ValuePointâ€™s customers to access a central online website to view and/or shop the goods and services available from existing NASPO ValuePoint Cooperative Contracts. The central online website is referred to as the NASPO ValuePoint eMarket Center.

The Contractor will have visibility in the eMarket Center through Ordering Instructions. These Ordering Instructions are available at no cost to the Contractor and provided customers information regarding the Contractors website and ordering information.

39. NASPO ValuePoint eMarket Center: In July 2011, NASPO ValuePoint entered into a multiyear agreement with SciQuest, Inc. whereby SciQuest will provide certain electronic catalog hosting and management services to enable eligible NASPO ValuePointâ€™s customers to access a central online website to view and/or shop the goods and services available from existing NASPO ValuePoint Cooperative Contracts. The central online website is referred to as the NASPO ValuePoint eMarket Center.

At a minimum, the Contractor agrees to the following timeline: NASPO ValuePoint eMarket Center Site Admin shall provide a written request to the Contractor to begin Ordering Instruction process. The Contractor shall have thirty (30) days from receipt of written request to work with NASPO ValuePoint to provide any unique information and ordering instructions that the Contractor would like the customer to have. (Answered: Jan 27, 2016 11:46:12 AM MST)
Question 100
Regarding the State Specific Terms and Conditions in Attachment E, are those binding on the Contract Vendor once the Master Agreement is awarded? Or will the Contract Vendor have the chance to negotiate with the State during the Participating Addendum process? (Submitted: Jan 20, 2016 4:37:21 PM MST) Answer
- The state specific terms and conditions are not binding, but are for reference only. An awarded contractor will be allowed to negotiate the state specific terms and conditions during the Participating Addendum process. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 101
Regarding the State Specific Terms and Conditions in Attachment E, are those binding on the Contract Vendor once the Master Agreement is awarded? Or will the Contract Vendor have the chance to negotiate with the State during the Participating Addendum process? (Submitted: Jan 20, 2016 4:37:35 PM MST) Answer
- The state specific terms and conditions are not binding, but are for reference only. An awarded contractor will be allowed to negotiate the state specific terms and conditions during the Participating Addendum process. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 102
Section 5 of the RFP reads:

MANDATORY MINIMUM REQUIREMENTS
This section contains mandatory minimum requirements that must be met in order for an Offerorâ€™s proposal to be considered for the technical evaluation phase of the RFP. Failure to meet any one of the mandatory minimum requirements will result in the proposal being rejected pursuant to UCA Â§ 63 G-6a-704 and the proposal will not move forward in the evaluation process.

All of the items described in this section are non -negotiable. A rejection of a proposal due to a proposal not meeting mandatory minimum requirements can occur at any time in the evaluation process
Offerors are required to provide a point-by-point response to each of the following mandatory minimum requirements:

Several of requirements do not apply to some of the products we intend to bid.

How can indicate that the individual requirements does not apply to a specific product we are proposing without having our proposal rejected? (Submitted: Jan 20, 2016 7:30:14 PM MST) Answer
- If a mandatory minimum does not apply to a specific product the vendor is proposing then an offeror may state in its response why the mandatory minimum is not applicable. The State of Utah reserves the right to clarify if it believes the mandatory minimum is applicable. (Answered: Jan 21, 2016 4:24:21 PM MST) Question 103
Will the State of Utah's Participating Agreement Terms and Conditions be negotiated after award of the Master Agreement, or since Utah is the lead State, will their Participating Agreement Terms and Conditions be a part of the Master Agreement award? (Submitted: Jan 21, 2016 6:21:19 AM MST) Answer
- The State of Utah's terms and conditions will be negotiated during the Participating Addendum stage. (Answered:

Jan 21, 2016 4:24:21 PM MST)
Question 104
Please confirm that offerors may submit differing minimum discounts by vendor for each of the product categories identified (SaaS, IaaS, PaaS) in Attachment G. (Submitted: Jan 21, 2016 10:25:47 AM MST) Answer
- Correct, Offerors may submit differing minimum discounts. (Answered: Jan 21, 2016 4:24:21 PM MST) Question 105
Please confirm that offerors must submit a price catalog with detailed product offerings for each category by line item, to include manufacturer name, manufacturer part number, list price, product category, and sub category (e.g., education SaaS, e-procurement SaaS, information SaaS, etc.) as applicable. (Submitted: Jan 21, 2016 10:26:49 AM MST)
Answer
CorrectOfferors must submit a price catalog with detailed product offerings for each category by line itemto State of Utah Bid CH16012
3/22/2016 4:23 PM p. 316
#2..
- 360 -
Question 105
Please confirm that offerors must submit a price catalog with detailed product offerings for each category by line item, to include manufacturer name, manufacturer part number, list price, product category, and sub category (e.g., education SaaS, e-procurement SaaS, information SaaS, etc.) as applicable. (Submitted: Jan 21, 2016 10:26:49 AM MST)
Answer
- Correct, Offerors must submit a price catalog with detailed product offerings for each category by line item, to include manufacturer name, manufacturer part number, list price, product category, and sub category (e.g., education SaaS, e-procurement SaaS, information SaaS, etc.) as applicable. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 106
Section 3.13 of the RFP notes that "Pricing may not be classified as confidential or protected and will be considered public information after award of the contract." Please confirm that pricing may be classified as confidential prior to award; it is understood that pricing will be considered public information following award. (Submitted: Jan 21, 2016 10:27:22 AM MST)
Answer
- Proposals and pricing will be confidential until contract award. (Answered: Jan 21, 2016 4:24:21 PM MST) Question 107
What is the criteria for allocating the 152.8 points in the evaluation of cost proposals? (Submitted: Jan 21, 2016 10:27:46 AM MST)
Answer
- If a vendor completes the Cost Proposal form and provides a minimum discount for each category then it will be awarded the full 152.8 points. (Answered: Jan 25, 2016 2:06:20 PM MST) Question 108
Would an implementation timeline be acceptable to meet the security requirements? (Submitted: Jan 21, 2016 12:11:16 PM MST)
Answer
- It may be acceptable, but an Offeror must provide enough detail to the implementation timeline to describe how it meets the security requirements. If the evaluation committee does not believe it meets the security requirements then it may be scored lower. (Answered: Jan 27, 2016 11:46:12 AM MST) Question 109
If we take exception to security requirements will we be able to provide our current security protocol? (Submitted:

Jan 21, 2016 12:11:30 PM MST)
Answer
- An Offeror's proposal must include its current security protocol, which must meet or exceed the security requirements listed in the RFP. (Answered: Jan 27, 2016 11:46:12 AM MST) Question 110
If we take exception to security requirements will we be able to provide our current security protocol? Will the vendor receive partial points or zero points? (Submitted: Jan 21, 2016 12:11:45 PM MST) Answer
- An Offeror's proposal must include its current security protocol, which must meet or exceed the security requirements listed in the RFP.

Points will be determined by the evaluation committee. (Answered: Jan 27, 2016 11:46:12 AM MST) Question 111
In the service level agreement is it a general service agreement or an individual (customer) agreement? (Submitted: Jan 21, 2016 12:11:57 PM MST)
Answer
- The service level agreement should be the one that the Offeror intends to use if awarded contract. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 112
In reference to Section 3.12 Submission of Proposal, in particular the sentence "Offerors should title each document with the names listed below." Does NASPO VP/ State of Utah want a separate/ individual document file for each Section Title, or can Offerors present responses for each section, aside from the Cost Proposal, in one single document file? (Submitted: Jan 21, 2016 2:50:40 PM MST) Answer
- An Offeror may submit its response as one document or multiple documents. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 113
In line with this RFP of providing public entities with choices of qualified Offerors, multiple States have historically leveraged the below proposal wording - Are Joint Proposals allowed for this contract? Joint Proposals: A joint proposal (2 or more bidders proposing jointly on a single proposal) may be submitted.

Each participating bidder must sign the joint proposal. If the contract is awarded to joint bidders, it shall be one indivisible contract. Each joint bidder will be jointly and severally responsible for the performance of the entire contract, and the joint bidders must designate, in writing, one individual having authority to represent them in all matters relating to the contract. The State assumes no responsibility or obligation for the division of orders or purchases among the joint bidders. (Submitted: Jan 22, 2016 11:55:58 AM MST) Answer
- Yes. (Answered: Jan 25, 2016 2:06:20 PM MST)
Question 114
In Attachment G, Cost Schedule, can the Offeror add additional Value Added Services categories and provide separate pricing for those additional categories? (Submitted: Jan 22, 2016 12:53:51 PM MST) Answer
- Yes.The cost proposal form has been modified to reflect this question. (Answered: Jan 25, 2016 2:06:20 PM MST) Question 115
In Exhibit 1 to Attachment A, Paragraph 2.d, if the Contractor is a reseller and not the provider, the reseller does not have the ability to encrypt the Non-Public Data. It would be the responsibility of the provider. How should the Offeror distinguish between what the reseller is responsible for and what the provider is responsible for? (Submitted: Jan 22, 2016 12:54:31 PM MST)
Answer
- Offerors need to describe in their proposals what they are responsible for and what providers are responsible for, but wih (Answered: Jan 28, 2016 2:00:48 PM MST)
Question 116
In reference to Section 7. Organization and Staffing, the RFP states, "The State has identified a number of roles that are necessary based on the requirements of Attachment D..." Did Utah/NASPO VP intend to list additional roles beyond that of the Contract Manager? (Submitted: Jan 22, 2016 12:59:09 PM MST) Answer
- Section 7 has been modified to only reference the Contract Manager role. (Answered: Jan 28, 2016 2:00:48 PM MST) Question 117
If a Reseller is submitting offerings to be provided through our CSP partners, are they consider subcontractors under this contract and subject to section 8.2 of the RFP? (Submitted: Jan 22, 2016 1:01:39 PM MST) Answer
- Any Offeror submitting a proposal must address each mandatory minimum requirement and technical evaluation criteria. (Answered: Jan 28, 2016 2:00:48 PM MST) Question 118
Question 1 (Reference RFP 9.1):

RFP 9.1 states: â€œâ€¦ it is more favorable for Purchasing Entities to have the Master Agreement be based on minimum discounts off the Offerorâ€™sâ€™ commercially published pricelists versus fixed pricing.â€ Many cloud providers do not maintain published pricelists. Will offerors that do not have commercially published pricelists be considered for award of a Master Agreement? Question 2 (Reference RFP 9.1):

RFP 9.1 states: â€œThe hourly rates should be a fully burdened rate that includes labor, per diem, travel, overhead, and any other costs related to the service.â€ We recommend that the hourly rates include labor, overhead, and fee, but not per diem and travel costs since per diem and travel costs will vary widely and cannot be estimated at this time.

Question 3 (Reference Attachment A, Section 19):

Please clarify how services will be ordered under this Master Agreement. In particular:
1) Will ordering entities release task order requests/solicitations that firms having a Master Agreement are allowed to bid to?
2) Will all firms having a Master Agreement be allowed an opportunity to bid on a task order/solicitation? 3) Does a firm have the option of not bidding on a particular task order/solicitation? 4) Can an entity order directly from a firmâ€™s pricelist without going through a task order/solicitation process? (Submitted: Jan 22, 2016 2:07:11 PM MST)
Answer
- 1. Offerors must provide a price list so that the Participating States know how much an Offerors services may cost.

2. Agreed. Per diem and travel will be removed from the final RFP documents.

3. If an Offeror is awarded a contract then an Offeror must negotiate a Participating Addendum with Participating Entities (States). If awarded a Master Agreement it does not guarantee that a Participating Entity will sign a Participating Addendum with an offeror. (Answered: Jan 25, 2016 2:02:24 PM MST) Question 119
With respect to section 5.2.5, if a parent company and a subsidiary planned to submit separate bids, can an employee of the parent company assist in the preparation of both? (Submitted: Jan 22, 2016 3:32:18 PM MST) Answer
- Yes. (Answered: Jan 25, 2016 11:40:18 AM MST)
Question 120
To meet minimum requirements, are Exhibit 1 to Attachment B - CAIQ v3.0.1-09-16-2014.xls) and Exhibit 2 to Attachment B - CSA_CCM_v3.0.1-09-16-2014.xlsx expected to be completed? I don't see these listed as a set of minimum requirements. (Submitted: Jan 25, 2016 1:56:09 PM MST) Answer
- 5.5.8 Offeror must at a minimum complete, provide, and maintain a completed a Level 1 CSA STAR Registry Self-Assessment and submit a copy under this RFP. Offeror must represent and warrant that it will keep this CSA Star Self-Assessment current on an annual basis and must be provide it to a Purchasing Entity when requested.

Offeror must also represent and warrant the accuracy and currency of the information on the completed CSA Star Self-Assessment Form. (Answered: Jan 25, 2016 2:08:52 PM MST) Question 121

8.17.1 Documented cloud hosting provisioning processes, and the your defined/standard cloud provisioning stack.

Please clarify what is meant by cloud provisioning stack and/or provide examples. Specifically interested in the context of SaaS. (Submitted: Jan 25, 2016 2:27:38 PM MST) Answer
- If this section does not apply to SaaS then Offerors offering SaaSare required to describe why it is not applicable in their proposals. (Answered: Jan 27, 2016 1:00:04 PM MST) Question 122
Â¶ Section 3.9 & 3.12 Pg. 12 Paragraph numbering sequence. The Paragraph sequencing skips 3.10 and

3.11. Is there missing content? Please clarify. (Submitted: Jan 26, 2016 4:45:52 AM MST) Answer
- This was a numbering issue that will be corrected in the final version of the RFP documents. (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 123
Â¶ 4.1.2 Pg. 16 Offerors are encouraged to demonstrate compliance with a mandatory minimum and to demonstrate that they exceed to the requirement. The phase â€œexceed to the requirementâ€ is confusing.

Was â€œaccede to the requirementâ€ intended? (Submitted: Jan 26, 2016 4:46:18 AM MST) Answer
- The sentence you are referring to in 4.1.2 has been modified to the following: "Offerors are encouraged to demonstrate compliance with a mandatory minimum and to demonstrate that they meet or exceed to the requirement." (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 124
Â¶ 5.6.6 Pg. 23 Offeror must provide a statement certifying that it on request you can isolate that data to servers and data centers residing entirely in the United States of America or its territories. Please reword for clarity. (Submitted: Jan 26, 2016 4:46:39 AM MST)
Answer
- Offeror must certify that it can isolate that data, if required, to servers and data centers residing entirely in the United States of America or its territories.

Certain Purchasing Entity data must reside in the United States.

If an Offeror cannot meet this mandatory minimum requirement it will not be rejected, but it will restrict the type of award the Offeror can receive. (Answered: Jan 27, 2016 1:00:04 PM MST) Question 125
Â¶ 7.1 Pg. 27 It is this offerors opinion that the minimum requirement for Contract Manager, â€œ3 yearsâ€ experience managing contracts for cloud solutionsâ€ , is un-necessarily restrictive due primarily to newness and developing cloud market place. This offeror recommends removing the â€œmandatoryâ€ language and evaluate the yearsâ€™ experience only. i.e. Change from (ME) to (E). (Submitted: Jan 26, 2016 4:47:03 AM MST) Answer
- The minimum requirement will remain, but the three years will be removed. (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 126
Â¶ 8.12.1 Pg. 31 â€œAdditional points will be awarded for 99.99% or greater availabilityâ€ Base on the language of Â¶ 8.12.1 can the maximum points for Â¶ 8.12 exceed 50? (Submitted: Jan 26, 2016 4:47:29 AM MST) Answer
- No the expectation is that an Offeror can guarantee reliability and uptime greater than 99.9%, which would result in 30 points. If an offerors provides greater availability then it could receive 40 or 50 points. (Answered: Jan 27, 2016 1:00:04 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 319
#2..
- 363 -
Question 126
Â¶ 8.12.1 Pg. 31 â€œAdditional points will be awarded for 99.99% or greater availabilityâ€ Base on the language of Â¶ 8.12.1 can the maximum points for Â¶ 8.12 exceed 50? (Submitted: Jan 26, 2016 4:47:29 AM MST) Answer
- No the expectation is that an Offeror can guarantee reliability and uptime greater than 99.9%, which would result in 30 points. If an offerors provides greater availability then it could receive 40 or 50 points. (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 127

5.5.3 Pg 25 SciQuest: Offeror must agree to cooperate with NASPO ValuePoint and SciQuest (and any authorized agent or successor entity to SciQuest) with uploading ordering instructions Will the state provide vendors with detail requirements that they must provide to SciQuest for ordering instructions? (Submitted: Jan 26, 2016 7:06:07 AM MST)
Answer
- Offerors that are awarded contract must provide their orders instructions to SciQuest there are no detailed requirements. (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 128
Â¶ 8.23 (E) Pg. 33 RFP requires a response to review Cyber Insurance requirements as detailed in Attachment A (Master Agreement). If you have cyber insurance, what levels of protection does it provide to Purchasing Entities.

Will the state please clarify the intent for this response? The Offeror understands that in its proposal response, it will include whether or not it has Cyber Insurance and to what level detailed in Attachment A; however, we ask for clarification regarding what Cyber Insurance coverage is required to be offered to Purchasing Entities. (Submitted:

Jan 26, 2016 7:06:45 AM MST)
Answer
- 8.23 has been deleted from the final RFP documents.

Offerors must review Attachment A for Cyber Insurance requirements. (Answered: Jan 27, 2016 1:00:04 PM MST) Question 129
Â¶ Bid Sync Questions Close Period January 29, 2016 Based on answers provided after the question close period, if additional clarification is required will the government consider additional questions to clarify those responses? (Submitted: Jan 26, 2016 7:07:29 AM MST)
Answer
- No. The question and answer period ends on January 29th. (Answered: Jan 27, 2016 1:00:04 PM MST) Question 130
Â¶ 3.8 Pg. 11
Â¶3.11.1 Pg. 11
Â¶3.11.2 Pg. 12
Â¶3.9.3 Pg. 13
Â¶3.12 Pg. 10
Â¶4.3 Pg. 18
Multiple references to â€œcostâ€ and â€œcost proposal.â€ This Offeror understands â€œcostâ€ in these instances to mean â€œpriceâ€ and not the actual cost build up behind the prices proposed for products or services within our proposal response.

Please clarify the Stateâ€™s meaning when using â€œcostâ€ as detailed in this question. (Submitted: Jan 26, 2016 7:09:39 AM MST)
Answer
- In these sections "cost" has been replaced with "cost proposal". (Answered: Jan 27, 2016 1:00:04 PM MST) Question 131
Attachment G â€“ Cost Proposal N/A Onsite and Remote Hourly Rates To accommodate a 10 year contract term and adjust for cost increase over time, will vendors be able to increase their Onsite and Remote rates during the contract term? Would the State consider using a published index (i.e. CPI) for annual rate increases? (Submitted: Jan 26, 2016 7:10:05 AM MST)
Answer
- Yes. Annual increases are acceptable, but only if the awarded contractor is able to demonstrate that the price increase is justified, such as by using a published index. (Answered: Jan 27, 2016 1:00:04 PM MST) Question 132

5.2.5 Pg. 20 In the cover letter, an Offeror must include a statement that it hasnâ€™t employed any company or person other than an employee or a company regularly employed as a marketing agent to respond to the RFP.

Will the State please clarify the intent of this requirement? Is the intent to determine whether a lobbyist has been or will be utilized or is the intent to determine whether the proposal response has been written by a person or company other than the Offerorâ€™s? (Submitted: Jan 26, 2016 7:10:32 AM MST) Answer
- The intent is to determine who helped the Offeror write its proposal to ensure that no conflict of interest is present. (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 133
RFP Section 1 Last sentence If any provision of this RFP conflicts with the UCA or UAC, the UCA or UAC will take precedenceException
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 320
#2..
- 364 -
Answer
- The intent is to determine who helped the Offeror write its proposal to ensure that no conflict of interest is present. (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 133
RFP Section 1 Last sentence If any provision of this RFP conflicts with the UCA or UAC, the UCA or UAC will take precedence. Exception
Microsoft respectfully takes exception to this requirement, as written. Microsoft complies with all laws applicable to it, both as an IT service provider and as a corporation, in general. However, Microsoft does not agree to comply with laws applicable solely to its Purchasing Entities and their government or industry functions. (Submitted: Jan 26, 2016 7:10:39 AM MST)
Answer
- This section is used to ensure that the procurement is performed in accordance with Utah's procurement laws. (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 134
RFP Section 2.2 Contract Vendors must submit an annual certification that they are still compliant with the mandatory minimum requirements and technical specification of the RFP Exception Microsoftâ€™s Online Services are subject to change, so Microsoft is unable to agree to maintain static technical specifications for the duration of the Master Agreement. To the extent that Microsoft has identified protective security and privacy terms and conditions in its Online Services Terms (OST), with respect to those services the OST expressly applies to, Microsoft will not diminish those terms and conditions with respect to those specific products. (Submitted: Jan 26, 2016 7:10:55 AM MST)
Answer
- The annual certification is intended to ensure that all awarded contractor still comply with the terms of the contracts and can still provide the offerings as specified in the Master Agreement. (Answered: Jan 28, 2016 9:57:54

AM MST)
Question 135
Â¶ 38. Pg. 23 No Guarantee of Service Volumes: The Contractor acknowledges and agrees that the Lead State and NASPO ValuePoint makes no representation, warranty or condition as to the nature, timing, quality, quantity or volume of business for the Services or any other products and services that the Contractor may realize from this Master Agreement, or the compensation that may be earned by the Contractor by offering the Services. The Contractor acknowledges and agrees that is has conducted its own due diligence prior to entering into this Master Agreement as to all the foregoing matters. Will the state please clarify the bolded language to clarify the stateâ€™s intent? (bold added to highlight for questions) This Offeror agrees we should conduct reasonable due diligence but the wording is unclear. Does "all the foregoing matters" refer to Service Volumes (as the content of the specific paragraph). If not, please specify what this language means. (Submitted: Jan 26, 2016 7:11:05 AM MST) Answer
- The intent of this term and condition is to ensure that Offerors understand that even by being awarded a contract that there is no guarantee of use by any of the purchasing entities. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 136
RFP Section 2.7.2 Master Agreement
The Master Agreement(s) awarded from this RFP will consist of the RFP document, including all Exhibits, Attachments, and the winning Offerorâ€™s Proposal, in that order of precedence. Exception.

Offeror respectfully takes exception to the requirement to incorporate Exhibit E. While Exhibit E contains the boilerplate of Participating Addenda proposed by certain Participating States, it is unreasonable to expect Offeror to have prepared detailed Exception statements for each of the provisions in that 143 page document prior to engaging in negotiation with each of the individual Participating States after award, in accordance with RFP Sections 2.7.3 and 5.2.3.

Additionally, neither Appendix C nor Appendix D are written in such a way as to constitute contract terms, per se.

While offeror does not take exception to following the instructions for submitting information with as required by those Appendices, Offeror respectfully asks that those Appendices be struck from the â€œEntire Agreement,â€ as they contain no terms and conditions, per se. (Submitted: Jan 26, 2016 7:11:18 AM MST) Answer
- The Master Agreement will contain the following documents:
(1) A Participating Entityâ€™s Participating Addendum (â€œPAâ€ ); (2) NASPO ValuePoint Master Agreement Terms & Conditions, including the applicable Exhibits to the Master Agreement;
(3) The Solicitation;
(4) Contractorâ€™s response to the Solicitation, as revised (if permitted) and accepted by the Lead State; and (5) A Service Level Agreement issued against the Participating Addendum. (Answered: Jan 28, 2016 2:00:48 PM MST) Question 137
Exceptions to scope/content of the RFP within an Offerorâ€™s proposal that have not been previously addressed within the Q&A period of the procurement are not allowed and may result in the Offerorâ€™s proposal being considered non-responsive. Exception.

While Microsoft and Offeror have endeavored to submit during the Q&A period all Exceptions made necessary by our current understanding of the RFP requirements, it is possible that the answers we later receive from the Lead State to our questions (and those of other vendors) may cause us to reevaluate our interpretation of requirements, in light of those answersMicrosoft and Offeror therefore reserve the right to add any Exceptions that may result State of Utah Bid CH16012
3/22/2016 4:23 PM p. 321
#2..
- 365 -
Question 137
Exceptions to scope/content of the RFP within an Offerorâ€™s proposal that have not been previously addressed within the Q&A period of the procurement are not allowed and may result in the Offerorâ€™s proposal being considered non-responsive. Exception.

While Microsoft and Offeror have endeavored to submit during the Q&A period all Exceptions made necessary by our current understanding of the RFP requirements, it is possible that the answers we later receive from the Lead State to our questions (and those of other vendors) may cause us to reevaluate our interpretation of requirements, in light of those answers. Microsoft and Offeror therefore reserve the right to add any Exceptions that may result based upon the subsequent answers to the questions. (Submitted: Jan 26, 2016 7:11:42 AM MST) Answer
- Exceptions to the the RFP document should occur during the Q&A period. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 138

5.6.4 Pg. 23 Offeror must provide a statement certifying that it is NIST compliant with the service models it offers.

Will the state please confirm that it requires offers to certify compliance with NIST Special Publication 800-145? (Submitted: Jan 26, 2016 7:11:53 AM MST)
Answer
- Yes. This clarification is made in the final RFP document. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 139
RFP Section 3.4 Offerors may not submit requests for exceptions and/or additions by reference to a vendor's website or URL. URLs provided with a proposal may result in that proposal being rejected as non-responsive.

Exception.

Microsoft respectfully asserts that URLs are necessary and reasonable for clarifying certain terms and conditions which must reasonably be able to evolve over time. For example, we are constantly adding to our IaaS and PaaS offerings, and believe it is reasonable to announce and clarify those updates using a public website. In general, changes are not more restrictive but rather are additive with respect to certain protections offered for the services. (Submitted: Jan 26, 2016 7:12:07 AM MST)
Answer
- Correct. This section is used to ensure that Offerors do not offer blanket exceptions by referring to a URL. URLs may be necessary and reasonable to clarify certain terms and conditions.

However, many evaluators will print off the proposals and may not have access to a URL. So it is recommended that Offerors do not solely rely on URLs. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 140

5.6.5 Pg. 23 Offeror must provide a statement certifying that its service model offering(s) meet or exceed NIST definitions for service models Will the state please confirm that it requires offers to certify compliance with NIST Special Publication 800-145? (Submitted: Jan 26, 2016 7:12:09 AM MST) Answer
- Yes. This clarification is made in the final RFP document. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 141
RFP Section 5.5.4 (M) Offeror must provide a statement certifying that its computer applications and Web sites must be accessible to people with disabilities, and must comply with Participating entity accessibility policies and the Americans with Disability Act, as applicable. Exception Microsoft complies with all laws applicable to it as IT service provider, but not laws applicable to a Purchasing Entityâ€™s own operations. Microsoftâ€™s research indicates that most if not all State accessibility laws (and the Federal ADA) applies to our customers (and not to Microsoft, as service provider), so we respectfully take exception with this clause, as written. Microsoft supports the governmentâ€™s obligation to provide accessible technologies to its citizens with disabilities as required by Section 508 of the Rehabilitation Act of 1973, and its state law counterparts (including applicable California provisions). We encourage our customers (including Purchasing Entities under the Master Agreement and Participating Addenda) to judiciously compare product accessibility performance. The Voluntary Product Accessibility Templates (â€œVPATsâ€ ) for the Microsoft technologies used in providing the online services can be found at Microsoftâ€™s VPAT page. Further information regarding Microsoftâ€™s commitment to accessibility can be found at www.microsoft.com/enable. (Submitted: Jan 26, 2016 7:12:29 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 142
RFP Section 5.5.4 (M) Offeror must provide a statement certifying that its computer applications and Web sites must be accessible to people with disabilities, and must comply with Participating entity accessibility policies and the Americans with Disability Act, as applicable. Exception Microsoft complies with all laws applicable to it as IT service provider, but not laws applicable to a Purchasing Entityâ€™s own operations. Microsoftâ€™s research indicates that most if not all State accessibility laws (and the Federal ADA) applies to our customers (and not to Microsoft, as service provider), so we respectfully take exception with this clause, as written. Microsoft supports the governmentâ€™s obligation to provide accessible technologies to its citizens with disabilities as required by Section 508 of the Rehabilitation Act of 1973, and its state law counterparts (including applicable California provisions). We encourage our customers (including Purchasing Entities under the Master Agreement and Participating Addenda) to judiciously compare product accessibility performance. The Voluntary Product Accessibility Templates (â€œVPATsâ€ ) for the Microsoft State of Utah Bid CH16012
3/22/2016 4:23 PM p. 322
#2..
- 366 -
Entityâ€s own operations. Microsoftâ€s research indicates that most if not all State accessibility laws (and the Federal ADA) applies to our customers (and not to Microsoft, as service provider), so we respectfully take exception with this clause, as written. Microsoft supports the governmentâ€™s obligation to provide accessible technologies to its citizens with disabilities as required by Section 508 of the Rehabilitation Act of 1973, and its state law counterparts (including applicable California provisions). We encourage our customers (including Purchasing Entities under the Master Agreement and Participating Addenda) to judiciously compare product accessibility performance. The Voluntary Product Accessibility Templates (â€œVPATsâ€ ) for the Microsoft technologies used in providing the online services can be found at Microsoftâ€™s VPAT page. Further information regarding Microsoftâ€™s commitment to accessibility can be found at www.microsoft.com/enable. (Submitted: Jan 26, 2016 7:13:30 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 143
RFP Section 5.5.5 (M) Offeror must provide a statement certifying that its applications and content delivered through Web browsers must be accessible using current released versions of multiple browser platforms (such as Internet Explorer, Firefox, Chrome, and Safari) at minimum. Exception and Clarifying Statement For each of the Microsoft cloud services offered by Offeror, to the extent they deliver content through Web browsers, Microsoft generally endeavors to ensure compatibility with the latest versions of the most popular browsers including Internet Explorer, Firefox, Chrome and Safari. As of the date of Offerorâ€™s Proposal, each of these are supported. However, Microsoft respectfully declines to commit to any requirement that would constrain its ability to evolve its services to meet market needs. Over the 10 year term of the Master Agreement, it is likely that browser technology will change, and Microsoft will make decisions (independent of contractual commitments) as to how it will support future versions of these browsers. Microsoft therefore respectfully declines to accept this Section as written. (Submitted: Jan 26, 2016 7:13:58 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 144
RFP Section 5.5.6 (M) Offeror must provide a statement certifying that it shall only use data for purposes defined in the Master Agreement, participating addendum, or related service level agreement. Offeror shall not use the government data or government related data for any other purpose including but not limited to data mining or bids on other government contracts. Offeror and/or its agents shall not resell nor otherwise redistribute information gained from its access to the Purchasing Entity. Clarifying Statement Customer Data will be used only to provide a Purchasing Entity the Online Services including purposes compatible with providing those services. Microsoft will not use Customer Data or derive information from it for any advertising or similar commercial purposes. As between the parties, the Purchasing Entity retains all right, title and interest in and to Customer Data. Microsoft acquires no rights in Customer Data, other than the rights Customer grants to Microsoft to provide the Online Services to Customer. This paragraph does not affect Microsoftâ€™s rights in software or Online Services Microsoft licenses to Purchasing Entity.

Microsoft uses data mining solely for the purposes of providing the cloud services, subject to the abovementioned restrictions. Microsoft will not use data mining for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security or service delivery analysis that is not explicitly authorized. (Submitted: Jan 26, 2016 7:14:14 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 145
Â¶16.b Pg. 12 Specific insurance requirements Please clarify whether the Offeror is required or is not required to add Participating States or Purchasing Entities as an additional insured for Data Breach and Privacy/Cyber Liability including Technology Errors & Omissions and Crime Insurance as outlined in section 16 b. (Submitted: Jan 26, 2016 7:14:24 AM MST)
Answer
- This issue will need to be addressed in negotiations with Participating Entities during the negotiation of the participating addendums. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 146
RFP Section 5.5.8 (M)
Also Attachment B
Also RFP Section 8.13 (E) (5.5.8) Offeror must at a minimum complete, provide, and maintain a completed a Level 1 CSA STAR Registry Self-Assessment and submit a copy under this RFP. Offeror must represent and warrant that it will keep this CSA Star Self-Assessment current on an annual basis and must be provide it to a Purchasing Entity when requested. Offeror must also represent and warrant the accuracy and currency of the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 323
#2..
- 367 -
Also RFP Section 8.13 (E) (5.5.8) Offeror must at a minimum complete, provide, and maintain a completed a Level 1 CSA STAR Registry Self-Assessment and submit a copy under this RFP. Offeror must represent and warrant that it will keep this CSA Star Self-Assessment current on an annual basis and must be provide it to a Purchasing Entity when requested. Offeror must also represent and warrant the accuracy and currency of the information on the completed CSA Star Self-Assessment Form. (8.13) CLOUD SECURITY ALLIANCE QUESTIONNAIRES
Describe your level disclosure of compliance with the Cloud Controls Matrix for each Cloud solutions offered for the three levels below.
a. Level 1 CSA STAR Registry Self-Assessment complete an available through CSA STAR, as required by Mandatory Minimum 4.1.9.
b. Level 2 CSA STAR Registry Assessment Certification
c. Level 2 CSA STAR Registry Attestation Exception and Clarifying Statement Microsoft is on the Board of Directors of the Cloud Security Alliance (CSA). See https://cloudsecurityalliance.org/about/board-of-directors/.

While Microsoft represents that all CCMs were complete to the best of the knowledge of the authors thereof as of the time they were completed, Microsoft respectfully declines to represent and warrant the accuracy of CCMs.

Additionally, for services that do not store or process sensitive Customer Data (e.g. applications such as Office 365 ProPlus, which is merely a delivery mechanism for on-premises software bits), Microsoft does not complete CCMs. (Submitted: Jan 26, 2016 7:14:28 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 147
Â¶16.b.2 and 16.b.4 Pg. 12 Specific insurance requirements Please clarify how Professional Liability as outlined in section 16 b. 4 is different from Technology Errors & Omissions coverage in section 16 b. 2 (Submitted:

Jan 26, 2016 7:14:44 AM MST)
Answer
- Tech E&O policies cover both liability and property loss exposures. Major liability insuring agreements include losses resulting from: (1) technology services, (2) technology products, (3) media content, and (4) network security breaches. Key property insuring agreements provide coverage for extortion threats, crisis management expense, and business interruption.

And some of the value added services may need to be covered by professional liability insurance. (Answered: Jan 28, 2016 9:57:54 AM MST)
Question 148
RFP Section 5.5.9 (M)
Also RFP Section 5.6.1 (M) (5.5.9) Offeror must provide a statement certifying that it agrees to adhere to the services, definitions, and deployment models identified in the Scope of Services, in Attachment D, during the term of the contract.
(5.6.1) Offeror must provide a statement certifying that its Cloud Solutions meet the definitions described in Attachment D Exception and Clarifying Statement
Microsoft is able to provide, for Offerorâ€™s response, statements as to how each Microsoft Online Service meets certain definitions and deployment models shown in Attachment D (and the related Attachment C). However, because of the wide variety of Microsoft Online Services proposed for the Master Agreement, and the diversity of features, functionality and intended uses for each such Online Service, it is not possible for all elements of Attachments D and C to logically apply to each Online Service.

Additionally, over time, Microsoft Online Services will evolve to meet the needs of the marketplace, and the marketplace can be expected to drive evolution and improvements of standards such as NIST 800-53. Microsoft, as provider of these services to many thousands of customers with millions of users, can be expected to provide services that meet its customersâ€™ needs in this regard, but cannot reasonably freeze its design and operation of cloud services based upon any individual customer contract.

Lead State and Participating States may evaluate the Proposal to determine for themselves the suitability of any Microsoft Online Service for their Purchasing Entities. However, Microsoft must respectfully decline to certify that all statements in these attachments apply to all Online Services offered hereunder. (Submitted: Jan 26, 2016 7:14:52 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 149
Â¶19. Ordering Pg. 15 h. Resale. Subject to any explicit permission in a Participating Addendum, Purchasing Entities may not resell goods, software, or Services obtained under this Master Agreement. This limitation does not prohibit: payments by employees of a Purchasing Entity as explicitly permitted under this agreement; sales of goods to the general public as surplus property; and fees associated with inventory transactions with other State of Utah Bid CH16012
3/22/2016 4:23 PM p. 324
#2..
- 368 -
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 149
Â¶19. Ordering Pg. 15 h. Resale. Subject to any explicit permission in a Participating Addendum, Purchasing Entities may not resell goods, software, or Services obtained under this Master Agreement. This limitation does not prohibit: payments by employees of a Purchasing Entity as explicitly permitted under this agreement; sales of goods to the general public as surplus property; and fees associated with inventory transactions with other governmental or nonprofit entities under cooperative agreements and consistent with a Purchasing Entityâ€™s laws and regulations. Any sale or transfer permitted by this subsection must be consistent with license rights granted for use of intellectual property.

Will the state please clarify the bolded language to clarify what the state means (bold added to highlight for questions)? For example, to what type of fees is the state referring; what inventory; and what transactions? (Submitted: Jan 26, 2016 7:15:04 AM MST)
Answer
- Bolding does not show up on questions. (Answered: Jan 28, 2016 2:00:48 PM MST) Question 150
RFP Section 5.5.10 (M) Offeror must provide a statement that its auditing capabilities and reports are consistent with SAS 70 or later versions including, SSAE 16 6/2011, or greater Clarifying Statement For Office 365 Services (exclusive of Yammer), Microsoft Dynamics CRM Online Services, Microsoft Azure Core Services, and Microsoft Intune Online Services (each, as defined in the Microsoft Online Services Terms), each such Microsoft Online Service Each Online Service follows a written data security policy (â€œInformation Security Policyâ€ ) that complies with the control standards and frameworks of SSAE 16 SOC 1 (Type II) and SOC 2 (Type II). Additional standards are listed in the Microsoft Online Services Terms, which also include terms and conditions pursuant to which the audit findings may be provided to Purchasing Entities under non-disclosure agreement. Additionally, please see our response on Section 5.6.4, which pertains to other certifications and compliance with other standards. (Submitted: Jan 26, 2016 7:15:11 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 151
RFP Section 5.5.12 (M) Offeror, as part of its proposal, must provide a sample of its Service Level Agreement (SLA) that contains at a minimum, the terms described in Section 8.13 of the RFP. Exception and Clarifying Statement
Note that the reference to Section 8.13 appears to be a typographic error, as that section does not apply to Service Level Agreements.

Offeror will provide Microsoftâ€™s most recent SLA with its Proposal.

Microsoft respectfully declines to conform its SLA to the terms of any section of the RFP. For clarity, Microsoftâ€™s SLAs are administered in a consistent and in some cases automated way for all its customers, and may therefore not be customized. For any given cloud service, our SLA in effect as of the time a subscription order is first placed is locked and will not change during the term of a subscription order. Upon renewal of a customerâ€™s subscription order, Microsoftâ€™s then-current SLA will supersede the previous SLA. The Purchasing Entityâ€™s renewal of its subscription will constitute its written approval of the then-current (new) SLA.

Microsoftâ€™s historical practice has been to improve its SLAs over time, and we have never before adversely changed any SLA terms.

However, our SLAs may not be customized for any customer, and we must reserve the right to change SLAs over time at our sole discretion, except to the extent one is locked for a subscription as noted above. (Submitted: Jan 26, 2016 7:15:44 AM MST)
Answer
- The typographic error has been corrected. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 152
RFP Section 5.5.13 (M) Offeror must provide a statement certifying that it cannot change the SLA in any manner that adversely affects a Purchasing Entity or degrades the service levels applicable to a Purchasing Entity, without the Purchasing Entityâ€™s written approval. Clarifying Statement Microsoftâ€™s SLAs are administered in a consistent and in some cases automated way for all its customers, and may therefore not be customized. For any given cloud service, our SLA in effect as of the time a subscription order is first placed is locked and will not change during the term of a subscription order. Upon renewal of a customerâ€™s subscription order, Microsoftâ€™s then-current SLA will supersede the previous SLA. The Purchasing Entityâ€™s renewal of its subscription will constitute its written approval of the then-current (new) SLA.

Microsoftâ€™s historical practice has been to improve its SLAs over time, and we have never before adversely changed any SLA terms.

However, our SLAs may not be customized for any customer, and we must reserve the right to change SLAs over time at our sole discretion. (Submitted: Jan 26, 2016 7:16:00 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 325
#2..
- 369 -
Microsoftâ€s historical practice has been to improve its SLAs over time, and we have never before adversely changed any SLA terms.

However, our SLAs may not be customized for any customer, and we must reserve the right to change SLAs over time at our sole discretion. (Submitted: Jan 26, 2016 7:16:00 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 153
RFP Section 5.5.12 (M) Offeror, as part of its proposal, must provide a sample of its Service Level Agreement (SLA) that contains at a minimum, the terms described in Section 8.13 of the RFP. Exception and Clarifying Statement
Note that the reference to Section 8.13 appears to be a typographic error, as that section does not apply to Service Level Agreements.

Offeror will provide Microsoftâ€™s most recent SLA with its Proposal.

Microsoftâ€™s historical practice has been to improve its SLAs over time, and we have never before adversely changed any SLA terms.

However, our SLAs may not be customized for any customer, and we must reserve the right to change SLAs over time at our sole discretion, except to the extent one is locked for a subscription as noted above. (Submitted: Jan 26, 2016 7:17:26 AM MST)
Answer
- The typographic error has been corrected. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 154
RFP Section 5.5.13 (M) Offeror must provide a statement certifying that it cannot change the SLA in any manner that adversely affects a Purchasing Entity or degrades the service levels applicable to a Purchasing Entity, without the Purchasing Entityâ€™s written approval. Clarifying Statement Microsoftâ€™s SLAs are administered in a consistent and in some cases automated way for all its customers, and may therefore not be customized. For any given cloud service, our SLA in effect as of the time a subscription order is first placed is locked and will not change during the term of a subscription order. Upon renewal of a customerâ€™s subscription order, Microsoftâ€™s then-current SLA will supersede the previous SLA. The Purchasing Entityâ€™s renewal of its subscription will constitute its written approval of the then-current (new) SLA.

Microsoftâ€™s historical practice has been to improve its SLAs over time, and we have never before adversely changed any SLA terms.

However, our SLAs may not be customized for any customer, and we must reserve the right to change SLAs over time at our sole discretion. (Submitted: Jan 26, 2016 7:18:35 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 155
Part 1:

Offeror must provide a statement acknowledging that no click-through, or other end user terms and conditions or agreements required by the Contract Vendor (â€œAdditional Termsâ€ ) provided with any Services hereunder shall be binding on Participating Entities or Purchasing Entities, even if use of such Services requires an affirmative â€œacceptanceâ€ of those Additional Terms before access is permitted, unless agree to in the Master Agreement Terms and Conditions or in a Participating Addendum.

Exception and Clarifying Statement.

Contractual commitment: For the Microsoft Online Services sold and licensed to Purchasing Entities hereunder, no click-through licensing terms presented to end users or administrators, as they pertain to the delivery, operation or use of such services, shall be binding. For clarity, to the extent that certain services may present terms of use for a web portal used to administer and configure the Online Services, or to download software in conjunction with the Online Services, such terms of use shall be binding, to the extent that there are no equivalent terms and conditions in the Master Agreement which pertain to the use of such web portals. (Submitted: Jan 26, 2016 7:19:47 AM MST)
Answer
- All terms and conditions that an Offeror believes will apply must be disclosed and provided under the Master Agreement. (Answered: Jan 28, 2016 9:57:54 AM MST)
Question 156
Part 2
Other than the foregoing, Microsoft respectfully takes exception to the additional requirement in this section 5.5.14 State of Utah Bid CH16012
3/22/2016 4:23 PM p. 326
#2..
- 370 -
Answer
- All terms and conditions that an Offeror believes will apply must be disclosed and provided under the Master Agreement. (Answered: Jan 28, 2016 9:57:54 AM MST)
Question 156
Part 2
Other than the foregoing, Microsoft respectfully takes exception to the additional requirement in this section 5.5.14 that would prevent any other form of â€œAdditional Termsâ€ from applying. Specifically:
(1) Because Microsoft is constantly adding to its list of Azure (and some other) Online Services, Microsoft must rely on URL-published lists of these Online Services in order to update its customers about such things as (i) whether they are included in Microsoftâ€™s Government Community Cloud; (ii) whether they are subject to particular certifications; etc.
(2) Microsoft publishes and regularly updates its Microsoft Online Services Terms (OST), which are incorporated into the terms and conditions of the Master Agreement applicable to Purchasing Entities and include (but are not limited to) both licensing and security/privacy terms and conditions, both generally and on a product-specific basis. Offeror has attached with its Proposal a copy of the latest version of the OST. Microsoft endeavors to improve the terms and conditions of the OST over time, and also must reasonably be able to update its terms in order to accommodate new products and changes to existing technology.

As such, Offeror and its subcontractor Microsoft will be willing to stipulate the following:

A. The mutually-agreed terms of the Master Agreement and Participating Addenda will take precedence over the OST, in the event of a conflict between them.

B. With respect to any individual subscription for an individual Online Service, changes to the OST during the term of the subscription shall not apply unless a Purchasing Entity elects to apply them. At the onset of a subsequent renewal subscription term, the then-current OST shall apply. (Submitted: Jan 26, 2016 7:24:09 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 157
RFP Section 5.6.2 (M) Offeror must provide a statement certifying that its Service Level Agreement must define the performance and other operating parameters within which the infrastructure must operate to meet IT System and Purchasing Entityâ€™s requirements. Exception
Microsoft respectfully takes exception to this requirement as unreasonable. It is impossible for the provider of a standardized multi-tenant cloud service, provided uniformly to thousands of customers and millions of users, to design that service to meet each and every one of its customerâ€™s individual requirements. Microsoft transparently provides information about its Online Services to all customers so that they may judge for themselves whether the Online Services meet their needs. (Submitted: Jan 26, 2016 7:24:32 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 158
Due to the size of the following question the reference info will be in this question and the question in the following entry:

RFP Section 5.6.4 (M)
Also RFP Section 5.6.5 (M) (identical)
Also RFP Section 8.6.1 (E)
Also RFP Section 8.6.2 (E)
Also RFP Section 8.6.6 (E)
Offeror must provide a statement certifying that it is NIST compliant with the service models it offers.

Specify your commitment to your commitment to comply with NIST, and any other relevant industry standards, as it relates to the Scope of Services described in this RFP, including supporting the different types of data that you may receive. You should include detailed response on how you plan to maintain security certifications.

List all government or standards organization security certifications you currently hold that apply specifically to the hosted environment described in your firmâ€™s RFP response, as well as those in process at time of response.

Specifically include HIPAA, FERPA, CJIS Security Policy, PCI Data Security Standards (DSS), IRS Publication 1075, FISMA, NIST 800-53, NIST SP 800-171, and FIPS 200 if they apply.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 327
#2..
- 371 -
Specify your commitment to your commitment to comply with NIST, and any other relevant industry standards, as it relates to the Scope of Services described in this RFP, including supporting the different types of data that you may receive. You should include detailed response on how you plan to maintain security certifications.

Specifically include HIPAA, FERPA, CJIS Security Policy, PCI Data Security Standards (DSS), IRS Publication 1075, FISMA, NIST 800-53, NIST SP 800-171, and FIPS 200 if they apply.

Provide a detailed list of the third-party attestations, reports, security credentials (e.g., FedRamp), and certifications relating to data security, integrity, and other controls. (Submitted: Jan 26, 2016 7:27:21 AM MST) Answer
- I do not see a question in this question. (Answered: Jan 28, 2016 2:00:48 PM MST) Question 159
part 1:

Microsoft will agree that, during the term of a Purchasing Entityâ€™s subscription for its â€œGovernment Community Cloud Servicesâ€ (as defined in Microsoftâ€™s terms and conditions), those services will be operated in accordance with a written data security policy and control framework that is consistent with the requirements of NIST 800-53 Revision 4, or successor standards and guidelines (if any), established to support Federal Risk and Authorization Management Program (FedRAMP) accreditation at a Moderate Impact level.

Microsoft intends for Government Community Cloud Services to support FedRAMP Authority to Operate (ATO), and Microsoft will use commercially reasonable efforts to obtain an ATO from a Federal agency, and to maintain such ATO through continuous monitoring processes and by conducting regular FedRAMP audits.

Also see the Microsoft Trust Center at https://www.microsoft.com/en-us/TrustCenter/default.aspx and click on the applicable link for information about Microsoftâ€™s compliance and adherence to other standards, such as CJIS, IRS 1075, HIPAA, FERPA, ISO/IEC 27001 and (Submitted: Jan 26, 2016 7:29:35 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 160
part 2:
27018, SOC1 and 2, and others. Also, please refer to our Exception and Clarifying Statements for Attachment A, Section 17, below in this document. Please note that some of these standards apply only to certain services (e.g.

CJIS applies only our Government Community Cloud services) and that some of them require special Amendments and/or Agreements (e.g. CJIS requires that a Stateâ€™s CJIS Systems Agency must execute a special agreement with Microsoft, before Microsoft will provide an FBI CJIS Addendum for use in each such state).

Microsoft welcomes the opportunity to discuss this in more detail during negotiation.

Additionally, for the commercial and education versions of Office 365 Services (which are not Government Community Cloud Services), Microsoft Dynamics CRM Online Services, Microsoft Azure Core Services, and Microsoft Intune Online Services (each, as defined in the Microsoft Online Services Terms), each such Microsoft Online Service Each Online Service follows a written data security policy (â€œInformation Security Policyâ€ ) that complies with the control standards and frameworks shown in the table below. (Submitted: Jan 26, 2016 7:30:13 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 161
Part I: Question will be part 2:

RFP Section 5.6.6 (M)
Also RFP Section 8.8.2, subsections c and d (E) Offeror must provide a statement certifying that it on request you can isolate that data to servers and data centers residing entirely in the United States of America or its territories.

Explain and specify methodologies for the following backup and restore services:
c. Digital location of backup storage (secondary storage, tape, etc.) d. Alternate data center strategies for primary data centers within the continental United States. (Submitted: Jan 26, 2016 7:53:32 AM MST)
Answer
- I do not see a question in this question. (Answered: Jan 28, 2016 2:00:48 PM MST) Question 162
Exception and Clarifying Statement
For its Government Community Cloud Services (as defined in Microsoftâ€™s service terms and conditions), or â€œGCC,â€ Customer Content is stored at rest in the United States. In the cases of the GCC versions of Exchange Online, SharePoint Online, Skype for Business, and Dynamics CRM Online, the Customer Content is stored in encrypted format, whereas in the GCC version of Azure Core Services, customers are given the option to encrypt non-public Customer Content.

For the non-GCC (public) versions of the equivalent services, as well as for Microsoft Intune Online Services, State of Utah Bid CH16012
3/22/2016 4:23 PM p. 328
#2..
- 372 -
Question 162
Exception and Clarifying Statement
For its Government Community Cloud Services (as defined in Microsoftâ€™s service terms and conditions), or â€œGCC,â€ Customer Content is stored at rest in the United States. In the cases of the GCC versions of Exchange Online, SharePoint Online, Skype for Business, and Dynamics CRM Online, the Customer Content is stored in encrypted format, whereas in the GCC version of Azure Core Services, customers are given the option to encrypt non-public Customer Content.

For the non-GCC (public) versions of the equivalent services, as well as for Microsoft Intune Online Services, certain types of Customer Content are stored at rest in the United States, if set up by the users in the United States. The terms and conditions governing where Customer Data will be stored may be found in the Microsoft Online Services Terms. Finally, for the non-GCC version of Azure Core Services, customers are given the choice of which of Microsoftâ€™s worldwide data centers to store and/or process data in.

For purposes of the above, â€œCustomer Contentâ€ means the subset of Customer Data created by users.

For Office 365 Services, Customer Content shall at least include Exchange Online mailbox content (e-mail body, calendar entries, and the content of e-mail attachments), SharePoint Online site content and the files stored within that site, and Skype for Business Online archived conversations. For Microsoft Dynamics CRM Online Services, Customer Content shall be the entities of Customer Data managed by the Microsoft Dynamics CRM Online Services (Submitted: Jan 26, 2016 7:55:58 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 163
RFP Section 5.6.7 (M) Offeror must provide a statement certifying that it will comply with all applicable laws and related to data privacy and security, which will be defined in the relevant Participating Addendum and/or Service Level Agreement. Exception
Microsoft will comply with all applicable laws (including but not limited to privacy and security related laws) applicable to IT service providers. For clarity, however, Microsoft does not agree to comply with laws written to apply solely to governments and their government functions (or to companies and their industry functions). For example, some laws pertaining to notification of security incidents apply to our government customers (not to IT Service Providers), so Microsoft does not agree to comply with those (but we believe our contractual commitments for Security Incident reporting are sufficient to help customers comply with their own laws).

Additionally, Microsoft respectfully declines to agree in advance to comply with laws to be listed in Participating Addenda, as Microsoft cannot reasonably be expected to review (and determine applicability of) all the possible laws that Participating States may list on those in the future. Microsoft sincerely hopes that its general contractual commitment to comply with all laws applicable to IT Service Providers will satisfy all Participating States. (Submitted: Jan 26, 2016 7:56:24 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 164
RFP Section 5.6.14 (M)
Also RFP Section 8.18 (E) (5.6.14) If applicable, Offeror must provide a statement certifying that its applicationhosting environments also support a user test/staging environment that is identical to production. (8.18) Describe your testing and training periods that your offer for your service offerings. Clarifying Statement For RFP Section 5.6.14, Microsoft asserts the following:
a. Microsoft currently, as of the date of the Proposal, has a mechanism by which 30-day Trial subscriptions may be ordered for some, but not all, of the cloud services offered hereunder. Microsoft will provide additional information about this upon request of Lead State, Participating States, or any Purchasing Entity. b. It is possible for any Purchasing Entity to purchase a separate subscription for the purpose of establishing a second environment for test and/or staging purposes. Such separate Subscription would be at an additional cost, and additional contract paperwork may be required. (Submitted: Jan 26, 2016 7:56:57 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 165

TECHNICAL REQUIREMENTS
<Long section, not printed here â€“ these notes and disclaimers apply to the Section as a whole, although we will also address individual subsections, below.> Clarifying Statement.

The Microsoft Online Services in this Proposal provide highly-scalable and configurable solutions to address each customerâ€™s stated business needs in a cost-effective manner. These Online Services are multi-tenant â€œcloudâ€ solutions hosted by Microsoft, operating on standardized terms, protocols and procedures.

Microsoft is not able to customize the Online Services or their operational protocols for any individual government customer.

As with any standardized cloud service, Microsoft expects to evolve and improve the features and functions of these Online Services. For that reason, Microsoft reserves the right to update and change features and functionality described in this response during the term of the agreement between parties.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 329
#2..
- 373 -
The Microsoft Online Services in this Proposal provide highlyscalable and configurable solutions to address each customerâ€™s stated business needs in a cost-effective manner. These Online Services are multi-tenant â€œcloudâ€ solutions hosted by Microsoft, operating on standardized terms, protocols and procedures.

Microsoft is not able to customize the Online Services or their operational protocols for any individual government customer.

The features and functionality listed in the Proposal represent the Microsoft Online Services as of our response date, but neither Offeror nor Microsoft can guarantee that these features and functions will not change over time.

Microsoft generally provides advance notice to its customers of major changes, but might not in all cases notify regarding minor changes. It is Microsoftâ€™s goal to improve the service over time. (Submitted: Jan 26, 2016 7:57:44

AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 166
RFP Section 8.4.1 (3rd bullet point) (E) Service Level Agreement (SLA). Please note that the terms and conditions of this RFP and all exhibits take precedence over any conflicting terms and conditions in the SLA.

Exception
Microsoft respectfully takes exception to this requirement. Microsoftâ€™s SLA applies to standardized cloud services that cannot be customized for any one customer, as they are delivered uniformly to all customers. The process by which Microsoft administers its SLA is also standardized, relying upon both automated processes and standard operating procedures. As such, Microsoft cannot reasonably be expected to conform to any of its customersâ€™ individual SLAs. (Submitted: Jan 26, 2016 7:58:07 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 167
Certify that all traffic to and from the hosting environment can and will be guaranteed to stay within the United States. Exception and Clarifying Statement
Microsoft respectfully takes exception to this requirement, as it is impossible to restrict data flowing through the public Internet (through which traffic to and from the hosting environment passes) to the United States. This is the case for all internet-based cloud services from all vendors.

For an additional fee, Microsoft offers optional services such as private IPSec VPN or ExpressRoute to provide a direct connection between a Purchasing Entityâ€™s network equipment and Microsoftâ€™s Online Services offered hereunder. The private IPSec VPN service provides a protected connection over the internet between the Purchasing Entityâ€™s network and Microsoftâ€™s Online Services. ExpressRoute provides a direct network connection between the Purchasing Entityâ€™s network and Microsoftâ€™s Online Services bypassing the Internet. (Submitted: Jan 26, 2016 7:58:31 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 168
RFP Section 8.10 (E) Describe whether your sample Service Level Agreement is negotiable. Clarifying Statement
Microsoftâ€™s Service Level Agreement is not negotiable, as it pertains to standardized multitenant cloud services, uniformly delivered to many thousands of customers and millions of users, and relies upon automated processes and standard operating procedures. (Submitted: Jan 26, 2016 7:59:00 AM MST) Answer
- Responses to the RFP document need to be provided in an Offeror's proposal, not during the Question and Answer period. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 169
RFP Section 8.16 Ability to provide anti-virus protection, for data stores. Clarifying Statement For Office 365 Services, Microsoft Azure Core Services, Microsoft Dynamics CRM Online Services, and Microsoft Intune Online Services (as each is defined in the Microsoft Online Services Terms), Microsoft will implement and maintain all appropriate administrative, physical, technical and procedural safeguards in accordance with the terms and conditions of the Microsoft Online Services Terms, at all times during the term of the Master Agreement, to secure Customer Data from Security Incident, protect Customer Data and the applicable Online Services from hacks, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt a customerâ€™s access to its Customer Data.

Additionally, see the section of Microsoftâ€™s Service Level Agreement pertaining to anti-virus. (Submitted: Jan 26, 2016 7:59:36 AM MST)
Answer
- Responses to the RFP document need to be provided in an Offeror's proposal, not during the Question and Answer period. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 170
RFP Section 8.16 Ability to provide anti-virus protection, for data stores. Clarifying Statement For Office 365 Services, Microsoft Azure Core Services, Microsoft Dynamics CRM Online Services, and Microsoft Intune Online Services (as each is defined in the Microsoft Online Services Terms), Microsoft will implement and maintain all appropriate administrative, physical, technical and procedural safeguards in accordance with the terms and conditions of the Microsoft Online Services Terms, at all times during the term of the Master Agreement, to secure Customer Data from Security Incident, protect Customer Data and the applicable Online Services from hacks, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt a customerâ€™s access to its Customer Data.

Additionally, see the section of Microsoftâ€™s Service Level Agreement pertaining to anti-virus. (Submitted: Jan 26, 2016 8:03:29 AM MST)
Answer
- Responses to the RFP document need to be provided in an Offeror's proposal, not during the Question and Answer period.

Any response/question will not be considered part of an Offeror's response if it is posted on Bidsync. (Answered:

Jan 26, 2016 8:18:40 AM MST)
Question 171
RFP Section 8.23 In responding to this section, please review the Cyber Insurance requirements in Attachment 5 RFP Section 8.23 In responding to this section, please review the Cyber Insurance requirements in Attachment A: Master Agreement Terms and Conditions. Describe if you have cyber insurance; and if so what is the coverage and what levels of protection does it provide to Purchasing Entities. Please see our Exception and Clarifying Statement, below, for Attachment A, Section 16. (Submitted: Jan 26, 2016 8:03:52 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:18:40 AM MST)
Question 172
Attachment A, Section 2, definition of â€œConfidential Informationâ€ Confidential Information means any and all information of any form that is marked as confidential or would by its nature be deemed confidential obtained by Contractor or its employees or agents in the performance of this Master Agreement, including, but not necessarily limited to (1) any Purchasing Entityâ€™s records, (2) personnel records, and (3) information concerning individuals, is confidential information of Purchasing Entity. Exception Microsoft requests the following alternative definition, which we believe is no less protective and is more appropriate for a cloud services contract, to the extent it contemplates Customer Data. We have merged much of the RFPâ€™s definition into ours.
â€œConfidential Informationâ€ is non-public information that is designated â€œconfidentialâ€ or that a reasonable person should understand to be confidential, including (1) Customer Data; (2) any Purchasing Entityâ€™s records, (3) personnel records, and (4) information concerning individuals. Confidential Information does not include information that (a) becomes publicly available without a breach of this agreement, (b) was lawfully known or received by the receiving party without an obligation to keep it confidential, (c) is independently developed, or (d) is a comment or suggestion one party volunteers about the otherâ€™s business, products or services.â€ (Submitted: Jan 26, 2016 8:04:31 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:18:40 AM MST)
Question 173
Data means all information, whether in oral or written (including electronic) form, created by or in any way originating with a Participating Entity or Purchasing Entity, and all information that is the output of any computer processing, or other electronic manipulation, of any information that was created by or in any way originating with a Participating Entity or Purchasing Entity, in the course of using and configuring the Services provided under this Agreement.

Exception
Microsoft respectfully request to use its definition (see below). Issues with the RFPâ€™s definition are as follows:
1) The RFPâ€™s definition conflates electronic data with oral and other written data. Microsoft necessarily divides these into separate categories: (a) data stored and processed by our Online Services, which Microsoft calls â€œCustomer Dataâ€ in its documents and is subject to the protections of Microsoftâ€™ robust Online Services Terms; vs. (b) other types of data exchanged between the parties which, if that data meets the definition of Confidential Information, will be protected solely by the confidentiality terms. To provide just one example of relevance, Customer Data stored on our servers used to provide our Government Community Cloud Services will be subjected to NIST 800-53 controls necessary to meet the FedRAMP Moderate specification, whereas oral data exchanged between the parties will not be subjected to those controls (although, if confidential, will be treated as such)
(SbittdJ262016 80933 AM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 331
#2..
- 375 -
these into separate categories: (a) data stored and processed by our Online Services, which Microsoft calls â€œCustomer Dataâ€ in its documents and is subject to the protections of Microsoftâ€™ robust Online Services Terms; vs. (b) other types of data exchanged between the parties which, if that data meets the definition of Confidential Information, will be protected solely by the confidentiality terms. To provide just one example of relevance, Customer Data stored on our servers used to provide our Government Community Cloud Services will be subjected to NIST 800-53 controls necessary to meet the FedRAMP Moderate specification, whereas oral data exchanged between the parties will not be subjected to those controls (although, if confidential, will be treated as such). (Submitted: Jan 26, 2016 8:09:33 AM MST)
Answer
- The definition of "Data" is contained in the Master Agreement Terms and Conditions. As such, an Offeror should not be taking exception to the terms and conditions during the the questions and answer period.

As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:18:40 AM MST)
Question 174
Data means all information, whether in oral or written (including electronic) form, created by or in any way originating with a Participating Entity or Purchasing Entity, and all information that is the output of any computer processing, or other electronic manipulation, of any information that was created by or in any way originating with a Participating Entity or Purchasing Entity, in the course of using and configuring the Services provided under this Agreement.

Question 2:
) The RFPâ€™s definition would treat metadata (e.g. data generated by the systems of an Online Services based upon the analysis or categorization of Customer Data) equally with the data input by Purchasing Entities. Metadata will be used by Microsoft only for the provision of the Online Services, including but not limited to spam and virus filtering, data loss prevention, spillage support, transaction logs, temp files, and memory buffers.. Neither Customer Data nor metadata will be used by Microsoft for purposes of data mining to target advertisements to users. However, unlike Customer Data, Microsoft retains ownership of metadata and customers may not delete or extract it.

Proposed alternative language:
â€œCustomer Dataâ€ means all data, including all text, sound, software, or image files that are provided to Microsoft by, or on behalf of, an Enrolled Affiliate through its use of the Online Services. All references to â€œDataâ€ in the Master Agreement shall be deemed to mean customer data. (Submitted: Jan 26, 2016 8:10:21

AM MST)
Answer
- The definition of "Data" is contained in the Master Agreement Terms and Conditions. As such, an Offeror should not be taking exception to the terms and conditions during the the questions and answer period.

As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:18:40 AM MST)
Question 175
Attachment A, Section 2, Definitions of â€œData Breachâ€ and â€œSecurity Incidentâ€ Data Breach means any actual or reasonably suspected non-authorized access to or acquisition of computerized Non-Public Data or Personal Data that compromises the security, confidentiality, or integrity of the Non-Public Data or Personal Data, or the ability of Purchasing Entity to access the Non-Public Data or Personal Data.

Security Incident means the possible or actual unauthorized access to a Purchasing Entityâ€™s Non-Public Data and Personal Data the Contractor believes could reasonably result in the use, disclosure or theft of a Purchasing Entityâ€™s Non-Public Data within the possession or control of the Contractor. A Security Incident also includes a major security breach to the Contractorâ€™s system, regardless if Contractor is aware of unauthorized access to a Purchasing Entityâ€™s Non-Public Data. A Security Incident may or may not turn into a Data Breach.

Suggested alternative language:
â€œSecurity Incidentâ€ means any unlawful access, use, theft or destruction to any Customer Data stored on Microsoftâ€™s equipment or in Microsoftâ€™s facilities, or unauthorized access to such equipment or facilities resulting in use, theft, loss, disclosure, alteration or destruction of Customer Data. All references to â€œData Breachâ€ in the Master Agreement shall be deemed to mean Security Incident (Submitted: Jan 26, 2016 8:24:43 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 176
Because of the maximum, this question will be in two parts. The first is the language and the second is question:

Part I:

Attachment A, Section 2, Definitions of â€œData Breachâ€ and â€œSecurity Incidentâ€ Data Breach means any actual or reasonably suspected non-authorized access to or acquisition of computerized Non-Public Data or State of Utah Bid CH16012
3/22/2016 4:23 PM p. 332
#2..
- 376 -
answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 176
Because of the maximum, this question will be in two parts. The first is the language and the second is question:

Part I:

Attachment A, Section 2, Definitions of â€œData Breachâ€ and â€œSecurity Incidentâ€ Data Breach means any actual or reasonably suspected non-authorized access to or acquisition of computerized Non-Public Data or Personal Data that compromises the security, confidentiality, or integrity of the Non-Public Data or Personal Data, or the ability of Purchasing Entity to access the Non-Public Data or Personal Data.

Jan 26, 2016 8:25:51 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 177
Part 2
Exception.

Microsoft respectfully takes exception with both these definitions, and asks that both of them be consolidated into a single defined term â€œSecurity Incidentâ€ using the alternative language proposed by Microsoft below, for the following reasons:
1) Microsoft maintains standardized multitenant Online Services that involve standardized processes, including but not limited to the processes involved with notification and mitigation of Security Incidents. Microsoft cannot feasibly customize its Security Incident processes.
2) Microsoftâ€™s processes do not recognize any distinction between â€œData Breachâ€ and â€œSecurity Incident.â€ Microsoft defines â€œSecurity Incidentâ€ (below) to describe precisely what sort of event will be reported to customers pursuant to Microsoftâ€™s standard processes. 3) Neither Microsoft, nor any other provider of similar multitenant cloud services we are aware of, report suspected Security Incidents. We constantly monitor for events that raise suspicions, and investigate those accordingly. But the number of suspected incidents we investigate is large. It is only when we confirm that a Security Incident has actually happened that we report it.
4) Neither Microsoftâ€™s processes, nor those of our similarly-situated competitors providing standardized multitenant cloud services, include reporting of events that do not result in loss, disclosure or alteration of Customer Data. (Submitted: Jan 26, 2016 8:26:25 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 178
Because of space allowed, first we are listing the RFP language. Part 2 will be the exceptions/clarifications:

Attachment A, Section 2, definition of â€œProtected Health Informationâ€ Protected Health Information (PHI) means individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by the Family Educational Rights and Privacy Act (FERPA), as amended, 20 U.S.C. 1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv) and employment records held by a covered entity in its role as employer. PHI may also include information that is a subset of health information, including demographic information collected from an individual, and (1) is created or received by a health care provider, health plan, employer or health care clearinghouse; and (2) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (a) that identifies the individual; or (b) with respect to which there is a reasonable basis to believe the information can be used to identify the individual. (Submitted: Jan 26, 2016 8:27:53 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 179
Part 2:

Exception:

Microsoft does not object to defining PHI as is defined in statute. However, to the extent that the definition in statute may change, the RFP (by fixing the definition to the current one) would create conflict if, in the future, the definition in statute is updated.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 333
#2..
- 377 -
answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 179
Part 2:

Exception:

Additionally, for purposes of Microsoftâ€™s role as Business Associate with respect to PHI processed in our Online Services, we respectfully request to clarify that only that which is stored and processed by those Online Services will apply.

We therefore respectfully request the following alternative language be used:
â€œProtected Health Informationâ€ shall have the same meaning as the term â€œprotected health informationâ€ in 45 CFR Â§ 160.103 of HIPAA, provided that it is limited to such protected health information that is received by Microsoft from, or created, received, maintained, or transmitted by Microsoft on behalf of, Customer. (Submitted: Jan 26, 2016 8:28:32 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 180
Attachment A, Section 2, definition of â€œService Level Agreementâ€ Service Level Agreement (SLA) means a written agreement between both the Purchasing Entity and the Contractor that is subject to the terms and conditions in this Master Agreement and relevant Participating Addendum unless otherwise expressly agreed in writing between the Purchasing Entity and the Contractor. SLAs should include: (1) the technical service level performance promises, (i.e. metrics for performance and intervals for measure), (2) description of service quality, (3) identification of roles and responsibilities, (4) remedies, such as credits, and (5) an explanation of how remedies or credits are calculated and issued. Exception.

Microsoftâ€™s SLA reflects standardized and automated processes by which service credits are provided in the event that certain performance standards are not adhered to, as stated in the SLA document. As stated in our response to Section 8.10 of the RFP, Microsoftâ€™s SLA is not negotiable, to the extent that Microsoft must reasonably administer our SLA in a uniform manner for all its customers.

Microsoft therefore respectfully requests to use the following alternative language:
â€œService Level Agreementâ€ (SLA) means the document which specifies the standards to which Microsoft agrees to adhere and by which it measures the level of service for an Online Service. Microsoftâ€™s current and archived prior version SLAs are available at the Microsoft Volume Licensing Site (www.microsoft.com/contracts of a successor site). With respect to any Microsoft Online Service ordered under the Maser Agreement, the most current SLA available at the onset of a subscription License term shall apply to that Online Service for the duration of that subscription License Term, after which (for any subsequent renewal subscription License term) it will be superseded by the version current at the time of renewal. (Submitted: Jan 26, 2016 8:28:58 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 181
Because of the entry limit part 1 is the RFP language and our second question will be the exception question; Attachment A, Section 7 Termination: Unless otherwise stated, this Master Agreement may be terminated by either party upon 60 days written notice prior to the effective date of the termination. Further, any Participating Entity may terminate its participation upon 30 days written notice, unless otherwise limited or stated in the Participating Addendum. Termination may be in whole or in part. Any termination under this provision shall not affect the rights and obligations attending orders outstanding at the time of termination, including any right of any Purchasing Entity to indemnification by the Contractor, rights of payment for Services delivered and accepted, data ownership, Contractor obligations regarding Purchasing Entity Data, rights attending default in performance an applicable Service Level of Agreement in association with any Order, Contractor obligations under Termination and Suspension of Service, and any responsibilities arising out of a Security Incident or Data Breach. Termination of the Master Agreement due to Contractor default may be immediate. (Submitted: Jan 26, 2016 8:30:17 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 182
Part 2:

Exception.

Microsoft respectfully requests a cure period before any termination for default becomes effective, provided that a breach is curable. To that end, we respectfully request to modify that last sentence accordingly. In addition, we have found and corrected a few typographical errors in the original language.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 334
#2..
- 378 -
answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 182
Part 2:

Exception.

Proposed revision:

Termination: Unless otherwise stated, this Master Agreement may be terminated by either party upon 60 days written notice prior to the effective date of the termination. Further, any Participating Entity may terminate its participation upon 30 days written notice, unless otherwise limited or stated in the Participating Addendum.

Termination may be in whole or in part. Any termination under this provision shall not affect the rights and obligations attending orders outstanding at the time of termination, including any right of any Purchasing Entity to indemnification by the Contractor, rights of payment for Services delivered and accepted, data ownership, Contractor obligations regarding Purchasing Entity Data, rights attending default in performance of an applicable Service Level Agreement in association with any Order, Contractor obligations under Termination and Suspension of Service, and any responsibilities arising out of a Security Incident or Data Breach. Termination of the Master Agreement due to Contractor default may be immediate if defaults cannot be reasonably cured as allowed per Default and Remedies terms. (Submitted: Jan 26, 2016 8:30:47 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 183
This question will be spread out over 4 questions because of the size:

Part 1 of RFP Language
Subsection b.) Non-Disclosure. Contractor shall hold Confidential Information in confidence, using at least the industry standard of confidentiality, and shall not copy, reproduce, sell, assign, license, market, transfer or otherwise dispose of, give, or disclose Confidential Information to third parties or use Confidential Information for any purposes whatsoever other than what is necessary to the performance of Orders placed under this Master Agreement. Contractor shall advise each of its employees and agents of their obligations to keep Confidential Information confidential. Contractor shall use commercially reasonable efforts to assist Purchasing Entity in identifying and preventing any unauthorized use or disclosure of any Confidential Information. Without limiting the generality of the foregoing, Contractor shall advise Purchasing Entity, applicable Participating Entity, (Submitted: Jan 26, 2016 8:32:48 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 184
Part 2 RFP language:
and the Lead State immediately if Contractor learns or has reason to believe that any person who has had access to Confidential Information has violated or intends to violate the terms of this Master Agreement, and Contractor shall at its expense cooperate with Purchasing Entity in seeking injunctive or other equitable relief in the name of Purchasing Entity or Contractor against any such person. Except as directed by Purchasing Entity, Contractor will not at any time during or after the term of this Master Agreement disclose, directly or indirectly, any Confidential Information to any person, except in accordance with this Master Agreement, and that upon termination of this Master Agreement or at Purchasing Entityâ€™s request, Contractor shall turn over to Purchasing Entity all documents, papers, and other matter in Contractor's possession that embody Confidential Information. (Submitted:

Jan 26, 2016 8:33:25 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 185
exceptions from previous 2 'questions':

Exception
First, in Subsection b., Microsoft respectfully request to strike the sentence â€œContractor shall use commercially reasonable efforts to assist Purchasing Entity in identifying and preventing any unauthorized use or disclosure of any Confidential Information.â€œ This is unreasonable to expect either Offeror or its subcontractor and service provider, Microsoft, to do, to the extent that how any end user may or may not use a service is beyond the scope of control of any outside party. Having said this, some of Microsoftâ€™s Online Services Licenses include Data Loss Prevention (DLP) technology, which may be able to assist Purchasing Entities in this regard. Additional technical and licensing information about DLP is available upon request.

Next, in the following sentence (beginning with â€œWithout limiting the generalityâ€¦â€ , Microsoft respectfully State of Utah Bid CH16012
3/22/2016 4:23 PM p. 335
#2..
- 379 -
First, in Subsection b., Microsoft respectfully request to strike the sentence â€œContractor shall use commercially reasonable efforts to assist Purchasing Entity in identifying and preventing any unauthorized use or disclosure of any Confidential Information.â€œ This is unreasonable to expect either Offeror or its subcontractor and service provider, Microsoft, to do, to the extent that how any end user may or may not use a service is beyond the scope of control of any outside party. Having said this, some of Microsoftâ€™s Online Services Licenses include Data Loss Prevention (DLP) technology, which may be able to assist Purchasing Entities in this regard. Additional technical and licensing information about DLP is available upon request.

Next, in the following sentence (beginning with â€œWithout limiting the generalityâ€¦â€ , Microsoft respectfully requests to change the word â€œpersonâ€ to â€œof Contractorâ€™s Employees,â€ to the extent that Contractor only has visibility to and control over the actions of its own employees.

Finally, because Customer Data is considered Confidential Information, and because Microsoft reasonably must be able to limit its liability in the event of a Security Incident. Except in the case of gross negligence or willful misconduct, Microsoft reasonably limits its liability with respect to Security Incidents (see our next Exceptions, in which we request a Limitation of Liability section, for additional details). Microsoft therefore respectfully requests to add the following subsection e to Section 8, as follows:
e. Notwithstanding the foregoing, damages attributable to Security Incidents shall be subject to the Section of the Master Agreement titled â€œLimitation of Liability.â€ (Submitted: Jan 26, 2016 8:34:11 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 186
Part 1:

Microsoft respectfully requests that the following additional Section, titled â€œLimitation of Liability,â€ be inserted into Attachment A as Section 43, and that the existing Section 43, titled â€œEntire Agreement,â€ be renumbered as Section 44.

Note that â€œAffiliateâ€ will be defined as:
ïƒ˜ For a Purchasing Entity, any entity eligible to purchase under the Master Agreement or a Participating Addendum to which a Purchasing Entity sublicenses the use of the Online Service. ïƒ˜ For Microsoft, any company that Microsoft owns, that owns Microsoft, or is under common ownership with Microsoft.

Proposed language:

43. Limitation of Liability for Microsoft Online Services. The parties agree that, other than Online Services, no other Microsoft Products shall be sold pursuant to the Master Agreement. As applicable to Online Services, the following terms and conditions shall apply: (Submitted: Jan 26, 2016 8:36:45 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 187
Part 2:
a. General. The total liability of each party for a purchase hereunder (Microsoft and each Purchasing Entity), including their Affiliates and contractors, for claims arising under the Master Agreement is limited to direct damages up to the amount a Purchasing Entity paid for the Online Service during the prior 12 months before the cause of action arose; but in no event will a partyâ€™s aggregate liability for any Online Service exceed the total amount paid for that Online Service under this Agreement. In the case of Online Services provided free of charge, previews, or code that a Purchasing Entity is authorized to redistribute to third parties without separate payment to Contractor, Microsoftâ€™s liability is limited to direct damages up to U.S. $5,000. These limitations apply regardless of whether the liability is based on breach of contract, tort (including negligence), strict liability, breach of warranties, or any other legal theory.
b. Affiliates and contractors. Microsoft and Purchasing Entity each agree not to bring any action against the otherâ€™s Affiliates or contractors in respect of any matter disclaimed on their behalf in this Agreement. Each party will be responsible for its actions in the event of any breach of this provision. (Submitted: Jan 26, 2016 8:38:53

AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 188
Part 3:
c. EXCLUSION OF CERTAIN DAMAGES. Neither party nor their Affiliates or contractors will be liable for any indirect, consequential, special or incidental damages, or damages for lost profits, revenues, business interruption, or loss of business information in connection with this agreement, even if advised of the possibility of such damages or if such possibility was reasonably foreseeable. d. Limits. The limits and exclusions in this section titled â€œLimitation of liabilityâ€ do not apply to either partyâ€™s (1) obligations under the section titled â€œDefense of third party claimsâ€ , (2) liability for damages State of Utah Bid CH16012
3/22/2016 4:23 PM p. 336
#2..
- 380 -
Question 188
Part 3:
c. EXCLUSION OF CERTAIN DAMAGES. Neither party nor their Affiliates or contractors will be liable for any indirect, consequential, special or incidental damages, or damages for lost profits, revenues, business interruption, or loss of business information in connection with this agreement, even if advised of the possibility of such damages or if such possibility was reasonably foreseeable. d. Limits. The limits and exclusions in this section titled â€œLimitation of liabilityâ€ do not apply to either partyâ€™s (1) obligations under the section titled â€œDefense of third party claimsâ€ , (2) liability for damages caused by either partyâ€™s gross negligence or willful misconduct, or that of its employees or its agents, and awarded by a court of final adjudication (provided that, in jurisdictions that do not recognize a legal distinction between â€œgross negligenceâ€ and â€œnegligence,â€ â€œgross negligenceâ€ as used in this subsection shall mean â€œrecklessnessâ€ ); and (3) liability for violation of its confidentiality obligations (except obligations related to Customer Data) or the other partyâ€™s intellectual property rights. (Submitted: Jan 26, 2016 8:39:39 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 189
Attachment A, Section 10, Subsection a(4) (4) Institution of proceedings under any bankruptcy, insolvency, reorganization or similar law, by or against Contractor, or the appointment of a receiver or similar officer for Contractor or any of its property, which is not vacated or fully stayed within thirty (30) calendar days after the institution or occurrence thereof; or
Exception
Microsoft respectfully requests to make this paragraph reciprocal. Please see the following proposed revised language:
(4) Institution of proceedings under any bankruptcy, insolvency, reorganization or similar law, by or against either party to this Master Agreement or to a Participating State or Purchasing Entity, or the appointment of a receiver or similar officer for any such party or any of such partyâ€™s property, which is not vacated or fully stayed within thirty (30) calendar days after the institution or occurrence thereof; or (Submitted: Jan 26, 2016 8:40:16 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 190
The following will be in two parts because of the size limit. part 1 RFP language:

Attachment A, Section 10, Subsections b and c b. Upon the occurrence of an event of default, Lead State shall issue a written notice of default, identifying the nature of the default, and providing a period of 30 calendar days in which Contractor shall have an opportunity to cure the default. The Lead State shall not be required to provide advance written notice or a cure period and may immediately terminate this Master Agreement in whole or in part if the Lead State, in its sole discretion, determines that it is reasonably necessary to preserve public safety or prevent immediate public crisis. Time allowed for cure shall not diminish or eliminate Contractorâ€™s liability for damages.
c. If Contractor is afforded an opportunity to cure and fails to cure the default within the period specified in the written notice of default, Contractor shall be in breach of its obligations under this Master Agreement and Lead State shall have the right to exercise any or all of the following remedies:
(1) Exercise any remedy provided by law; and
(2) Terminate this Master Agreement and any related Contracts or portions thereof; and (3) Suspend Contractor from being able to respond to future bid solicitations; and (4) Suspend Contractorâ€™s performance; and
(5) Withhold payment until the default is remedied. (Submitted: Jan 26, 2016 8:41:10 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 191
Part 2
Exception.

The minor changes we have made to these two Subsections are related to the above changes to Subsection a. (4), to the extent these are needed to support those changes. Revised language follows:
b. Upon the occurrence of an event of default, the party claiming default shall issue a written notice of default, identifying the nature of the default, and providing a period of 30 calendar days in which the non-defaulting party shall have an opportunity to cure the default. The Lead State shall not be required to provide advance written notice or a cure period and may immediately terminate this Master Agreement in whole or in part if the Lead State, in its sole discretion, determines that it is reasonably necessary to preserve public safety or prevent immediate public crisis. Time allowed for cure shall not diminish or eliminate defaulting partyâ€™s liability for damages. c. If a defaulting party is afforded an opportunity to cure and fails to cure the default within the period specified in the written notice of default, the defaulting party shall be in breach of its obligations under this Master Agreement and the non-defaulting party shall have the right to exercise any or all of the following remedies:
(1) Exercise any remedy provided by law; and
(2) Terminate this Master Agreement and any related Contracts or portions thereof; and (3) In the event of default by the Contractor, and to the extent permitted by the law of the Participating State or Purchasing Entity, the Lead State shall have the right to suspend Contractor from being able to respond to future bid solicitations; and
(4) Suspend Contractorâ€™s performance; and
(5) Withhold payment until the default is remedied. (Submitted: Jan 26, 2016 8:41:56 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 192
This will be 4 parts. 1 and two the RFP language 3 and 4 the question.

Part 1:

Indemnification
a. The Contractor shall defend, indemnify and hold harmless NASPO, NASPO ValuePoint, the Lead State, Participating Entities, and Purchasing Entities, along with their officers, agents, and employees as well as any person or entity for which they may be liable, from and against claims, damages or causes of action including reasonable attorneysâ€™ fees and related costs for any death, injury, or damage to property arising directly or indirectly from act(s), error(s), or omission(s) of the Contractor, its employees or subcontractors or volunteers, at any tier, relating to the performance under the Master Agreement. b. Indemnification â€“ Intellectual Property. The Contractor shall defend, indemnify and hold harmless NASPO, NASPO ValuePoint, the Lead State, Participating Entities, Purchasing Entities, along with their officers, agents, and employees as well as any person or entity for which they may be liable ("Indemnified Party"), from and against claims, damages or causes of action including reasonable attorneysâ€™ fees and related costs arising out of the claim that the Product or its use, infringes Intellectual Property rights ("Intellectual Property Claim") of another person or entity.
(1) The Contractorâ€™s obligations under this section shall not extend to any claims arising from the combination of the Product with any other product, system or method, unless the Product, system or method is:
(Submitted: Jan 26, 2016 8:44:53 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 193
part 2:
a) provided by the Contractor or the Contractorâ€™s subsidiaries or affiliates; (b) specified by the Contractor to work with the Product; or (c) reasonably required, in order to use the Product in its intended manner, and the infringement could not have been avoided by substituting another reasonably available product, system or method capable of performing the same function; or
(d) It would be reasonably expected to use the Product in combination with such product, system or method. (2) The Indemnified Party shall notify the Contractor within a reasonable time after receiving notice of an Intellectual Property Claim. Even if the Indemnified Party fails to provide reasonable notice, the Contractor shall not be relieved from its obligations unless the Contractor can demonstrate that it was prejudiced in defending the Intellectual Property Claim resulting in increased expenses or loss to the Contractor and then only to the extent of the prejudice or expenses. If the Contractor promptly and reasonably investigates and defends any Intellectual Property Claim, it shall have control over the defense and settlement of it. However, the Indemnified Party must consent in writing for any money damages or obligations for which it may be responsible. The Indemnified Party shall furnish, at the Contractorâ€™s reasonable request and expense, information and assistance necessary for such defense. If the Contractor fails to vigorously pursue the defense or settlement of the Intellectual Property Claim, the Indemnified Party may assume the defense or settlement of it and the Contractor shall be liable for all costs and expenses, including reasonable attorneysâ€™ fees and related costs, incurred by the Indemnified Party in the pursuit of the Intellectual Property Claim. Unless otherwise agreed in writing, this section is not subject to any limitations of liability in this Master Agreement or in any other document executed in conjunction with this Master Agreement
(Submitted: Jan 262016 8:45:27 AM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 338
#2..
- 382 -
consent in writing for any money damages or obligations for which it may be responsible. The Indemnified Party shall furnish, at the Contractorâ€™s reasonable request and expense, information and assistance necessary for such defense. If the Contractor fails to vigorously pursue the defense or settlement of the Intellectual Property Claim, the Indemnified Party may assume the defense or settlement of it and the Contractor shall be liable for all costs and expenses, including reasonable attorneysâ€™ fees and related costs, incurred by the Indemnified Party in the pursuit of the Intellectual Property Claim. Unless otherwise agreed in writing, this section is not subject to any limitations of liability in this Master Agreement or in any other document executed in conjunction with this Master Agreement. (Submitted: Jan 26, 2016 8:45:27 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 194
part 3 Exception
Microsoft respectfully takes exception with this Section 13, as written, as it is overly broad in scope. Microsoft proposes the following alternative language:

Indemnification

13. Indemnification
a. Subject to the exceptions below and the NASPO Participantsâ€™ (as defined below) compliance with the notice and defense provisions below, in the event of any defect or deficiency in any Contractor Products or Services purchased by a Participating Entity or Purchasing Entity, Contractor agrees to defend NASPO, NASPO ValuePoint, the Lead State, Participating Entities, and Purchasing Entities, along with their officers, agents, and employees (collectively, the â€œNASPO Participantsâ€ ) against third party claims, damages or causes of action including reasonable attorneysâ€™ fees and related costs for any death, injury, or damage to tangible property suffered by such third party and caused by the negligence, or willful misconduct of Contractor, its employees or subcontractors or volunteers, at any tier, during the performance of this Master Agreement (a â€œPI Claimâ€ ).

This clause shall not be construed to bar any legal remedies Contractor may have with respect to the NASPO Participantsâ€™ failure to fulfill their obligations pursuant to the Master Agreement or any Participating Addendum. (Submitted: Jan 26, 2016 8:46:40 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 195
part 4 (of now 6 or 7)
To qualify for such defense, the Participating Entities/Purchasing Entities shall promptly notify Contractor of any PI Claim of which the Participating Entities/Purchasing Entities become aware which may give rise to a right of defense pursuant to this Section. Notice of any PI Claim that is a legal proceeding, by suit or otherwise, must be provided to Contractor within thirty (30) days of the Participating Entitiesâ€™/Purchasing Entitiesâ€™ first learning of such proceeding. If the Participating Entityâ€™s/Purchasing Entityâ€™s laws require approval of a third party to defend Participating Entity/Purchasing Entity, Participating Entity/Purchasing Entity will seek such approval and if approval is not received, Contractor is not required to defend that Participating Entity/Purchasing Entity. If a PI Claim is settled, to the extent permitted by law, the Participating Entities/Purchasing Entities shall not publicize the settlement and will cooperate with Contractor so that Contractor can make every effort to ensure the settlement agreement contains a non-disclosure provision.

Notwithstanding anything to the contrary contained herein, Participating Entities/Purchasing Entities agree that Contractor has no obligation for any PI Claim covered by this Section arising out of or resulting from the Participating Entitiesâ€™/Purchasing Entitiesâ€™ or any of their respective employeesâ€™, contractorsâ€™ or agentsâ€™ acts of negligence, gross negligence or misconduct. THE FOREGOING SHALL CONSTITUTE EACH AND EVERY PARTICIPATING ENTITYâ€™S/PURCHASING ENTITYâ€™S SOLE REMEDY AND CONTRACTORâ€™S SOLE AND EXCLUSIVE LIABILITY FOR ALL PI CLAIMS. (Submitted: Jan 26, 2016 8:48:45 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 196
From the RFP, it appears we should ask for our exeptions during this Q and A period. If not, please confirm formally. From the RFP:
3 SOLICITATION REQUIREMENTS, INFORMATION AND INSTRUCTIONS

3.1 QUESTION AND ANSWER PERIOD
The RFP is issued by the State of Utah Division of Purchasing via Bidsync. The Division of Purchasing is the only contact for this solicitation. Do not contact any other Participating Entity about the RFP.

All questions MUST be submitted through BIDSYNC (www.bidsync.com) during the designated time for questions (â€œQ&A periodâ€ ) listed on Bidsync. Questions submitted through any other channel will not be answered.

Questions may be answered in the order that they are submitted or may be compiled into one document and State of Utah Bid CH16012
3/22/2016 4:23 PM p. 339
#2..
- 383 -
formally. From the RFP:
3 SOLICITATION REQUIREMENTS, INFORMATION AND INSTRUCTIONS

Questions may be answered in the order that they are submitted or may be compiled into one document and answered via an addendum. Answers disseminated by the State through the BidSync system shall serve as the official and binding position of the State and will constitute an addendum to this RFP.

Questions, exceptions, or notification to the State of any ambiguity, inconsistency, excessively restrictive requirement, or error in this RFP, MUST be submitted as a question through BidSync during the Q&A period.

Questions may be answered individually or may be compiled into one document. Questions may also be answered via addenda. An answered question or addenda may modify the specification or requirements of this RFP. Answered questions and addendums will be posted on BidSync. Offerors should periodically check BidSync for answered questions and addendums before the closing date. It is the responsibility of the Offerors to submit their proposal as required by this RFP, including any requirements contained in an answered question and/or addendums.

Exceptions to scope/content of the RFP within an Offerorâ€™s proposal that have not been previously addressed within the Q&A period of the procurement are not allowed and may result in the Offerorâ€™s proposal being considered non-responsive. (Submitted: Jan 26, 2016 9:15:15 AM MST) Answer
- Exceptions to the Master Terms and Conditions do not need to come through Bidsync. These can be attached to an Offeror's proposal.

If an Offeror believes that the RFP document contains an ambiguity, inconsistency, excessively restrictive requirement, or error in this RFP, then it MUST be submitted as a question through BidSync during the Q&A period. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 197
The latest Q&A contains the following question and answer:
â€œQuestion
Attachment B: Cloud Security Alliance Questionnaires
Please confirm whether the response requires both the CAIQ (Attachment B Exhibit 1) and CCM (Attachment B Exhibit 2) questionnaires, or if only one of the two is required. (Submitted: Jan 20, 2016 11:56:58 AM MST) Answer(s)
â€¢ The final RFP document will require that both documents be attached to a proposal. (Answered: Jan 25, 2016 2:23:05 PM MST) â€œ
The CAIQ contains specific questions with space for answers in columns E-I. The CCM does not. What expectations does NASPO have of vendors to properly respond to the Control Specifications in the CCM? (Submitted: Jan 26, 2016 10:07:36 AM MST)
Answer
- Offerors can complete separate documents that answers the questions contained in both the CAIQ and the CCM. An Offeror is not required to use the spreadsheets uploaded.

However, if an Offeror completes a separate document then it should keep the questions in the same order as listed on the spreadsheets. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 198

1. GENERAL PROVISIONS Section 2. SUBMITTING A PROPOSAL: By submitting a proposal in response to this RFP, the Offeror acknowledges that the minimum requirements, technical specifications, scope of work, and the evaluation process, outlined in this RFP are fair, equitable, not unduly restrictive, and understood. Any exceptions to the content of this RFP, including the specifications and minimum requirements, must be addressed during the Question and Answer period or protested in writing to the Division of Purchasing before the closing date and time.

Q: Please clarify how exceptions addressed in this way will be integrated into the Offerorâ€™s final proposal? (Submitted: Jan 26, 2016 10:28:39 AM MST)
Answer
- Any exception to the RFP documents as posted must be protested before the closing of the RFP.

Exceptions/additions to the Master Terms and Conditions will be negotiated as provided in the RFP documents.

An Offeror should not submit a proposal that takes exceptions to the mandatory minimum or technical criteria.

Those exceptions/questions should take place during the Question and Answer period. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 199

4. GENERAL PROVISIONS Section 18. PERFORMANCE AND COST ANALYSIS: The State reserves the right to review the awarded contract(s) on a regular basis regarding performance and cost, and may negotiate price and service elements during the term of the contract.

Q: Please clarify the process for price adjustments. Will this be done via an amendment process? (Submitted: Jan 26, 2016 10:29:35 AM MST)
Answer
- Offerors are providing a minimum discount to their price list in the cost proposal. As such, Offerors in providing the offerings need to do so at the price list minus the minimum discount.

If an offeror want to lower is minimum discount from say 5% to 3% then that needs to occur through an State of Utah Bid CH16012
3/22/2016 4:23 PM p. 340
#2..
- 384 -
review the awarded contract(s) on a regular basis regarding performance and cost, and may negotiate price and service elements during the term of the contract.

If an offeror want to lower is minimum discount from say 5% to 3% then that needs to occur through an amendment. However, if an Offeror provides a discount greater than its minimum discount in its cost proposal then it does not need to go through an amendment. (Answered: Jan 28, 2016 2:00:48 PM MST) Question 200
GENERAL PROVISIONS Section 19. AWARDED CONTRACT(S): Contract(s) awarded from this RFP will include the following documents: the scope of work, the appropriate State of Utah Standard Terms and Conditions, and any other documents listed in this RFP.

Q: Please clarify what is included in the â€œscope of workâ€ . Is this from a PO from the ordering agency? Q: What are these other documents? (Submitted: Jan 26, 2016 10:30:27 AM MST) Answer
- For this contract the scope of work will be the PO from the purchasing entities.

The other documents include the documents listed as part of this RFP. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 201

6. GENERAL INOFMRATION Section 2.1 PURPOSE
The State of Utah, Division of Purchasing (Lead State) is requesting proposals for cloud solutions in furtherance of the NASPO ValuePoint Cooperative Purchasing Program. The purpose of this Request for Proposals (RFP) is to establish Master Agreements with qualified Offerors to provide services related to cloud solutions for all Participating Entities. The objective of this RFP is to obtain best value, and achieve more favorable pricing, than is obtainable by an individual state or local government entity because of the collective volume of potential purchases by numerous state and local government entities. The Master Agreement(s) resulting from this procurement shall be extended to state governments (including departments, agencies, institutions), institutions of higher education, political subdivisions (i.e., colleges, school districts, counties, cities, etc.), the District of Columbia, territories of the United States, and other eligible entities subject to approval of the individual state procurement director and compliance with local statutory and regulatory provisions. The initial term of the Master Agreement shall be ten (10) years with no renewal provisions; however, Contract Vendors must submit an annual certification that they are still compliant with the mandatory minimum requirements and technical specification of the RFP.

Q: Will the MA and/or the PA list all eligible entities. (Submitted: Jan 26, 2016 10:30:59 AM MST) Answer
- States that are participating in this solicitation via the Master Agreement are listed in Attachment E.

For the State of Utah there is no list of eligible users. It is any entity that is entitled to use a cooperative contract by statute. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 202
GENERAL INOFMRATION Section 2.3 DEFITIONS Participating Addendum means a written statement of agreement signed by the Contract Vendor and a Participating State or Participating Entity that clarifies the operation of the Master Agreement for the Participating Entity (e.g. ordering procedures specific to Participating State) and may add other state-specific language or other requirements. A Participating Addendum evidences the Participating Entity's willingness to purchase and the Contract Vendor's willingness to provide Offerings under the terms and conditions of the Master Agreement with any and all exceptions noted and agreed upon.

Q: Is there a template of the Participating Addendum or can the Offeror use its own template? Q: Can a state extend the PA after the expiration of the MA? (Submitted: Jan 26, 2016 10:31:30 AM MST) Answer
- A template of the participating addendum will be customized after contract award.

A PA cannot be extended after the expiration of the MA. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 203
GENERAL INFORMATION Section 2.7.2 Master Agreement The Master Agreement(s) awarded from this RFP will consist of the RFP document, including all Exhibits, Attachments, and the winning Offeror's Proposal, in that order of precedence.

Q: Can an Offeror add their order specific terms on a master level or must it be done at the state level? Q: Can an Offeror expand the documents to include an ordering document template. (Submitted: Jan 26, 2016 10:31:50 AM MST)
Answer
- 1. Yes. Ordering specific terms and conditions can be done at either level. However, it is encouraged to negotiate as many terms and conditions during the Master Agreement.

2. Yes. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 204
GENERAL INFORMATION Section 2.14 NASPO ValuePoint eMarket Center In July 2011, NASPO ValuePoint entered into a multi-year agreement with SciQuest, Inc. whereby SciQuest will provide certain electronic catalog hosting and management services to enable eligible NASPO ValuePoint entity's customers to access a central online website to view and/or shop the goods and services available from existing NASPO ValuePoint Cooperative Contracts. The central online website is referred to as the NASPO ValuePoint eMarket Center Contract Because of the nature of these services, the NASPO ValuePoint Master Agreement Terms and Conditions (Attachment A) require only cooperation in providing ordering instructions on the eMarket Center.

Q: Is this the dedicated website referred to in Section 2.12? (Submitted: Jan 26, 2016 10:32:34 AM MST) Answer
- Yes. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 205
SOLICITATION REQUIREMENTS, INFORMATION AND INSTRUCTIONS Section 3.4 Exceptions to RFP and NASPO ValuePoint Master Agreement Terms and Conditions
Q: Does this Section mean that an Offeror can provide a list of exceptions or a proposed amendment that would form the basis of a negotiated agreement as part of their response? Q: Can an Offeror reference its global policies that are referenced in URLS? (Submitted: Jan 26, 2016 10:35:51 AM MST)
Answer
- 1. Yes, an Offeror can take exception/addition to the Master Terms and Conditions as part of its response to the RFP. An Offeror does not need to list its exceptions/additions to the Master Terms and Conditions during the Question and Answer Period.

2. Please provide more context regarding your second question. However, regarding the Master Terms and Conditions Offerors may not submit requests for exceptions and/or additions by reference to a vendor's website or URL. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 206
Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions Section 1.a. Master Order of Precedence
Any Order placed under this Master Agreement shall consist of the following documents:
â€¢ A Participating Entityâ€™s Participating Addendum (â€œPAâ€ ) â€¢ NASPO ValuePoint Master Agreement Terms & Conditions including the applicable Exhibits to the Master Agreement
â€¢ The Solicitation
â€¢ Contractorâ€™s response to the Solicitation, as revised (if permitted) and accepted by the Lead State; and â€¢ A Service Level Agreement issued against the PA
Q: Can an Offeror add its Ordering Document to these list of documents? (Submitted: Jan 26, 2016 10:36:39 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. The Lead State will not consider proposed modifications and/or additions to the Master Agreement Terms and Conditions after the deadline for proposals. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 207
Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions Section 8 Confidentiality, NonDisclosure, and Injunctive Relief Q: These terms seem to be one-sided. Can this be made mutual? (Submitted: Jan 26, 2016 10:37:17 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. The Lead State will not consider proposed modifications and/or additions to the Master Agreement Terms and Conditions after the deadline for proposals. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 208
Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions Section 19.b and c Ordering b. This Master Agreement permits Purchasing Entities to define project-specific requirements and informally compete the requirement among other firms having a Master Agreement on an "as needed" basis. This procedure may also be used when requirements are aggregated or other firm commitments may be made to achieve reductions in pricing. This procedure may be modified in Participating Addenda and adapted to Purchasing Entity rules and policies. The Purchasing Entity may in its sole discretion determine which firms should be solicited for a quote. The Purchasing Entity may select the quote that it considers most advantageous, cost and other factors considered.
c. Each Purchasing Entity will identify and utilize its own appropriate purchasing procedure and documentation.

Contractor is expected to become familiar with the Purchasing Entities' rules, policies, and procedures regarding the ordering of supplies and/or services contemplated by this Master Agreement.

Q: Will this be governed by state procurement procedures or the Master Agreement terms along with the PA? (Submitted: Jan 26, 2016 10:37:47 AM MST)
Answer
- This will be governed by a purchasing entities procurement procedures. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 209
On Page 34 Section 6.3 States "Offeror... shuold meet a minimum Dun and bradstreet (D&B) credit rating of 4A2." Would a Dun and Bradstreet Credit rating of 1R3 result in a fail of section 6.3. If so could the provided audited financial statements overcome that score? (Submitted: Jan 26, 2016 10:48:30 AM MST) Answer
- Offeror's proposals under 6.3 must meet the financial strength identified in that Section. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 210
Could you provide an example cloud scenario that we would be able to work with to demonstrate our capabilities? (Submitted: Jan 26, 2016 10:49:55 AM MST) Answer
- Unfortunately, there is no example of a cloud scenario used in this RFP to demonstrate an offeror's capabilities. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 211
Please confirm that offerors wishing to submit cloud solutions for multiple manufacturers may specify distinct discount percentages for products or product lines offered by each manufacturer within each of the three product categories identified (SaaS, IaaS, PaaS) in Attachment G.

For example:

Company A
SaaS Discount % 1
IaaS Discount % 2
PaaS Discount % 3
Company B
SaaS Discount % 4
IaaS Discount % 5
PaaS Discount % 6 (Submitted: Jan 26, 2016 11:07:59 AM MST) Answer
- Yes. This would be acceptable. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 212
In regards to question 207... what safeguards and assurances does a vendor have that items marked confidential or private will remain as such? Is the information retained, where is it retained and what assurances does a vendor have that this information will be properly secured? (Submitted: Jan 26, 2016 11:39:43 AM MST) Answer
- The documents are maintained on Bidsync. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 213
2 part question: Is the cyber insurance part of the minimum mandatory requirements? Is this scored and can it be negotiable? (Submitted: Jan 26, 2016 11:42:01 AM MST) Answer
- The reference to cyber insurance from the RFP document has been removed. An Offeror can take exception to the insurance requirements in the Master Terms and Conditions. (Answered: Feb 1, 2016 4:19:32 PM MST) Question 214
Document: Cloud_Solutions_-_Request_for_Proposals_-_CH16012; Page: 23; Section: 5.6.5 â€œOfferor must provide a statement certifying that its service model offering(s) meet or exceed NIST definitions for service models.â€ Is this referring to the service model definitions in Attachment D? (Submitted: Jan 26, 2016 12:18:48 PM MST)
Answer
- Yes. (Answered: Feb 1, 2016 4:19:32 PM MST)
Question 215
Document: Cloud_Solutions_-_Request_for_Proposals_-_CH16012; Page: 28; Section: 8.1.3 â€œOfferor must identify for each service category(ies) the areas that each service category.â€ 1) Can a supplier add categories during the 10 year term? 2) Can a supplier add Services during the 10 year term? 3) Can a supplier move Services between service categories during the 10 year term? 4) Can a supplier remove services during the 10 year term? 5) Are there any restrictions around timing for these changes? Is so, what is the process for these changes? (Submitted: Jan 26, 2016 12:21:28 PM MST)
Answer
- An Offeror is not awarded a Service Category during this solicitation then an Offeror may attempt to be awarded a Service Model if the Lead State re-issues the solicitation, as permitted in 2.8.

For example if during this solicitation an Offeror is awarded a contract only for SaaS it cannot amend its contract to State of Utah Bid CH16012
3/22/2016 4:23 PM p. 343
#2..
- 387 -
3) Can a supplier move Services between service categories during the 10 year term? 4) Can a supplier remove services during the 10 year term? 5) Are there any restrictions around timing for these changes? Is so, what is the process for these changes? (Submitted: Jan 26, 2016 12:21:28 PM MST)
Answer
- An Offeror is not awarded a Service Category during this solicitation then an Offeror may attempt to be awarded a Service Model if the Lead State re-issues the solicitation, as permitted in 2.8.

For example if during this solicitation an Offeror is awarded a contract only for SaaS it cannot amend its contract to include PaaS or IaaS offerings unless it is awarded those service models during a re-solicitation. (Answered: Feb 1, 2016 4:19:32 PM MST)
Question 216

Page 61 ends

Please confirm that this is a statement that Contractor is representing that the Contractorâ€™s representations in response to the Solicitation by the Lead State are accurate. (Submitted: Jan 26, 2016 12:33:24 PM MST) Answer
- Yes. (Answered: Feb 1, 2016 4:19:32 PM MST)
Question 217
Document: Cloud_Solutions_-_Request_for_Proposals_-_CH16012; Page: 30; Section: 8.8.1.c â€œSpecify how you would respond to the following situations; include any contingency plan or policy. c. Experiences a business failure.â€
Can you provide a couple of specific example scenarios to clarify the type of event you intend in this question? (c.

Experiences a business failure) (Submitted: Jan 26, 2016 12:39:27 PM MST) Answer
- No. Offeros should provide their general policies on how they respond to situations. (Answered: Feb 1, 2016 4:19:32

PM MST)
Question 218
The answer to question 69. CH16012 - NASPO ValuePoint Cloud Solutions, in part states "However, if an Offeror is not awarded a Service Category during this solicitation then an Offeror may attempt to be awarded a Service Category if the Lead State re-issues the solicitation, as permitted in 2.8." Service Category is not defined in the RFP. Please clarify the definition of this term. (Submitted: Jan 26, 2016 1:16:19

PM MST)
Answer
- Answer 69 should replace "Service Category" with Service Model, as defined in Attachment D. (Answered: Feb 1, 2016 4:19:32 PM MST)
Question 219
RFP 8.2.13(B) asks for "b. Level 2 CSA STAR Registry Assessment Certification." Our CSP will certify that they have this, but their standard practice is to only provide the certification document by request under NDA. We can therefore make a statement but we cannot provide the actual document.

Is this acceptable to NASPO? (Submitted: Jan 26, 2016 1:20:38 PM MST) Answer
- An Offeror must demonstrate how it meets this requirement under 8.2.13. (Answered: Feb 1, 2016 4:19:32 PM MST) Question 220
If an Offeror is awarded one Cloud Service Type may the offeror add offerings from another Cloud Service Type during the term of the Master Agreement? For example if an offeror is awarded SAAS, are they permited to later add IAAS products to the Master Agreement? (Submitted: Jan 26, 2016 1:23:16 PM MST) Answer
- If an Offeror is awarded an offering for SaaS during this solicitation then it would be permitted to later add IaaS or PaaS if there was a re solicitation. An Offeror could amend its contract to later add on an offering. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 221
RFP section 7.0 states ".....The State has identified a number of roles that are necessary based on the requirements of Attachment D; these titles are not meant to be restrictive, but are used to identify key roles." We are unable to locate the roles the State has identified. They are not listed in Attachment D. What section contains the list of key roles, as identified by the State? (Submitted: Jan 26, 2016 2:08:27 PM MST) Answer
- Section 7 have been modified to only include the role of a contract manager. (Answered: Feb 1, 2016 4:19:32 PM MST)
Question 222
"8.13 (E) CLOUD SECURITY ALLIANCE QUESTIONNAIRES - A" references a Mandatory Minimum Requirement described in section 4.1.9 though I don't see anything in the RFP doc beyond 4.1.2, did I miss it? Also, is the expectation that each response will include both the CCM and CAIQ or is it either / or? The language "can submit two different types of reports" in attachment B implies the option to choose which one we include, is that correct? (Submitted: Jan 26, 2016 2:43:39 PM MST)
Answer
- This was a mistake in the RFP document. The reference should be to Section 5.5.8. This will be corrected in the final version of the RFP document
(Answered: Jan 262016 4:42:34 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 344
#2..
- 388 -

8.13 (E) CLOUD SECURITY ALLIANCE QUESTIONNAIRES A references a Mandatory Minimum Requirement described in section 4.1.9 though I don't see anything in the RFP doc beyond 4.1.2, did I miss it? Also, is the expectation that each response will include both the CCM and CAIQ or is it either / or? The language "can submit two different types of reports" in attachment B implies the option to choose which one we include, is that correct? (Submitted: Jan 26, 2016 2:43:39 PM MST)
Answer
- This was a mistake in the RFP document. The reference should be to Section 5.5.8. This will be corrected in the final version of the RFP document. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 223
If we are a current NASPO ValuePoint contract holder would it be possible to use the terms and conditions of the previous contract that are already negotiated and approved? (Submitted: Jan 26, 2016 4:14:20 PM MST) Answer
- This cannot be guarantee. This solicitation contains specific terms and conditions that are specific to this solicitation. (Answered: Jan 26, 2016 4:43:16 PM MST)
Question 224
Mandatory Minimum Requirements Section 5.5.10 our data is housed in colocation centers. Can we submit the data center SOC reports? (Submitted: Jan 26, 2016 4:44:13 PM MST) Answer
- Yes. This should be the 5.5.10 requirement. (Answered: Jan 27, 2016 11:24:19 AM MST) Question 225
Can you please provide us with the excel sheet format (showing the specific 20+ column headers) of the Quarterly Sales Reports that will be required under the contract? (Submitted: Jan 26, 2016 8:37:31 PM MST) Answer
- NASPO ValuePoint is going to work with awarded contractors, once awards are made, to create a reasonable and effective detailed report template.

What NASPO ValuePoint will want to know is very limited in the Cloud case - what entities are using it, which offerings and how much are they paying. (Answered: Jan 28, 2016 1:14:43 PM MST) Question 226
Document: Cloud_Solutions_-_Request_for_Proposals_-_CH16012; Page: 23; Section: 8.15.2. This section

8.15.2 appears to be a duplicate of section 8.8.2. Is that correct, or is there a different answer expected? Can you please clarify? (Submitted: Jan 27, 2016 8:01:00 AM MST) Answer
- Section 8.15.2 has been deleted from the final version of the RFP. (Answered: Jan 27, 2016 11:24:19 AM MST) Question 227
Document: Cloud_Solutions_-_Request_for_Proposals_-_CH16012; Page: 30; Section: 8.14.2 â€œDescribe in detail the standard lead-time for provisioning Services defined in section 8.4.2 of the RFP.â€ Section 8.4.2 reads, â€œSpecify your ability to comply with the following customer service requirements:
a. You must have one lead representative for each entity that executes a Participating Addendum. Contact information shall be kept current.
b. Customer Service Representative(s) must be available by phone or email at a minimum, from 7AM to 6PM on Monday through Sunday for the applicable time zones.
c. Customer Service Representative will respond to inquiries within one business day. d. You must provide design services for the applicable categories. e. You must provide Installation Services for the applicable categories.â€ Can you clarify how these two sections are related? (Submitted: Jan 27, 2016 8:03:24 AM MST) Answer
- These section are not related. And Section 8.14.2 has been modified to remove the reference to 8.4.2. (Answered:

Jan 27, 2016 11:24:19 AM MST)
Question 228

Page 31 ends

agreed to in the Master Agreement Terms and Conditions or in a Participating Addendum. Will NASPO review new terms and conditions over the term of the contract, as appropriate to keep pace with changes and new technologies?

Page 31 ends

agreed to in the Master Agreement Terms and Conditions or in a Participating Addendum. Some cloud manufacturers will require end users to complete a document to enroll in cloud services. It is our understanding that this step (as applicable) would be permissible to properly establish the cloud solution for the end user, can you confirm? (Submitted: Jan 27, 2016 1:07:49 PM MST)
Answer
- Yes. Master Agreement terms and conditions may be modified as a result of changes and new technologies. (Answered: Jan 28, 2016 1:14:43 PM MST)
Question 229

Page 43 ends

costs and management of infrastructure, network, OS, and software.â€ We interpret this to mean that pricing should be provided for all aspects of the cloud solution that are typically offered by the manufacturer, can you confirm? Alternatively, if there are additional expectations around infrastructure and management of infrastructure beyond what might typically be offered by a cloud solutions provider, can you please clarify what those expectations are? (Submitted: Jan 27, 2016 1:08:12 PM MST) Answer
- Your interpretation is correct. (Answered: Jan 28, 2016 1:14:43 PM MST) Question 230
RFP Section 5.2.5 prohibits employment of â€œany company or person other than a bona fide employee working solely for the Offeror or a company regularly employed as its marketing agent, to respond to the RFP.â€ What about cases where authorized resellers or value added resellers of a service provider wish to submit proposals as prime contractors, for the purpose of providing cloud services for which the cloud service provider sells via an â€œindirect through resellerâ€ sales model â€“ is this allowed? (Submitted: Jan 27, 2016 1:09:09 PM MST)
Answer
- This is allowed. (Answered: Jan 28, 2016 1:14:43 PM MST) Question 231
RFP Section 5.5.12 refers to SLA requirements in RFP Section 8.13. But Section 8.13 appears to apply to the STAR Registry Self-Assessment, not SLA. Is this a typo, and if so then what section was intended? If not, please explain the relationship to SLA. (Submitted: Jan 27, 2016 1:10:48 PM MST) Answer
- The reference should be to 8.12. (Answered: Jan 28, 2016 1:14:43 PM MST) Question 232
RFP Section 9.1 requires that Offerors bid a minimum discount off of their published government price catalog.

Fulfillment Partner means a third-party contractor qualified and authorized by Contractor, and approved by the Participating State under a Participating Addendum, who may, to the extent authorized by Contractor, fulfill any of the requirements of this Master Agreement including but not limited to providing Services under this Master Agreement and billing Customers directly for such Services. Contractor may, upon written notice to the Participating State, add or delete authorized Fulfillment Partners as necessary at any time during the contract term.

Fulfillment Partner has no authority to amend this Master Agreement or to bind Contractor to any additional terms and conditions. (Answered: Jan 28, 2016 11:00:02 AM MST) Question 234
Section 9 of Attachment A (â€œRight to Publishâ€ ) appears to prohibit any sort of mention of the Agreement without advance permission. Will a Contractor need to seek permission in each case where it wants to alert a prospective Purchasing Entity in a Participating State of the existence of the Master Agreement, in order that the Contractor may encourage the prospective Purchasing Entity to utilize the Master Agreement for its needs? (Submitted: Jan 27, 2016 1:12:39 PM MST)
Answer
- No. (Answered: Jan 28, 2016 9:12:16 AM MST)
Question 235
RFP Section 7.2 requires incorporation of all Attachments. If an exception is not taken to Attachment E would an offeror be bound by those state specific terms and conditions when they attempt to negotiate a Participating Addendum with that respective State? Must exceptions to Attachment Eâ€™s state specific terms and conditions State of Utah Bid CH16012
3/22/2016 4:23 PM p. 346
#2..
- 390 -
(Submitted: Jan 27, 2016 1:12:39 PM MST)
Answer
- No. (Answered: Jan 28, 2016 9:12:16 AM MST)
Question 235
RFP Section 7.2 requires incorporation of all Attachments. If an exception is not taken to Attachment E would an offeror be bound by those state specific terms and conditions when they attempt to negotiate a Participating Addendum with that respective State? Must exceptions to Attachment Eâ€™s state specific terms and conditions be taken at this phase? Or will additional time be granted for Offerors to prepare exceptions to the Participating Addenda in Attachment E? (Submitted: Jan 27, 2016 1:13:05 PM MST) Answer
- No. State specific terms and conditions will be negotiated when an awarded contractor negotiates a participating addendum (the same applies for the State of Utah's terms and conditions).

The only set of terms and conditions that an Offeror needs to take exception to are the Master Agreement Terms and Conditions. (Answered: Jan 28, 2016 9:12:16 AM MST) Question 236
In each of the Exhibits 1 and 2 to Attachment A, please explain what is meant by the section titled â€œWeb Servicesâ€ which says â€œthe Contractor shall use Web services exclusively to interface with the Purchasing Entityâ€™s data in near real time.â€ (Submitted: Jan 27, 2016 1:13:44 PM MST) Answer
- The applications are accessible from various client devices through a thin-client interface such as a Web browser (e.g., Web-based email) or a program interface. (Answered: Jan 28, 2016 10:34:42 AM MST) Question 237
Our company currently has a D&B rating of 1R2. We would like to confirm if this is considered an equivalent rating to the required D&B of 3A2 or higher? Our company is a Private S Corporation and like many other similar companies, we do not submit financials to D&B and therefore D&B cannot provide us a â€œAâ€ rating. D&B has therefore provided us a rating of 1R2. We believe that 1R2 + financials (which we will be submitting with our proposal) to show our standing and financial strength is equivalent to 3A2 - this is based on satisfying the 3A2 threshold as a $100M+ company and a composite rating of 2 which is equivalent.

Please confirm if 1R2 with financials submitted directly to NASPO with our proposal will be deemed equivalent to 3A2. (Submitted: Jan 27, 2016 2:24:14 PM MST)
Answer
- The State's concerns with the D&B rating is the financial strength of the company. An Offeror's submitted financials must meet this requirement. (Answered: Jan 28, 2016 9:12:16 AM MST) Question 238
When does the State intend to publish the revised, final RFP? (Submitted: Jan 28, 2016 2:11:45 AM MST) Answer
- As soon as all the revisions have been made to the document. It is anticipated that it will be released by February 5, 2016. (Answered: Jan 28, 2016 9:12:16 AM MST)
Question 239
The RFP refers to a 'contract vendor'. In each cloud category, will multiple cloud vendors be chosen by the Lead State? (Submitted: Jan 28, 2016 7:18:21 AM MST)
Answer
- Yes, this is a multiple award contract, so the State intends to award multiple contracts to each category. (Answered: Jan 28, 2016 9:12:16 AM MST)
Question 240
Is there a document associated with Addendum #6? If not, can you specify what information was added? (Submitted: Jan 28, 2016 9:08:55 AM MST)
Answer
- This addendum is being provided to inform Offerors that the State of Alabama has provided its intent to participate in this RFP. (Answered: Jan 28, 2016 9:12:49 AM MST) Question 241
Does the SSAE 16 requirement apply to every service offering? (Submitted: Jan 28, 2016 9:32:35 AM MST) Answer
- If an Offeror does not believe the SSAE 16 requirement applies to its offering then it needs to describe why the requirement does not apply. However, the State reserves the right to determine if it does apply. (Answered: Jan 28, 2016 10:58:31 AM MST)
Question 242
Please provide additional details of the applicable roles for subcontractors and/or third party resellers. (Submitted: Jan 28, 2016 9:39:13 AM MST)
Answer
- Subcontractor means any organization, whether designated as a subcontractor , fulfillment partner, reseller, etc., that will assist an Offeror to provide an Offering if awarded a Master Agreement. (Answered: Jan 28, 2016 10:58:31 AM MST)
Question 243
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 347
#2..
- 391 -
Please provide additional details of the applicable roles for subcontractors and/or third party resellers. (Submitted: Jan 28, 2016 9:39:13 AM MST)
Answer
- Subcontractor means any organization, whether designated as a subcontractor , fulfillment partner, reseller, etc., that will assist an Offeror to provide an Offering if awarded a Master Agreement. (Answered: Jan 28, 2016 10:58:31 AM MST)
Question 243
Will subcontractors and/or third parties be able to provide functions of the service delivery? For example, if an OEM has a offering on it's GPL but part of that delivery will include a "wrapper" value added services from an authorized reseller. Is this joint offering from the OEM and it's authorized reseller permissible under the scope of this RFP? (Submitted: Jan 28, 2016 9:39:39 AM MST)
Answer
- Yes. (Answered: Jan 28, 2016 10:58:31 AM MST)
Question 244
Will subcontractors and/or third parties be able to list their service offerings under a Subcontractor price list? (Submitted: Jan 28, 2016 9:40:07 AM MST)
Answer
- Subcontractor will only be able to offer what the awarded contractor is able to offer. (Answered: Jan 28, 2016 10:58:31

AM MST)
Question 245
How can a cloud provider certify its offerings are NIST compliant? We can attest that our offering is NIST compliant but how can we certify it? (Submitted: Jan 28, 2016 9:40:24 AM MST) Answer
- This requirement has been modified to request that Offerors describe how its offerings are NIST compliant. (Answered: Jan 28, 2016 10:58:31 AM MST)
Question 246
Section 5.6.13 seems to be applicable to IaaS only. If a requirement such as 5.6.13 is only applicable to IaaS, how can it be a mandatory requirement? (Submitted: Jan 28, 2016 9:40:54 AM MST) Answer
- If a mandatory minimum does not apply to an Offeror's offering/solution then the Offeror must describe how that mandatory minimum does not apply. (Answered: Jan 28, 2016 10:58:31 AM MST) Question 247
Is Cloud brokering and/or resale of other Cloud Service Providers offerings allowed in a respondents proposal? (Submitted: Jan 28, 2016 9:41:28 AM MST)
Answer
- Brokering and/or resale were not contemplated for this RFP apart from an Offeror using resellers. (Answered: Jan 28, 2016 1:14:43 PM MST)
Question 248
Attachment A T&Cs, Section 42B. Please explain what is meant ship date in the detailed sales report that is required. (Submitted: Jan 28, 2016 9:41:48 AM MST)
Answer
- "Ship date" should be removed. It is not applicable to this RFP. (Answered: Jan 28, 2016 1:14:43 PM MST) Question 249
It appears that not all the sales reporting requirements in Attachment A 42B are reflected in the reporting template provided in Attachment F. Which document has precedents? (Submitted: Jan 28, 2016 9:42:22 AM MST) Answer
- The sales reporting document will be modified once contracts have been awarded. (Answered: Jan 28, 2016 1:14:43 PM MST)
Question 250
Would the State entertain providing an extension to the submittal deadline in order to allow reponders to provide a more detailed accurate response? (Submitted: Jan 28, 2016 9:42:55 AM MST) Answer
- No. The RFP will have been posted for over 60 days. The State believes that it has provided Offerors time to provide a detailed accurate response. (Answered: Jan 28, 2016 10:00:55 AM MST) Question 251
Revisions will be included in a final document available Feb. 5th, the responses are due Feb. 26th. This would require a complete review of the final document for any and all changes, which by the way include a new review by legal, finance/purchasing, product management, contractual review team, etc., is it normal to expect a complete response in this timeframe of 21 days? We would like to formally request a 30 day extension be granted to everyone. (Submitted: Jan 28, 2016 10:17:50 AM MST)
Answer
- The revisions that are being made are the ones being discussed during the question and answer period to address typos, numbering issues, and clarifications. (Answered: Jan 28, 2016 10:25:20 AM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 348
#2..
- 392 -
require a complete review of the final document for any and all changes, which by the way include a new review by legal, finance/purchasing, product management, contractual review team, etc., is it normal to expect a complete response in this timeframe of 21 days? We would like to formally request a 30 day extension be granted to everyone. (Submitted: Jan 28, 2016 10:17:50 AM MST)
Answer
- The revisions that are being made are the ones being discussed during the question and answer period to address typos, numbering issues, and clarifications. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 252
If selected as an approved Offeror, is the vendor/Offeror required to accept all requests for services? Or can the vendor/Offeror decline service requests posed to them? (Submitted: Jan 28, 2016 10:37:15 AM MST) Answer
- No. An Offeror may negotiate participating addendums with Participating Entities as they choose. (Answered: Jan 28, 2016 10:58:31 AM MST)
Question 253
Section #8.3- refers to roles, iidentified in Section 7, which refers to roles identified in Attachment D. Attachment D, has no roles identified.

What are the roles NASPO would like identified and described? (Submitted: Jan 28, 2016 10:48:52 AM MST) Answer
- Section 7 has been modified to only reference the role of the Contract Manager. (Answered: Jan 28, 2016 10:58:31

AM MST)
Question 254
Section 8.15.1 is matching 8.8.1(e). This appears to be a duplicate question. Please confirm which question should be answered. (Submitted: Jan 28, 2016 10:51:06 AM MST) Answer
- Yes this is a duplicate and 8.15.1 has been deleted from the final RFP document. (Answered: Jan 28, 2016 10:58:31

AM MST)
Question 255

5.5.5 (p.22) Please clarify that this requirement only applies to SaaS solutions (Submitted: Jan 28, 2016 10:54:49

AM MST)
Answer
- If an Offeror beleives that a requirement or technical criteria only applies to a certain offering then it must describe that in its RFP. (Answered: Feb 1, 2016 4:19:32 PM MST) Question 256

5.5.11 (p. 22) Please confirm that the no-cost training is limited to the training that the vendor will describe in response to RFP Section 8.18 (Submitted: Jan 28, 2016 10:55:12 AM MST) Answer
- The word "training" in 5.5.11. will be removed from the final RFP document. (Answered: Jan 28, 2016 1:14:43 PM MST)
Question 257

5.6.2 (p. 23) Does the SLA have to include payment provisions for violation of the SLA? (Submitted: Jan 28, 2016 10:55:32 AM MST)
Answer
- Yes, if included in the Offeror's SLA. (Answered: Jan 28, 2016 1:14:43 PM MST) Question 258

5.6.14 (p.23) Please confirm if the applicable production environment interfaces with purchasing party applications, the purchasing party will be responsible for providing test/staging interfaces in order to make the test/staging environment identical to production? (Submitted: Jan 28, 2016 10:56:00 AM MST) Answer
- Correct. (Answered: Jan 28, 2016 1:14:43 PM MST)
Question 259

5.6.14 (p. 23) Please confirm that only the hardware/software configuration between test/staging and production environments needs to be identical. The actual data in various environments can be different. (Submitted: Jan 28, 2016 10:56:27 AM MST)
Answer
- Correct. (Answered: Jan 28, 2016 1:14:43 PM MST)
Question 260

8.1.1 (p. 28) This section refers to page limit for response. Please provide the page limit. (Submitted: Jan 28, 2016 10:56:51 AM MST)
Answer
- 8.1.1. has been modified so that ",within the indicated page limit." has been deleted. (Answered: Jan 28, 2016 11:02:01 AM MST)
Question 261
General Question
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 349
#2..
- 393 -
(p) pgpppg
10:56:51 AM MST)
Answer
- 8.1.1. has been modified so that ",within the indicated page limit." has been deleted. (Answered: Jan 28, 2016 11:02:01 AM MST)
Question 261
General Question
Will the vendors be scored individually for each solution submitted, or one combined score for all solutions provided? (Submitted: Jan 28, 2016 10:57:34 AM MST)
Answer
- Combined for all of the offering provided. (Answered: Jan 28, 2016 11:02:01 AM MST) Question 262
We are a privately held corporation and do not have publicly traded debt; Therefore we do not file any financial / annual report documents with the Securities and Exchange Commission (SEC). We only distribute financial information to a limited number of parties; investors, debt holders/lenders, and customers and vendors with whom we have confidentiality or non-disclosure agreements with. Furthermore, financial statements are NOT generally available to the public since we neither file with the SEC nor do we disclose financials without confidentiality or non-disclosure agreements. Please confirm if the State will hold financial statements as Confidential should bidder clearly marks as confidential. (Submitted: Jan 28, 2016 1:05:27 PM MST) Answer
- If documents, such as financial information as marked as Confidential and an Offeror has completed the appropriate form (Claim of Business Confidentiality form) then the State will not disclose the documents. (Answered: Jan 28, 2016 1:18:45 PM MST)
Question 263

5.6.13: some of the service offerings rely on connectivity to the PSTN (e.g.: mobile numbers for texting/sms services, local area voice calling, long distance access, audio circuits for web-based conferencing) may require non-automated intervention to increase capacity â€“ is exclusion of such services from compliance to 5.6.13 a disqualifying event for a service offering relying on the PSTN connectivity? (Submitted: Jan 28, 2016 1:07:28 PM MST) Answer
- An Offeror should discuss this issue in their proposal. It should not disqualify. (Answered: Jan 28, 2016 1:18:45 PM MST)
Question 264
Unlimited Training:

Is unlimited electronic training, such as online forums, API and SDK reference documents, video on demand and other electronic, automatic, self-paced documentation and training, considered a compliant response to requirement 5.5.11? Is there any expectation of in-person, or 1:1, or 1:many live training in this requirement? If so, what quantities of persons and session might contractor need to consider to establish cost basis for proposal? (Submitted: Jan 28, 2016 1:07:59 PM MST)
Answer
- This would meet the requirement. However, the word "training" has been removed form 5.5.11. (Answered: Jan 28, 2016 1:18:45 PM MST)
Question 265
Section 5.5.7; Is a Level 1 CSA STAR Registry Self-Assessment required for a remotely managed, on customer premises IaaS offer? (Submitted: Jan 28, 2016 1:10:01 PM MST) Answer
- If an Offeror believes that a mandatory minimum requirement or technical criteria is not applicable to its offering then it should describe why it is not applicable in its proposal. (Answered: Feb 1, 2016 4:19:32 PM MST) Question 266
Will NASPO supply a Vendor information Sheet that is unlocked for ease of use in developing the proposal? (Submitted: Jan 28, 2016 2:00:18 PM MST)
Answer
- The Vendor Information Sheet does not have a password to protect it. (Answered: Jan 28, 2016 2:02:38 PM MST) Question 267
FP Section 5.2.5 prohibits employment of â€œany company or person other than a bona fide employee working solely for the Offeror or a company regularly employed as its marketing agent, to respond to the RFP.â€ What about cases where authorized resellers or value added resellers of a service provider wish to submit proposals as prime contractors, for the purpose of providing cloud services for which the cloud service provider sells via an â€œindirect through resellerâ€ sales model â€“ is this allowed? (Submitted: Jan 28, 2016 2:25:26 PM MST)
Answer
- Yes, this is allowed. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 268
RFP Section 5.5.12 refers to SLA requirements in RFP Section 8.13. But Section 8.13 appears to apply to the STAR Registry Self-Assessment, not SLA. Is this a typo, and if so then what section was intended? If not, please explain the relationship to SLA. (Submitted: Jan 28, 2016 2:25:40 PM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 350
#2..
- 394 -
MST)
Answer
- Yes, this is allowed. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 268
RFP Section 5.5.12 refers to SLA requirements in RFP Section 8.13. But Section 8.13 appears to apply to the STAR Registry Self-Assessment, not SLA. Is this a typo, and if so then what section was intended? If not, please explain the relationship to SLA. (Submitted: Jan 28, 2016 2:25:40 PM MST) Answer
- The reference to Section 8.13 should be 8.12. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 269
RFP Section 9.1 requires that Offerors bid a minimum discount off of their published government price catalog.

An Offeror may request that the term disabling code be removed from the Master Terms and Conditions if it is not used in the final Master Agreement. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 271
Section 9 of Attachment A (â€œRight to Publishâ€ ) appears to prohibit any sort of mention of the Agreement without advance permission. Will a Contractor need to seek permission in each case where it wants to alert a prospective Purchasing Entity in a Participating State of the existence of the Master Agreement, in order that the Contractor may encourage the prospective Purchasing Entity to utilize the Master Agreement for its needs? (Submitted: Jan 28, 2016 2:26:14 PM MST)
Answer
- No. (Answered: Jan 28, 2016 5:04:29 PM MST)
Question 272
RFP Section 7.2 requires incorporation of all Attachments. If an exception is not taken to Attachment E would an offeror be bound by those state specific terms and conditions when they attempt to negotiate a Participating Addendum with that respective State? Must exceptions to Attachment Eâ€™s state specific terms and conditions be taken at this phase? Or will additional time be granted for Offerors to prepare exceptions to the Participating Addenda in Attachment E? (Submitted: Jan 28, 2016 2:26:25 PM MST) Answer
- No. An offeror will negotiate State specific terms and conditions during the participating addendum process. (Answered: Jan 28, 2016 5:04:29 PM MST)
Question 273
In each of the Exhibits 1 and 2 to Attachment A, please explain what is meant by the section titled â€œWeb Servicesâ€ which says â€œthe Contractor shall use Web services exclusively to interface with the Purchasing Entityâ€™s data in near real time.â€ (Submitted: Jan 28, 2016 2:26:34 PM MST) Answer
- This question has been answered above. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 274
Regarding the following question:

6.2.2 Describe in detail the size and scope of the cloud solutions for which you have provided the types of services required by in this RFP.

What kind of details are you looking for? $ value? Number of users? Duration? Other? And how many customer solutions would be appropriate? (Submitted: Jan 28, 2016 3:03:22 PM MST) Answer
- Yes, all of those things list. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 275
Regarding Section 8.4.2.b, Customer Service: Is it acceptable for customer services representative(s) to be offshore, as long as they are available during the time frame defined by the Purchasing Agencies? (Submitted: Jan 28, 2016 3:06:16 PM MST)
Answer
- Yes. As long as no sensitive data (high risk data) is being transferred to them. (Answered: Jan 28, 2016 5:04:29 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 351
#2..
- 395 -
Question 275
Regarding Section 8.4.2.b, Customer Service: Is it acceptable for customer services representative(s) to be offshore, as long as they are available during the time frame defined by the Purchasing Agencies? (Submitted: Jan 28, 2016 3:06:16 PM MST)
Answer
- Yes. As long as no sensitive data (high risk data) is being transferred to them. (Answered: Jan 28, 2016 5:04:29 PM MST)
Question 276
In Section 3.14, the RFP mentions References. It is unclear how these will be scored, if at all, in the Evaluation process. Can this be clarified? And how many references are requested for maximum scoring? Finally, please define what information should be provided with these references. (Submitted: Jan 28, 2016 3:22:37

PM MST)
Answer
- Section 3.14 has been deleted. The State will not score/evaluate any references. (Answered: Jan 28, 2016 5:04:29

PM MST)
Question 277
There appears to be an ambiguity and inconsistency between section 3.1 requiring that all â€œexceptions to scope/contentâ€ be â€œaddressed within the Q&A periodâ€ and section 3.4 which requires that exceptions be made in the Offerorâ€™s Proposal. Please clarify whether exceptions need to be submitted through BidSync pursuant to Section 3.1 of the RFP to later be considered within the Offerorâ€™s proposal pursuant to section 3.4.

If an Offeror wishes to proposes its commercial terms as an exception to an RFP requirement which is not specifically in the Master Ts and Cs, should it submit those commercial terms as an exception in its proposal, and not as a question via BidSync? If an Offeror only proposes and submits its commercial terms as an exception to the Master Ts and Cs when it submits its final proposal will that Offerorâ€™s exceptions be allowed or considered responsive since it was not addressed in the Q&A period per section 3.1 of the RFP? (Submitted: Jan 28, 2016 3:25:00 PM MST)
Answer
- 3.4 states that: Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

3.1 states: Exceptions to scope/content of the RFP within an Offerorâ€™s proposal that have not been previously addressed within the Q&A period of the procurement are not allowed and may result in the Offerorâ€™s proposal being considered non-responsive.

The difference between the two sections is that 3.1 relates to RFP document. If an Offeror questions a mandatory minimum or scoreable criteria then it needs to address it during the Q&A period.

If an Offeror wants to modify the T&Cs then it can submit a redline version as part of its proposal. (Answered: Jan 28, 2016 5:04:29 PM MST)
Question 278
Section 3.4 states that â€œURLs provided with a proposal may result in that proposal being rejected as nonresponsive.â€ Does this apply to the total RFP or only to any Exceptions the Offerer submits? Can URLs be referenced in the response? (Submitted: Jan 28, 2016 4:22:04 PM MST) Answer
- URLs relates to Offerors taking exception to terms and conditions. An Offeror cannot take exception to the Master Agreement terms and conditions by stating that an Offerors terms and conditions can only be found at a URL. (Answered: Jan 28, 2016 5:04:29 PM MST)
Question 279

6.3 states "Offeror must provide audited financial statements to the State." How many years of audited financial statements does the State require? (Submitted: Jan 28, 2016 4:22:31 PM MST) Answer
- 6.3 has be been modified to require the last two years. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 280

6.3 states that the Offeror "should meet a minimum Dun and Bradstreet (D&B) credit rating of 4A2 or better, or a recognized equivalent rating." Our D&B service does not provide a credit rating. Will you accept other forms of credit reference e.g. A letter of reference from our bank? (Submitted: Jan 28, 2016 4:23:00 PM MST) Answer
- Yes. As long as you meet the financial strength component of the D&B rating. (Answered: Jan 28, 2016 5:04:29 PM MST)
Question 281
Which security certifications must the Offeror hold, or be in the process of obtaining, in order to comply with the RFP? (Submitted: Jan 28, 2016 4:23:35 PM MST)
Answer
- There is no requirement. An Offeror must list its security certifications to help purchasing entities make best value determinations. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 282

8.16 seems to imply that the Offeror will be storing data (other than CDR and similar data). Is there an expectation that the Offeror will be database of record for customer data? (Submitted: Jan 28, 2016 4:23:53 PM MST) Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 352
#2..
- 396 -
Answer
- There is no requirement. An Offeror must list its security certifications to help purchasing entities make best value determinations. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 282

8.16 seems to imply that the Offeror will be storing data (other than CDR and similar data). Is there an expectation that the Offeror will be database of record for customer data? (Submitted: Jan 28, 2016 4:23:53 PM MST) Answer
- For some solutions this could be the case. If 8.16 is not relevant to an Offeror's solution then an Offeror must describe why it is not relevant. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 283
Attachment A, Exhibits 1 and 2, Web Services state "The Contractor shall use Web services exclusively to interface with the Purchasing Entityâ€™s data in near real time." Will NASPO guarantee all Purchasing Entities are not only capable of consuming web services, but also willing to deny other potentially more desirable interface options, so that we as a Contractor may exclusively limit ourselves to their use as interfaces? (Submitted: Jan 28, 2016 4:24:13 PM MST)
Answer
- An offeror may take exceptions/additions to the master agreement terms and conditions in its proposal. (Answered: Feb 1, 2016 4:19:32 PM MST)
Question 284
Attachment A, Exhibits 1 and 2, Encryption of Data at Rest state "The Contractor shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data as identified in the SLA, unless the Contractor presents a justifiable position that is approved by the Purchasing Entity that Personal Data, is required to be stored on a Contractor portable device in order to accomplish work as defined in the scope of work." As this is a defined requirement for software and platform as a service options, is this requirement absolute, as it requires all hard drives containing personal data to be encrypted, regardless of platform, database, or operating system? (Submitted: Jan 28, 2016 4:24:26 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 285
Please confirm that Offerors need to provide only the CAIQ or CCM and not both reports. (Submitted: Jan 28, 2016 4:25:12 PM MST)
Answer
- The State is requesting that Offerors complete both documents to help purchasing entities make "best value" determinations. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 286
Can you provide specific direction regarding our insertion of list pricing into the response documents? The cost proposal section supports the insertion of discount percentages and only references itemized pricing. Where should the itemized pricing be included? (Submitted: Jan 28, 2016 4:25:27 PM MST) Answer
- The items pricing should be included in the cost proposal. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 287
Unduly Restrictive
Attachment A Section 16
Microsoft is self-insured, so this must be noted. Microsoftâ€™s program of self-assurance does cover the amounts listed in this section, however it should be noted that (as of the time of Proposal) â€œModerateâ€ is the highest Level of Risk that any Microsoft product is represented to be suitable for. Please see our Exception and Clarifying Statements to Section 5.6.4 for additional information on FedRAMP and NIST 800-53 Moderate controls.

Additionally, as it pertains to its program of self-insurance, Microsoft does not agree to name individual customers (whether Lead State, Participating Entities, or Purchasing Entities) as named insureds.

Additionally, while Microsoft is able to provide its renewal certificates upon request, but (as a provider of standardized services to many thousands of customers and millions of user) cannot be expected to institute a one-off operational process to notify any particular customer of renewals, let alone within any time frame.

Microsoft therefore respectfully requests the following changes to the subsections identified below, but otherwise accepts the remaining subsections of Section 16.

Revised Subsection a:
â€œUnless otherwise agreed in a Participating Addendum, Contractor shall, during the term of this Master Agreement, maintain in full force and effect, a program of self-insurance or the insurance described in this section. Contractor shall acquire such insurance from an insurance carrier or carriers licensed to conduct business in each Participating Entityâ€™s state and having a rating of A-, Class VII or better, in the most recently published edition of Bestâ€™s Reports. Failure to buy and maintain the required insurance may result in this Master Agreementâ€™s termination or, at a Participating Entityâ€™s option, result in termination of its Participating Addendum.â€ (Submitted: Jan 28, 2016 5:12:54 PM MST) Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 353
#2..
- 397 -
Agreement, maintain in full force and effect, a program of selfinsurance or the insurance described in this section. Contractor shall acquire such insurance from an insurance carrier or carriers licensed to conduct business in each Participating Entityâ€™s state and having a rating of A-, Class VII or better, in the most recently published edition of Bestâ€™s Reports. Failure to buy and maintain the required insurance may result in this Master Agreementâ€™s termination or, at a Participating Entityâ€™s option, result in termination of its Participating Addendum.â€ (Submitted: Jan 28, 2016 5:12:54 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 288
Unduly Restrictive
Attachment A Section 16
Revised Subsection d:

Prior to commencement of performance, Contractor shall provide to the Lead State a written endorsement to the Contractorâ€™s general liability insurance policy or other documentary evidence acceptable to the Lead State that provides that the Contractorâ€™s liability insurance policy shall be primary, with any liability insurance of any Participating State as secondary and noncontributory. Before performance of any Purchase Order issued after execution of a Participating Addendum authorizing it, the Contractor shall provide to a Purchasing Entity or Participating Entity who requests it the same information described in this subsection.

Revised Subsection e:
e. Contractor shall furnish to the Lead State, Participating Entity, and, on request, the Purchasing Entity copies of certificates of all required insurance within thirty (30) calendar days of the execution of this Master Agreement, the execution of a Participating Addendum, or the Purchase Orderâ€™s effective date and prior to performing any work. The insurance certificate shall provide the following information: the name and address of the insured; name, address, telephone number and signature of the authorized agent; name of the insurance company (authorized to operate in all states); a description of coverage in detailed standard terminology (including policy period, policy number, limits of liability, exclusions and endorsements); and an acknowledgment of the requirement for notice of cancellation. Copies of renewal certificates of all required insurance shall be furnished upon request. These certificates of insurance must expressly indicate compliance with each and every insurance requirement specified in this section. Failure to provide evidence of coverage may, at sole option of the Lead State, or any Participating Entity, result in this Master Agreementâ€™s termination or the termination of any Participating Addendum E (Submitted: Jan 28, 2016 5:14:24 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 289
Unduly Restrictive
The following 11 questions are based upon the following language:

Any and all Services offered and furnished shall comply fully with all applicable Federal and State laws and regulations.

The federal and state laws, regulations, policies, standards, and guidelines that Contractors doing business with the Participating Entities must be aware of, include, but not limited to: Criminal Justice Information Services (CJIS) Security Policy; Federal Educational Rights and Privacy Act (FERPA); Federal Information Security Management Act (FISMA); National Institute of Technology Standards; Gramm-Leach-Bliley Act (GLB) Act; Health Insurance Portability and Accountability Act (HIPAA); Health Information Technology for Economic and Clinical Health Act (HITECH); IRS Publication 1075; Payment Card Industry Data Security Standard (PCI DSS); Sarbanes-Oxley Act (SOX); Electronic Communications Privacy Act, Stored Communications Act and the PATRIOT Act. The list is intentionally United States-centric, and is not intended to be all-inclusive. Further, since laws, regulations, requirements and industry guidelines change, consulting definitive sources to assure a clear understanding of compliance requirements is critical. Many State Entities have additional program compliance requirements that must be considered in addressing compliance. (e.g..DMV Privacy Act, Public Service Law, etc.). (Submitted: Jan 28, 2016 5:22:54 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 290
Unduly Restrictive
To take each of the individual laws and standards that are mentioned in the 2nd paragraph:
1) CJIS. Specifically as it pertains to certain (but not all) Government Community Cloud Services, Microsoft will execute an FBI CJIS Addendum Certification. This certifies Microsoft agreement to comply with Appendix H to FBI CJIS Policy (applicable to private contractors) but not to comply with all other portions of CJIS Policy, which are intended to apply to the Purchasing Entities that are subject to CJIS Policy. Microsoftâ€™s ability and willingness to execute FBI CJIS Addendum Certifications currently only applies to those 16 States (not currently including Utah, but including several other potential Participating States such as California, Massachusetts, Minnesota, Kansas, and others) in which the Stateâ€™s CJIS Systems Agency (CSA) has executed a special Microsoft agreement called the CJIS Information Agreement, in which Microsoft and the CSA agree upon terms pursuant to which CJIS Policy audits will be conducted, and how the privacy of Microsoft personnel (subject to background checks by the CSA) will be protected, among other mutually-protective terms and conditions. Additionally, after each Statesâ€™ CSA executes CJIS Information Agreement, each individual Purchasing Entity in those States with CJIS Policy State of Utah Bid CH16012
3/22/2016 4:23 PM p. 354
#2..
- 398 -
intended to apply to the Purchasing Entities that are subject to CJIS Policy. Microsoftâ€ s ability and willingness
to execute FBI CJIS Addendum Certifications currently only applies to those 16 States (not currently including Utah, but including several other potential Participating States such as California, Massachusetts, Minnesota, Kansas, and others) in which the Stateâ€™s CJIS Systems Agency (CSA) has executed a special Microsoft agreement called the CJIS Information Agreement, in which Microsoft and the CSA agree upon terms pursuant to which CJIS Policy audits will be conducted, and how the privacy of Microsoft personnel (subject to background checks by the CSA) will be protected, among other mutually-protective terms and conditions. Additionally, after each Statesâ€™ CSA executes CJIS Information Agreement, each individual Purchasing Entity in those States with CJIS Policy requirements must also execute an Amendment in which the Purchasing Entity agrees to delegate its rights to audit and adjudicate employees to the CSA. Microsoft will be happy to provide a copy of the standard boilerplate Microsoft CJIS Information Agreement for review, however this is not something that can be incorporated into the Master Agreement as it must be executed by each Participating Stateâ€™s CSA, specifically (Submitted: Jan 28, 2016 5:23:44 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 291
unduly restrictive:
2) FERPA. The following contract language is included in the OST (Microsoft Online Services Terms, which is contractually incorporated). Note that â€œCustomerâ€ in this case â€œCustomerâ€ is equivalent to â€œPurchasing Entityâ€ : If a Customer is an educational agency or institution to which regulations under the Family Educational Rights and Privacy Act, 20 U.S.C. Â§ 1232g (FERPA) apply, Microsoft acknowledges that for the purposes of the OST, Microsoft is a â€œschool officialâ€ with â€œlegitimate educational interestsâ€ in the Customer Data, as those terms have been defined under FERPA and its implementing regulations, and Microsoft agrees to abide by the limitations and requirements imposed by 34 CFR 99.33(a) on school officials.

Customer understands that Microsoft may possess limited or no contact information for Customerâ€™s students and studentsâ€™ parents. Consequently, Customer will be responsible for obtaining any parental consent for any end userâ€™s use of the Online Service that may be required by applicable law and to convey notification on behalf of Microsoft to students (or, with respect to a student under 18 years of age and not in attendance at a postsecondary institution, to the studentâ€™s parent) of any judicial order or lawfully-issued subpoena requiring the disclosure of Customer Data in Microsoftâ€™s possession as may be required under applicable law. (Submitted: Jan 28, 2016 5:24:14 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 292
Unduly Restrictive
3) Federal Information Security Management Act (FISMA). Microsoft commits itself to certifying for FISMA via FedRAMP. Please see our clarifying statement and proposed alternative contract language above, for Section

5.6.4, which explains our commitment in this regard. Note that this only applies to our Government Community Cloud services (Submitted: Jan 28, 2016 5:24:51 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 293
Unduly Restrictive
4) National Institute of Technology. Here, we are unclear what the requirement is, because NIST is an organization that creates many different standards, only a few of which are applicable to cloud services. However, if NASPO means â€œNIST 800-53â€ then please see our response and proposed contract commitment pertaining to this, above in our Exception to RFP Section 5.6.4. (Submitted: Jan 28, 2016 5:25:16 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 294
Unduly Restrictive
5) GLB. Without representing that it is subject to Gramm-Leach-Bliley Act (GLB), Microsoft understands that it may have access under the contract to a Purchasing Entityâ€™s financial information and other nonpublic personal information protected thereby. To assist Purchasing Entities in meeting their GLB obligations, Microsoft will implement, maintain, and use appropriate administrative, technical and physical security measures to protect the confidentiality and integrity of all electronically maintained or transmitted Customer Data. Microsoft will protect the Customer Data it receives from or on behalf of Purchasing Entities according to commercially acceptable standards and no less rigorously than it protects its own confidential information. (Submitted: Jan 28, 2016 5:25:36 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 295
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 355
#2..
- 399 -
Customer Data it receives from or on behalf of Purchasing Entities according to commercially acceptable standards and no less rigorously than it protects its own confidential information. (Submitted: Jan 28, 2016 5:25:36 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 295
Unduly Restrictive
6) and 7) Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH). Microsoft has provided a Business Associate Agreement with this Proposal, and subject to that will comply with its obligations as Business Associate under these Statutes. (Submitted: Jan 28, 2016 5:26:17 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 296
LEVEL TWO: CSA STAR Certification
If the offeror possesses FedRAMP third party certification, would that meet requirements? (Submitted: Jan 28, 2016 5:26:45 PM MST)
Answer
- No. The certification is specific. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 297
Unduly Restrictive
8) IRS Publication 1075. For Purchasing Entities that must comply with this IRS regulation, Microsoft will execute the IRS â€œSafeguarding Contract Language for Technology Servicesâ€ (which is Exhibit 7 to IRS Publication 1075), solely for its Government Community Cloud versions of the following Online Services: Exchange Online, SharePoint Online, Exchange Online Archiving, Skype for Business, Office Web Apps when delivered as part of Office 365 Government E1 (formerly G1), E3 (formerly G3) and E4 (formerly G4) or other Government Community Cloud Offers, as well as the Azure Government services listed as being in the scope for IRS 1075 at http://azure.microsoft.com/en-us/support/trust-center/compliance/irs1075/ or its successor site. As a condition of doing this, each applicable Purchasing Entity must execute Microsoftâ€™s protective and clarifying Amendment related to this. A copy of this Amendment has been enclosed with Offerorâ€™s Proposal. (Submitted: Jan 28, 2016 5:26:57 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 298

8.15.1 Ability to recover and restore data within 4 business hours in the event of a severe outage. Describe your Recovery Point Objective (RPO) and Recovery Time Objective (RTO).

Please confirm the intent of the 4 business hours recovery is for system outage and not those facility outages requiring activation of the Disaster Recovery Plan, which is where offerors are asked to provide their current service level RPO and RTO. (Submitted: Jan 28, 2016 5:27:18 PM MST) Answer
- Yes. This has been modified. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 299
Unduly Restrictive
9) Payment Card Industry Data Security Standard (PCI DSS). A) The Azure platform is certified as compliant under PCI DSS version 3.0 at Service Provider Level 1 (the highest volume of transactionsâ€”more than 6 million a year).

Azure provides a platform that complies with the PCI DSS on which customers can develop a cardholder environment or card processing service. Customers can leverage Azureâ€™s validation in many of the underlying portions, thereby reducing the associated effort and costs of getting their own PCI DSS certification. It is, however, important to understand that Azureâ€™s PCI DSS compliance status does not automatically translate to PCI DSS certification for the services that Purchasing Entities (or their contractors) build or host on the Azure platform.

Purchasing Entities are responsible for ensuring that they achieve compliance with some PCI DSS requirements.

Microsoft publishes an Azure Customer PCI Guide (a copy of which is enclosed with the Proposal) which specifies areas of responsibility for each PCI DSS requirement, and whether it is assigned to Azure or the customer, or if the responsibility is shared. B) Other Microsoft cloud services are not certified for PCI-DSS Compliance, and Microsoft does not recommend storing or processing payment card numbers with such other services. Certain levels of Office 365 licenses provide Data Loss Prevention (DLP) capability, and those cases Microsoft provides DLP templates for PCI-DSS, in order to help Purchasing Entities ensure that their users are not improperly using payment card information on the services. (Submitted: Jan 28, 2016 5:27:25 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 300
Unduly Restrictive
10) Sarbanes Oxley (SOX)
As a corporationMicrosoftâ€™s business operations are subject to SOX However
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 356
#2..
- 400 -
improperly using payment card information on the services. ( , )
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 300
Unduly Restrictive
10) Sarbanes Oxley (SOX). As a corporation, Microsoftâ€™s business operations are subject to SOX. However, this is related to our own accounting practices and therefore not directly related to our customers use of any of our Online Services. Microsoft does not represent that its Online Services will assist Purchasing Entities with their SOX compliance, which is entirely the responsibility of the Purchasing Entities. (Submitted: Jan 28, 2016 5:27:45 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 301
Unduly Restrictive
11), 12) and 13) Electronic Communications Privacy Act, Stored Communications Act and the PATRIOT Act. As stated above, Microsoft complies with all laws that apply to it as a corporation, and as an IT Service Provider.

Microsoft does not accept responsibility for any portions of such laws that, as written, apply solely to Purchasing Entities.

Having explained the above, Microsoft respectfully declines to agree to Section 17, as written, but (a) will agree to comply with laws applicable to it as a corporation and as an IT Service Provider; and (b) to the extent that any of the above notes indicate specific Microsoftâ€™s willingness to sign amendments or agree to contract language, subject to the conditions outlined above, Microsoft will do so. (Submitted: Jan 28, 2016 5:28:19 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

However, the second paragraph in Section 17 has been deleted. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 302
Unduly Restrictive:

Attachment A, Section 23 Operations Management: Contractor shall maintain the administrative, physical, technical, and procedural infrastructure associated with the provision of the Product in a manner that is, at all times during the term of this Master Agreement, at a level equal to or more stringent than those specified in the Solicitation. Contractor must maintain any certifications required under the Solicitation As stated in the Microsoft Online Services Terms (OST), which is contractually incorporated, Microsoft is committed to helping protect the security of Customerâ€™s information. Microsoft has implemented and will maintain and follow appropriate technical and organizational measures intended to protect Customer Data against accidental, unauthorized or unlawful access, disclosure, alteration, loss, or destruction.

However, to the extent that Exceptions have been provided by Offeror to any of the requirements of the Solicitation, Microsoft cannot guarantee compliance with the requirement in this section to meet or exceed those Solicitation standards to which Exceptions have been taken, nor that it will maintain certifications to which Exceptions have been taken. Microsoft sincerely hopes that the terms and conditions that it is able to offer NASPO through the Offerors of its cloud services, subject to final negotiation, will meet the needs of all Participating Entities and Purchasing Entities in all Participating States. (Submitted: Jan 28, 2016 5:30:20 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 303
Unduly Restrictive:

Attachment A, Section 25 Purchasing Entity Data: Purchasing Entity retains full right and title to Data provided by it and any Data derived therefrom, including metadata.

Contractor shall not collect, access, or use user-specific Purchasing Entity Data except as strictly necessary to provide Service to the Purchasing Entity. No information regarding Purchasing Entityâ€™s use of the Service may be disclosed, provided, rented or sold to any third party for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. The obligation shall extend beyond the term of this Master Agreement in perpetuity.

Contractor shall not use any information collected in connection with this Master Agreement, including Purchasing Entity Data, for any purpose other than fulfilling its obligations under this Master Agreement.

Microsoft respectfully takes exception with the following words in the first sentence â€œand any data derived therefrom, including metadata,â€ and asks that these words be struck. Microsoft has no objection to the other words in this clause.

For clarity, Microsoft may use metadata derived from Customer Data for purposes necessary for the provision of the Online Services. Such use of metadata may include, but is not limited to, spam and virus filtering, data loss prevention, spillage support, transaction logs, temp files, and memory buffers. Microsoft shall not use metadata (or any other Customer Data) stored or transmitted by the Covered Service, or derive information from it, for any advertising or other commercial purpose of Microsoft or any third party.

However, Metadata is not retrievable or extractable, and may not be deleted, by Purchasing Entities. It is stored in Microsoftâ€™s internal databases, and retained and protected by Microsoft. (Submitted: Jan 28, 2016 5:31:03 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 304
Unduly Restrictive
Attachment A, Section 29 Title to Product: If access to the Product requires an application program interface (API), Contractor shall convey to Purchasing Entity an irrevocable and perpetual license to use the API.

Microsoft respectfully takes exception to this clause, as unreasonable. To the extent that all Products provided by Microsoft shall be Online Services provided pursuant to subscription licenses, all aspects of such Online Services (including APIs, to the extent applicable) are only licensed for the duration of that subscription. (Submitted: Jan 28, 2016 5:31:53 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 305
Unduly Restrictive
Attachment A, Section 30 Data Privacy: The Contractor must comply with all applicable laws related to data privacy and security, including IRS Pub 1075. Prior to entering into a SLA with a Purchasing Entity, the Contractor and Purchasing Entity must cooperate and hold a meeting to determine the Data Categorization to determine whether the Contractor will hold, store, or process High Risk Data, Moderate Risk Data and Low Risk Data. The Contractor must document the Data Categorization in the SLA or Statement of Work.

Please refer to our Exception and Clarifying Statements for Attachment A, Section 17, above in this document, which clarifies which laws and regulations Microsoft agrees to comply with, as applicable to Microsoft as a corporation and IT Service Provider. Our Statements clarify how Microsoft approaches compliance to specific standards, such as IRS 1075, and which of our various cloud services are in scope for each of those standards.

To reiterate a point made in that previous section, Microsoft does not agree to comply with laws (or portions of laws) that are written as applicable only to its customers and their industry or government function. (Submitted: Jan 28, 2016 5:32:43 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 306
Unduly Restrictive
Attachment A, Section 33 Waiver of Breach: Failure of the Lead State, Participating Entity, or Purchasing Entity to declare a default or enforce any rights and remedies shall not operate as a waiver under this Master Agreement or Participating Addendum. Any waiver by the Lead State, Participating Entity, or Purchasing Entity must be in writing.

Waiver by the Lead State or Participating Entity of any default, right or remedy under this Master Agreement or Participating Addendum, or by Purchasing Entity with respect to any Purchase Order, or breach of any terms or requirements of this Master Agreement, a Participating Addendum, or Purchase Order shall not be construed or operate as a waiver of any subsequent default or breach of such term or requirement, or of any other term or requirement under this Master Agreement, Participating Addendum, or Purchase Order.

Microsoft respectfully request to make this section reciprocal, to the extent we believe this is reasonable. As such, we have modified it accordingly, as follows.

Revised language:

Waiver of Breach: Failure of a party to declare a default or enforce any rights and remedies shall not operate as a waiver under this Master Agreement or Participating Addendum. Any waiver by a party must be in writing. Waiver by a party of any default, right or remedy under this Master Agreement or Participating Addendum, or by Purchasing Entity with respect to any Purchase Order, or breach of any terms or requirements of this Master Agreement, a Participating Addendum, or Purchase Order shall not be construed or operate as a waiver of any subsequent default or breach of such term or requirement, or of any other term or requirement under this Master Agreement, Participating Addendum, or Purchase Order. (Submitted: Jan 28, 2016 5:33:37 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 307
Unduly Restrictive
RFP Section 44 (which was renumbered from the original number 43 pursuant to Offerorâ€™s request to add a Limitation of Liability clause as Section 43) Entire Agreement: This Master Agreement, along with any attachment, contains the entire understanding of the parties hereto with respect to the Master Agreement unless a term is State of Utah Bid CH16012
3/22/2016 4:23 PM p. 358
#2..
- 402 -
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 307
Unduly Restrictive
RFP Section 44 (which was renumbered from the original number 43 pursuant to Offerorâ€™s request to add a Limitation of Liability clause as Section 43) Entire Agreement: This Master Agreement, along with any attachment, contains the entire understanding of the parties hereto with respect to the Master Agreement unless a term is modified in a Participating Addendum with a Participating Entity. No click-through, or other end user terms and conditions or agreements required by the Contractor (â€œAdditional Termsâ€ ) provided with any Services hereunder shall be binding on Participating Entities or Purchasing Entities, even if use of such Services requires an affirmative â€œacceptanceâ€ of those Additional Terms before access is permitted. Please see Exception and Clarifying Statements for RFP Section 5.5.14, pertain to â€œAdditional Terms.â€ Offer and Microsoft are willing to make the commitments shown in the Clarifying Statements, but respectfully takes exception with this clause as written. (Submitted: Jan 28, 2016 5:34:47 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 308
Unduly Restrictive
Exhibit 1 to Attachment A, Section 2c
Also Exhibit 2 to Attachment A, Section 2c All Personal Data shall be encrypted at rest and in transit with controlled access. Unless otherwise stipulated, the Contractor is responsible for encryption of the Personal Data. Any stipulation of responsibilities will identify specific roles and responsibilities and shall be included in the service level agreement (SLA), or otherwise made a part of the Master Agreement.

Please see explanations and definition of Customer Content in our exception to RFP Section 5.6.6, above. In that Exception, we explain that Customer Content in SaaS (of which, most Personal Data is a subset) is stored at rest in the US, and in what cases it is encrypted.

However, specifically as it pertains to the limited set of data in the Directory which is used to manage user accounts contains the names and email addresses of licensed users, that specific data is not encrypted at rest.

This is not sensitive Customer Content. Microsoft respectfully takes exception with any requirement that Directory data be encrypted.

Please refer to Microsoftâ€™s proposed contract language in its Exception and Clarifying Statements pertaining to RFP Section 5.6.6, above in this document. (Submitted: Jan 28, 2016 5:35:34 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 309
Unduly Restrictive
Exhibit 1 to Attachment A, Section 2d
Also Exhibit 2 to Attachment A, Section 2d Unless otherwise stipulated, the Contractor shall encrypt all Non-Public Data at rest and in transit. The Purchasing Entity shall identify data it deems as Non-Public Data to the Contractor.

The level of protection and encryption for all Non -Public Data shall be identified in the SLA.

As it pertains to Directory data (and the definition of Customer Content), please See Exception and Clarifying Statement for Section 2c, immediately above. Additionally, Microsoft treats all Customer Content in its SaaS services equally, and does not monitor whether data is public or non-public (it is all assumed to be non-public and treated according, except in cases where the services are used by Purchasing Entities to display data on their public Website). The level of Encryption is controlled by Microsoft based upon its system design, and is not selectable by individual Purchasing Entities, and is not identified in Microsoftâ€™s SLA.

As such, Microsoft respectfully takes exception to this requirement as written, and requests that it be struck. â€¢ Please refer to the Microsoft Online Services Terms for Microsoftâ€™s contractual commitments pertaining to encryption.
â€¢ Please refer to Microsoftâ€™s proposed contract language in its Exception and Clarifying Statements pertaining to RFP Section 5.6.6, above in this document. (Submitted: Jan 28, 2016 5:36:18 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 310
Unduly Restrictive
Exhibit 1 to Attachment A, Section 2e
Also Exhibit 2 to Attachment A, Section 2e At no time shall any data or processes â€” that either belong to or are intended for the use of a Purchasing Entity or its officers, agents or employees â€” be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the Purchasing Entity. Clarifying Statement As per Microsoftâ€™s previous Exceptions and Clarifying Statements above in this document, (1) metadata is owned and retained by Microsoft; (2) no form of Customer Data or metadata is used for any purpose other than State of Utah Bid CH16012
3/22/2016 4:23 PM p. 359
#2..
- 403 -
Unduly Restrictive
Exhibit 1 to Attachment A, Section 2e
Also Exhibit 2 to Attachment A, Section 2e At no time shall any data or processes â€” that either belong to or are intended for the use of a Purchasing Entity or its officers, agents or employees â€” be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the Purchasing Entity. Clarifying Statement As per Microsoftâ€™s previous Exceptions and Clarifying Statements above in this document, (1) metadata is owned and retained by Microsoft; (2) no form of Customer Data or metadata is used for any purpose other than operating and supporting the Online Services; and (3) disclosure of Customer Data to law enforcement is subject to law, but is protected by Microsoft according to the terms and conditions cited above in this document and in the Microsoft Online Services Terms. (Submitted: Jan 28, 2016 5:36:52 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 311
Unduly Restrictive
Exhibit 1 to Attachment A, Section 3
Also Exhibit 1 to Attachment A, Section 3 Data Location: The Contractor shall provide its services to the Purchasing Entity and its end users solely from data centers in the U.S. Storage of Purchasing Entity data at rest shall be located solely in data centers in the U.S. The Contractor shall not allow its personnel or contractors to store Purchasing Entity data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The Contractor shall permit its personnel and contractors to access Purchasing Entity data remotely only as required to provide technical support. The Contractor may provide technical user support on a 24/7 basis using a Follow the Sun model, unless otherwise prohibited in a Participating Addendum.

Please see the Exception and Clarifying Statements for RFP Section 5.6.6, above in this document, for information pertaining to Microsoftâ€™s contractual commitments to storing and processing Customer Content and other forms of Customer Data in the United States. To the extent that such commitments accurately describe Microsoftâ€™s commitments, Microsoft respectfully requests that this Section 3 be struck and that the aforementioned commitments apply in lieu thereof. (Submitted: Jan 28, 2016 5:37:33 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 312
Unduly Restrictive
The next question is based on the following- question following next per maximum word limit:

Exhibit 1 to Attachment A, Section 8 Background Checks:

Upon the request of the Purchasing Entity, the Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Master Agreement who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or misdemeanor offense for which incarceration for up to 1 year is an authorized penalty. The Contractor shall promote and maintain an awareness of the importance of securing the Purchasing Entityâ€™s information among the Contractorâ€™s employees and agents. If any of the stated personnel providing services under a Participating Addendum is not acceptable to the Purchasing Entity in its sole opinion as a result of the background or criminal history investigation, the Purchasing Entity, in itsâ€™ sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate the Participating Addendum and any related service agreement. (Submitted: Jan 28, 2016 5:40:09 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 313
question:

Microsoft respectfully requests to replace the wording from the RFP with the following contractual commitment, which more accurately describes Microsoftâ€™s procedures pertaining to each of its personnel that are expected to have access to Customer Content:

Microsoft performs the following background checks on all US personnel who have potential to access Customer Data. Adherence to this policy is one of the control procedures addressed by the Microsoft Audit Report per the section of the Microsoft Online Services Terms titled â€œMicrosoft Audits of Online Services.â€ Such Background Checks will be performed in accordance with the Fair Credit Reporting Act and will consist of Social Security Number trace, seven (7) year felony and misdemeanor criminal records check of federal, state, or local records (as applicable) for job related crimes, Office of Foreign Assets Control List (OFAC) check, Bureau of Industry and Security List (BIS) check and Office of Defense Trade Controls Debarred Persons List (DDTC) check.

Additionally, for States with which Microsoft has entered into a Microsoft CJIS Information Agreement and provided an FBI CJIS Addendum Certification to the applicable CJIS Systems Agency (CSA, e.g. the California Department of Justice), for its CJIS Covered Services (which are most of the Microsoft Government Community Cloud Services), Microsoft submits its personnel that have access to unencrypted Criminal Justice Information and other Customer Content (including both employees and subcontractors, where applicable) for FBI NCIC fingerprint background checks and adjudication by each such CSA (Submitted: Jan 28, 2016 5:41:24 PM MST) Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 360
#2..
- 404 -
Additionally, for States with which Microsoft has entered into a Microsoft CJIS Information Agreement and provided an FBI CJIS Addendum Certification to the applicable CJIS Systems Agency (CSA, e.g. the California Department of Justice), for its CJIS Covered Services (which are most of the Microsoft Government Community Cloud Services), Microsoft submits its personnel that have access to unencrypted Criminal Justice Information and other Customer Content (including both employees and subcontractors, where applicable) for FBI NCIC fingerprint background checks and adjudication by each such CSA (Submitted: Jan 28, 2016 5:41:24 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 314
Unduly Restrictive
Language question is following per maximum word limit:

Access to Security Logs and Reports: The Contractor shall provide reports on a schedule specified in the SLA to the Purchasing Entity in a format as specified in the SLA agreed to by both the Contractor and the Purchasing Entity. Reports shall include latency statistics, user access, user access IP address, user access history and security logs for all public jurisdiction files related to this Master Agreement and applicable Participating Addendum. (Submitted: Jan 28, 2016 5:43:28 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 315
question:

For certain key Microsoft Online Services (at minimum, those referenced in the proposed alternative language, below), Purchasing Entities are provided with self-service access to a number of security-related reports through the Administrator Console. These reports may change from time to time, and Microsoft is committed to designing services which meet the demands of its customers. However, Microsoft does not provide access to other internally-kept logs to its customers, as this would be disruptive to operations. Microsoft does not provide such reports for all its services, but more will provide more information upon request as to the reporting capabilities of its services.

Microsoft respectfully requests to replace the RFP language with this section with the following alternative language:
â€œFor the Online Services included in the Data Processing Terms section of the Microsoft Online Services Terms, Event Logging. Microsoft logs, or enables Customer to log, access and use of information systems containing Customer Data, registering the access ID, time, authorization granted or denied, and relevant activity.

Microsoft shall allow Purchasing Entities reasonable self-service access to security information, latency data, and other related SaaS security data that affect this Contract and the Purchasing Entityâ€™s Data, at no cost to the Purchasing Entity. The parties recognize that the type of self-service access and security data made available to Purchasing Entities may be subject to change. (Submitted: Jan 28, 2016 5:44:27 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 316
Unduly Restrictive:

The next question is based on the following per the maximum word limit:

Exhibit 1 to Attachment A, Section 11
Also Exhibit 2 to Attachment A, Section 11 Data Center Audit: The Contractor shall perform an independent audit of its data centers at least annually at its expense, and provide an unredacted version of the audit report upon request to a Purchasing Entity. The Contractor may remove its proprietary information from the unredacted version. A Service Organization Control (SOC) 2 audit report or approved equivalent sets the minimum level of a third-party audit. (Submitted: Jan 28, 2016 5:48:58 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 317
question based on previous comment:

Microsoft respectfully requests that this entire section be struck and not apply. Neither Microsoft nor, we believe, any similarly situated provider of standardized cloud services at mass scale, can reasonably be expected to customize their procedures and processes for such notification for any individual customers.

That said, Microsoft strives to provide as much advance notice as possible of changes (both major and minor) to its services, and in most if not all cases will provide at least 12 months advance notice of any changes expected to have significant impact to its customers.

Finally, regarding updates and upgrades, Microsoft does not charge extra for new and updated features added to any given subscription-licensed â€œplanâ€ for its Online Service. However, Microsoft may reasonably choose to create new license plans in order to monetize new features and functionality (Submitted: Jan 28, 2016 5:50:15 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 361
#2..
- 405 -
customize their procedures and processes for such notification for any individual customers.

Finally, regarding updates and upgrades, Microsoft does not charge extra for new and updated features added to any given subscription-licensed â€œplanâ€ for its Online Service. However, Microsoft may reasonably choose to create new license plans in order to monetize new features and functionality (Submitted: Jan 28, 2016 5:50:15 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 318
Unduly Restrictive
The following two questions are based on the following:

Exhibit 1 to Attachment A, Section 13
Also, Exhibit 2 to Attachment A, Section 13
Also, Exhibit 3 to Attachment A, Section 13 Security: As requested by a Purchasing Entity, the Contractor shall disclose its non-proprietary system security plans (SSP) or security processes and technical limitations to the Purchasing Entity such that adequate protection and flexibility can be attained between the Purchasing Entity and the Contractor. For example: virus checking and port sniffing â€” the Purchasing Entity and the Contractor shall understand each otherâ€™s roles and responsibilities. (Submitted: Jan 28, 2016 5:52:02 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 319
RFP, p. 25, #6.3 â€“ Financials - Your response to providing links as as a response to this section was â€œLinks are acceptableâ€ . Can we also provide links as responses to details requested on other sections of the RFP like SLAâ€™s, product offerings and other sections? A lot of the requested information is available on our public website and where appropriate we would like to refer to these publicly available links as out response. (Submitted: Jan 28, 2016 5:52:24 PM MST) Answer
- An exception is given to financials because it is mandatory requirement and evaluators will not be given that information.

For other criteria evaluators, who may print off a hard copy of a proposal, need to be able to read the information without visiting a website. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 320
part 1:

Microsoft proposes the following alternative language, which is also found in the Microsoft Online Services Terms (OST) and applies exclusively to the Microsoft Services included in the Data Processing Terms, or DPT, Section of the OST. Those DPT-included services include Microsoft Office 365 Services, Dynamics CRM Online Services, Microsoft Azure Core Services, and Microsoft Intune Online Services (each, as defined in the DPT). Proposed language follows:
â€œOnline Services Information Security Policy
â€œEach Online Service follows a written data security policy (â€œInformation Security Policyâ€ ) that complies with the control standards and frameworks shown in the table below.

Microsoft may add industry or government standards at any time. Microsoft will not eliminate a standard or framework in the table above, unless it is no longer used in the industry and it is replaced with a successor (if any). Azure Government Services meet a separate set of control standards and frameworks, as detailed on the Microsoft Azure Trust Center (Submitted: Jan 28, 2016 5:52:50 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 321
part 2:

Subject to non-disclosure obligations, Microsoft will make each Information Security Policy available to Customer, along with other information reasonably requested by Customer regarding Microsoft security practices and policies.

Customer is solely responsible for reviewing each Information Security Policy and making an independent determination as to whether it meets Customerâ€™s requirements. (Submitted: Jan 28, 2016 5:53:16 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 322
Unduly Restrictive
The following questions (labeled parts) are based on the following:

Exhibit 1 to Attachment A, Section 14
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 362
#2..
- 406 -
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 322
Unduly Restrictive
The following questions (labeled parts) are based on the following:

Exhibit 1 to Attachment A, Section 14
Also, Exhibit 2 to Attachment A, Section 14
Also, Exhibit 3 to Attachment A, Section 14 Non-disclosure and Separation of Duties: The Contractor shall enforce separation of job duties, require commercially reasonable non-disclosure agreements, and limit staff knowledge of Purchasing Entity data to that which is absolutely necessary to perform job duties. (Submitted: Jan 28, 2016 5:54:39

PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 323
Part 1:

Microsoft respectfully takes exception to this requirement, as written, and requests that its own language apply, to the extent that it more accurately describes Microsoftâ€™s commitments, which are applied uniformly for its standardized multitenant cloud services.

For this, Microsoft calls attention to the following statements (relevant to the subject matter of these RFP Sections) from the Data Processing Terms (DPT) section of the Microsoft Online Services Terms (OST), which apply solely to those Microsoft Online Services Products listed in the DPT, and which Microsoft is willing to use for these RFP Exhibit Sections, in lieu of the original RFP Language:

Security Ownership. Microsoft has appointed one or more security officers responsible for coordinating and monitoring the security rules and procedures. (Submitted: Jan 28, 2016 5:55:09 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 324
part 2:

Security Roles and Responsibilities. Microsoft personnel with access to Customer Data are subject to confidentiality obligations.

Security Training. Microsoft informs its personnel about relevant security procedures and their respective roles.

Microsoft also informs its personnel of possible consequences of breaching the security rules and procedures.

Microsoft will only use anonymous data in training.

Physical Access to Facilities. Microsoft limits access to facilities where information systems that process Customer Data are located to identified authorized individuals.

Physical Access to Components. Microsoft maintains records of the incoming and outgoing media containing Customer Data, including the kind of media, the authorized sender/recipients, date and time, the number of media and the types of Customer Data they contain.

Operational Policy. Microsoft maintains security documents describing its security measures and the relevant procedures and responsibilities of its personnel who have access to Customer Data. (Submitted: Jan 28, 2016 5:55:37 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 325
part 3:

Access Policy. Microsoft maintains a record of security privileges of individuals having access to Customer Data.

Access Authorization
- Microsoft maintains and updates a record of personnel authorized to access Microsoft systems that contain Customer Data.
- Microsoft deactivates authentication credentials that have not been used for a period of time not to exceed six months.
- Microsoft identifies those personnel who may grant, alter or cancel authorized access to data and resources. - Microsoft ensures that where more than one individual has access to systems containing Customer Data, the individuals have separate identifiers/log-ins.

Least Privilege
- Technical support personnel are only permitted to have access to Customer Data when needed. - Microsoft restricts access to Customer Data to only those individuals who require such access to perform their job function.

Integrity and Confidentiality
- Microsoft instructs Microsoft personnel to disable administrative sessions when leaving premises Microsoft controls or when computers are otherwise left unattended. - Microsoft stores passwords in a way that makes them unintelligible while they are in force.

Authentication (Submitted: Jan 28, 2016 5:56:18 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 363
#2..
- 407 -
job function.

Authentication (Submitted: Jan 28, 2016 5:56:18 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 326
part 4:

Microsoft stores passwords in a way that makes them unintelligible while they are in force.

Authentication
- Microsoft uses industry standard practices to identify and authenticate users who attempt to access information systems.
- Where authentication mechanisms are based on passwords, Microsoft requires that the passwords are renewed regularly.
- Where authentication mechanisms are based on passwords, Microsoft requires the password to be at least eight characters long.
- Microsoft ensures that de-activated or expired identifiers are not granted to other individuals. - Microsoft monitors, or enables Customer to monitor, repeated attempts to gain access to the information system using an invalid password.
- Microsoft maintains industry standard procedures to deactivate passwords that have been corrupted or inadvertently disclosed. (Submitted: Jan 28, 2016 5:57:04 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 327
part 5:

Microsoft uses industry standard password protection practices, including practices designed to maintain the confidentiality and integrity of passwords when they are assigned and distributed, and during storage.

Network Design. Microsoft has controls to avoid individuals assuming access rights they have not been assigned to gain access to Customer Data they are not authorized to access. (Submitted: Jan 28, 2016 5:57:34 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 328
Unduly Restrictive:

The following question is based on the following (per the max letter count):

Exhibit 1 to Attachment A, Section 15
Also, Exhibit 2 to Attachment A, Section 15
Also, Exhibit 3 to Attachment A, Section 15 Import and Export of Data: The Purchasing Entity shall have the ability to import or export data in piecemeal or in entirety at its discretion without interference from the Contractor at any time during the term of Contractorâ€™s contract with the Purchasing Entity. This includes the ability for the Purchasing Entity to import or export data to/from other Contractors. Contractor shall specify if Purchasing Entity is required to provide itsâ€™ own tools for this purpose, including the optional purchase of Contractors tools if Contractors applications are not able to provide this functionality directly. (Submitted: Jan 28, 2016 6:00:28 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 329
question:

Microsoft respectfully takes exception to this clause, as written, for the following reasons:
(a) It does not take into account the diversity of Online Services that Microsoft has to offer, each of which uses Customer Data in different forms and for different purposes. For example, it is reasonable to expect that a Purchasing Entityâ€™s administrator be able to extract emails, calendar entries and attachments thereto. But for an Online Service whose function it is to remotely install software uploaded to it by administrators, it is also reasonable for the service provider to assume that the Administrator has, himself or herself, retained a copy of the software program, and therefore does not need to be able to extract it from the Online Service. (b) It is also reasonable for a service provider to apply a time limit to the amount of time a Purchasing Entity has to extract its data (if applicable), following the expiration or termination of a subscription order for that service, even if the contract remains in effect for purposes of ordering other products. And (c) It is unreasonable to expect a service provider to export data in whatever form a Purchasing Entity wants, including in a format for export to a different service providerâ€™s product.

For additional information about how data is extracted, please refer to our Exceptions and Clarifying Statements above for RFP Section 8.7, as well as for the Sections of these Exhibits titled â€œtermination and Suspension of Services.â€ (Submitted: Jan 28, 2016 6:01:26 PM MST)
Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 364
#2..
- 408 -
6 extract its data (if applicable), following the expiration or termination of a subscription order for that service, even if the contract remains in effect for purposes of ordering other products. And (c) It is unreasonable to expect a service provider to export data in whatever form a Purchasing Entity wants, including in a format for export to a different service providerâ€™s product.

Exhibit 1 to Attachment A, Section 16
Also, Exhibit 2 to Attachment A, Section 16
Also, Exhibit 2 to Attachment A, Section 16 Responsibilities and Uptime Guarantee: The Contractor shall be responsible for the acquisition and operation of all hardware, software and network support related to the services being provided. The technical and professional activities required for establishing, managing and maintaining the environments are the responsibilities of the Contractor. The system shall be available 24/7/365 (with agreed-upon maintenance downtime), and provide service to customers as defined in the SLA.

With the following exception, Microsoft agrees to this language.

Microsoft respectfully takes exception to the parenthetical phrase pertaining to agreed-upon maintenance downtime, and asks that it be struck. As the provider of standardized multitenant services to many thousands of customers, Microsoft must reasonably be able to schedule downtime (which may apply to all Microsoftâ€™s customers simultaneously) without subjecting its scheduling to the approval of any single customer. (Submitted:

Jan 28, 2016 6:02:12 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 331
Unduly Restrictive
The following questions labeled parts, are based on the following:

Exhibit 1 to Attachment A, Section 19
Also, Exhibit 2 to Attachment A, Section 18 Business Continuity and Disaster Recovery: The Contractor shall provide a business continuity and disaster recovery plan upon request and ensure that the Purchasing Entityâ€™s recovery time objective (RTO) of XXX hours/days is met. (XXX hour/days shall be provided to Contractor by the Purchasing Entity.) Contractor must work with the Purchasing Entity to perform an annual Disaster Recovery test and take action to correct any issues detected during the test in a time frame mutually agreed between the Contractor and the Purchasing Entity. (Submitted: Jan 28, 2016 6:03:22 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 332
Part 1:

Microsoft does not guarantee an RTO. Please refer to Microsoftâ€™s Service Level Agreement (provided with Offerorâ€™s proposal) for the extent of Microsoftâ€™s guarantee of uptime performance, including service credits for failure to meet the requirements of the SLA.

Microsoft performs its own tests, not in conjunction with any single customer from among the thousands of customers of its standardized multitenant cloud service. 5 customers of its standardized multitenant cloud service.

Microsoft respectfully declines to agree to the language of this section, as written, but is willing to make the following contractual guarantees in lieu thereof, solely for the Microsoft Online Services identified as in scope for the Data Processing Terms (DPT) section of the Microsoft Online Services Terms (OST), which include Microsoft Office 365 Services, Microsoft Azure Core Services, Dynamics CRM Online Services, and Microsoft Intune Service:

Part 1: Data retention:

Customer Data will be processed and retained intact for the duration of Customerâ€™s subscription (including data retention period defined in the Online Services Terms document) as described in applicable Online Services documentation published by Microsoft. Processing will be, in accordance with Customer instructions provided in this enrollment and provided through end user and administrator actions and inactions during the use of the services (Submitted: Jan 28, 2016 6:03:56 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 333
Part 2:

Microsoft has specific procedures in place governing access to copies of Customer Data State of Utah Bid CH16012
3/22/2016 4:23 PM p. 365
#2..
- 409 -
Part 2:

Part 2: Data Recovery Procedures:
- On an ongoing basis, but in no case less frequently than once a week (unless no Customer Data has been updated during that period), Microsoft maintains multiple copies of Customer Data from which Customer Data can be recovered.
- Microsoft stores copies of Customer Data and data recovery procedures in a different place from where the primary computer equipment processing the Customer Data is located. - Microsoft has specific procedures in place governing access to copies of Customer Data. - Microsoft reviews data recovery procedures at least every six months. - Microsoft logs data restoration efforts, including the person responsible, the description of the restored data and where applicable, the person responsible and which data (if any) had to be input manually in the data recovery process.
- In the event such Customer Data restoration activities are conducted and upon subsequent Customer request, Microsoft will make the forgoing information from such logs available to the State, provided that: i) information will be provided only where it can be extracted from system wide logging with commercially reasonable efforts; ii) Microsoft shall not be subject to an urgent timeframe for completion of the request (except as may be required by applicable law); and iii) any information in such logs which pertains to other Microsoft customers and their data, or would compromise the security of the Office 365 Services, will be withheld. For clarity, â€œdata restoration effortsâ€ does not include automated Customer Data recovery processes such as when one of Microsoftâ€™s datacenters is activated upon failure of another. (Submitted: Jan 28, 2016 6:04:47 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 334
Unduly Restrictive:

Exhibit 1 to Attachment A, Section 20
Also, Exhibit 2 to Attachment A, Section 19 Compliance with Accessibility Standards: The Contractor shall comply with and adhere to Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973, or any other state laws or administrative regulations identified by the Participating Entity.

Microsoft supports governmentsâ€™ obligations to provide accessible technologies to its citizens with disabilities as required by Section 508 of the Rehabilitation Act of 1973, and its state law counterparts. We encourage our customers to judiciously compare product accessibility performance.

The Voluntary Product Accessibility Templates (â€œVPATsâ€ ) for the Microsoft technologies used in providing the online services can be found at Microsoftâ€™s VPAT page. Further information regarding Microsoftâ€™s commitment to accessibility can be found at www.microsoft.com/enable.

However, Microsoft respectfully takes exception to this statement as written, to the extent that Microsoft asserts that it is its customersâ€™ obligation to comply with such accessibility provisions, although Microsoft is committed to aiding its customersâ€™ compliance. Additionally, Section 508 is written to apply to Federal government agencies which use software, not to the manufacturers thereof. In the event that a prospective Participating State has a specific statute that is written to apply to the manufacturer (rather than to each government agency), Microsoft will engage in discussion with the applicable Participating State to determine whether that Stateâ€™s needs may be met. (Submitted: Jan 28, 2016 6:05:55 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 335
â€œSupport at no additional costâ€ as required in the RFP section 5.5.11 is generally quite limited in the marketplace for the offerings that are requested within this RFP.

Furthermore, â€œno-cost supportâ€ is not necessarily always applicable to the entire breadth and depth of products/services requested within this RFP . Generally, enterprises and organizations opt for an â€œadvancedâ€ level of support to meet their required SLAâ€™s for such offerings.

Is the State willing to accept loaded costs inclusive of â€œadvancedâ€ support levels? Or, would the State prefer that the support-costs are listed as a required, separate line item? (Submitted: Jan 28, 2016 6:06:24 PM MST) Answer
- The state has modified 5.5.11 to state that all "general support shall be provided at no additional costs..." The State prefer that the support-costs are listed as a required, separate line item. (Answered: Jan 29, 2016 1:48:33

PM MST)
Question 336
Unduly Restrictive:

Exhibit 1 to Attachment A, Section 22 Encryption of Data at Rest: The Contractor shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data, unless the Purchasing Entity approves in writing for the storage of Personal Data on a Contractor portable device in order to accomplish work as defined in the statement of work Microsoft respectfully takes exception to this clause, as written, and requests to substitute the alternative language below:
â€œTo whatever extent a form or use of encryption is required of Microsoft pursuant to any of the industry and Federal government standards committed by Microsoft in this Master Agreement and the Microsoft Online Services Terms, Microsoft will comply with such requirements.â€ Explanation:

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 366
#2..
- 410 -
Cryptographic Modules for all Personal Data, unless the Purchasing Entity approves in writing for the storage of Personal Data on a Contractor portable device in order to accomplish work as defined in the statement of work Microsoft respectfully takes exception to this clause, as written, and requests to substitute the alternative language below:
â€œTo whatever extent a form or use of encryption is required of Microsoft pursuant to any of the industry and Federal government standards committed by Microsoft in this Master Agreement and the Microsoft Online Services Terms, Microsoft will comply with such requirements.â€ Explanation:

For the primary Online Services offeror intends to sell under the Master Agreement and which store or process Customer Data at rest (which are those Online Services Microsoft lists in the Data Processing Terms <DPT> of the Microsoft Online Services Terms <OST>) Microsoft is committed to comply with the industry standards (and, in the case of our Government Community Cloud services, the government services) that have been cited in Offerorâ€™s proposed alternative contract language, above in this document (and in the OST). Not all forms of data need to be encrypted in order to meet those industry and government standards, but to the extent they do then that data will be encrypted, using whatever standards (whether FIPS 140-2 or other) that are set forth in those standards. To the extent the Encryption requirements of those standards change over time, so will Microsoftâ€™s use of encryption technology. (Submitted: Jan 28, 2016 6:06:39 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 337
Unduly Restrictive:

Exhibit 1 to Attachment A, Section 23
Also, Exhibit 2 to Attachment A, Section 22
Also, Exhibit 3 to Attachment A, Section 19 Subscription Terms: Contractor grants to a Purchasing Entity a license to: (i) access and use the Service for its business purposes; (ii) for SaaS <Exhibit 1> PaaS <Exhibit 2> IaaS <Exhibit 3>, use underlying software as embodied or used in the Service; and (iii) view, copy, upload and download (where applicable), and use Contractorâ€™s documentation.

No Contractor terms, including standard click through license or website terms or use of privacy policy, shall apply to Purchasing Entities unless such terms are included in this Master Agreement.

Microsoft respectfully takes exception to this Section, and asks that it be struck, to the extent that it is ambiguous and incomplete, and unreasonably conflicts with the reasonable subscription licensing terms Microsoft offers to Purchasing Entities through Offeror.

Microsoftâ€™s license grant to Each Offeror/Contractor (which is passed through to Purchasing Entities) is based upon the quantity and duration of subscription licenses for which orders are placed. The terms of use of such licenses are included in the Microsoft Online Services Terms, which is incorporated into the contract.

As for documentation, that is limited to what Microsoft makes available to all its customers of the same services.

In most cases, that consists of webpages, not all of which may be formatted suitably for printing, although nothing in Microsoftâ€™s terms of use of those websites prohibits end users or administrators from printing the documentation.

Finally, as it pertains to click-through terms, please see the Exception and Clarifying Statement for RFP Section

5.5.14, above in this document. (Submitted: Jan 28, 2016 6:07:34 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

This information should be included in Microsoft's redline version of the Terms and Conditions. The State cannot modify the Master Agreement Terms and Conditions for every Offeror as proposed. (Answered: Jan 29, 2016 1:48:33

PM MST)
Question 338
Unduly Restrictive:

The following questions labeled Parts are based on the following:

Exhibit 2 to Attachment A, Section 8
Also, Exhibit 3 to Attachment A, Section 8 Background Checks:
a. Upon the request of the Purchasing Entity, the Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Master Agreement who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or misdemeanor offense for which incarceration for up to 1 year is an authorized penalty. The Contractor shall promote and maintain an awareness of the importance of securing the Purchasing Entityâ€™s information among the Contractorâ€™s employees and agents.
b. The Contractor and the Purchasing Entity recognize that security responsibilities are shared. The Contractor is responsible for providing a secure infrastructure. The Purchasing Entity is responsible for its secure guest operating system, firewalls and other logs captured within the guest operating system. Specific shared responsibilities are identified within the SLA.
c. If any of the stated personnel providing services under a Participating Addendum is not acceptable to the Purchasing Entity in its sole opinion as a result of the background or criminal history investigation, the Purchasing Entity, in itsâ€™ sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate the Participating Addendum and any related service agreement. (Submitted: Jan 28, 2016 6:12:25 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 367
#2..
- 411 -
responsibilities are identified within the SLA.
c. If any of the stated personnel providing services under a Participating Addendum is not acceptable to the Purchasing Entity in its sole opinion as a result of the background or criminal history investigation, the Purchasing Entity, in itsâ€™ sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate the Participating Addendum and any related service agreement. (Submitted: Jan 28, 2016 6:12:25 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 339
Part 1:

Exception and Clarifying Statement
Microsoft provides standardized multitenant Online Services that reasonably cannot be customized for any one of its many thousands of customers. Additionally, Microsoftâ€™s SLA does not pertain to security logs and reports.

Microsoft shall allow Purchasing Entities reasonable self-service access to security information, latency data, and other related SaaS security data that affect this Contract and the Purchasing Entityâ€™s Data, at no cost to the Purchasing Entity. The parties recognize that the type of self-service access and security data made available to Purchasing Entities may be subject to change (Submitted: Jan 28, 2016 6:14:34 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 342
Unduly Restrictive:

The following questions (parts) are based on the following:

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 368
#2..
- 412 -
This information should be included in Microsoft's redline version of the Terms and Conditions. The State cannot modify the Master Agreement Terms and Conditions for every Offeror as proposed. (Answered: Jan 29, 2016 1:48:32

PM MST)
Question 342
Unduly Restrictive:

The following questions (parts) are based on the following:

Exhibit 2 to Attachment A, Section 8 Background Checks:
a. Upon the request of the Purchasing Entity, the Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Master Agreement who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or misdemeanor offense for which incarceration for up to 1 year is an authorized penalty. The Contractor shall promote and maintain an awareness of the importance of securing the Purchasing Entityâ€™s information among the Contractorâ€™s employees and agents.
b. The Contractor and the Purchasing Entity recognize that security responsibilities are shared. The Contractor is responsible for providing a secure infrastructure. The Purchasing Entity is responsible for its secure guest operating system, firewalls and other logs captured within the guest operating system. Specific shared responsibilities are identified within the SLA.
c. If any of the stated personnel providing services under a Participating Addendum is not acceptable to the Purchasing Entity in its sole opinion as a result of the background or criminal history investigation, the Purchasing Entity, in itsâ€™ sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate the Participating Addendum and any related service agreement. (Submitted: Jan 28, 2016 6:15:45 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 343
Part 1:

Microsoft has observed that this clause differs from Section 8 in Exhibit 1 to Attachment A to the extent that paragraph b. was added. Microsoft agrees that the security for both PaaS and IaaS are shared responsibilities.

However, specifically as it applies to background checks of Microsoft personnel operating Microsoftâ€™s PaaS and IaaS Services, there is no difference from the checks performed on our SaaS personnel.

PM MST)
Question 344
Part 2:

PM MST)
Question 345
Unduly Restrictive:

The following questions (parts) are based on the following:

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 369
#2..
- 413 -
This information should be included in Microsoft's redline version of the Terms and Conditions. The State cannot modify the Master Agreement Terms and Conditions for every Offeror as proposed. (Answered: Jan 29, 2016 1:48:32

PM MST)
Question 345
Unduly Restrictive:

The following questions (parts) are based on the following:

Exhibit 2 to Attachment A, Section 9 Access to Security Logs and Reports:
a. The Contractor shall provide reports on a schedule specified in the SLA to the Purchasing Entity in a format as specified in the SLA and agreed to by both the Contractor and the Purchasing Entity. Reports will include latency statistics, user access, user access IP address, user access history and security logs for all Purchasing Entity files related to the Master Agreement, Participating Addendum, or SLA. b. The Contractor and the Purchasing Entity recognize that security responsibilities are shared. The Contractor is responsible for providing a secure infrastructure. The Purchasing Entity is responsible for its secure guest operating system, firewalls and other logs captured within the guest operating system. Specific shared responsibilities are identified within the SLA. (Submitted: Jan 28, 2016 6:18:03 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 346
Part 1)
Microsoft has observed that this clause differs from Section 9 in Exhibit 1 to Attachment A to the extent that paragraph b. was added. Microsoft agrees that the security for both PaaS and IaaS are shared responsibilities.

However, specifically as it applies to access to Microsoftâ€™s security logs and reports for Microsoftâ€™s PaaS and IaaS Services, there is no difference from the logs and reports for our SaaS products.

PM MST)
Question 347
Part 2:

Microsoft shall allow Purchasing Entities reasonable self-service access to security information, latency data, and other related SaaS security data that affect this Contract and the Purchasing Entityâ€™s Data, at no cost to the Purchasing Entity. The parties recognize that the type of self-service access and security data made available to Purchasing Entities may be subject to change.â€ (Submitted: Jan 28, 2016 6:19:04 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 348
Unduly Restrictive:

The following question is based on the following:

Exhibit 2 to Attachment A, Section 21 Encryption of Data at Rest: The Contractor shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data as identified in the SLA, unless the Contractor presents a justifiable position that is approved by the Purchasing Entity that Personal Data, is required to be stored on a Contractor State of Utah Bid CH16012
3/22/2016 4:23 PM p. 370
#2..
- 414 -
Question 348
Unduly Restrictive:

The following question is based on the following:

Exhibit 2 to Attachment A, Section 21 Encryption of Data at Rest: The Contractor shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data as identified in the SLA, unless the Contractor presents a justifiable position that is approved by the Purchasing Entity that Personal Data, is required to be stored on a Contractor portable device in order to accomplish work as defined in the scope of work. (Submitted: Jan 28, 2016 6:20:44 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 349
Microsoft respectfully takes exception to this clause, as written, and requests to substitute the alternative language below:
â€œTo whatever extent a form or use of encryption is required of Microsoft pursuant to any of the industry and Federal government standards committed by Microsoft in this Master Agreement and the Microsoft Online Services Terms, Microsoft will comply with such requirements.â€ Explanation:

Additionally, as service provider, Microsoft will not be able to consult with a Purchasing Entity or to control whether or not personal data is stored on any of its Online Services. Purchasing Entity is solely responsible for selecting what type of data it uses the Online Services for. (Submitted: Jan 28, 2016 6:21:29 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 350
Unduly Restrictive:

The following question is based on the following:

Exhibit 3 to Attachment A, Section 9 Access to Security Logs and Reports:
a. The Contractor shall provide reports on a schedule specified in the SLA to the Contractor directly related to the infrastructure that the Contractor controls upon which the Purchasing Entityâ€™s account resides. Unless otherwise agreed to in the SLA, the Contractor shall provide the public jurisdiction a history or all API calls for the Purchasing Entity account that includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters and the response elements returned by the Contractor. The report will be sufficient to enable the Purchasing Entity to perform security analysis, resource change tracking and compliance auditing
b. The Contractor and the Purchasing Entity recognize that security responsibilities are shared. The Contractor is responsible for providing a secure infrastructure. The Purchasing Entity is responsible for its secure guest operating system, firewalls and other logs captured within the guest operating system. Specific shared responsibilities are identified within the SLA. (Submitted: Jan 28, 2016 6:23:34 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 351
Part 1 of question:

Microsoft has observed that this clause differs from Section 9 in Exhibit 2 to Attachment A to the extent that it includes technical requirements pertaining to API calls. However, specifically as it applies to access to Microsoftâ€™s security logs and reports for Microsoftâ€™s PaaS and IaaS Services, there is no difference from the logs and reports for our SaaS products. Additionally, Microsoft cannot make contractual statements pertaining to this level of functionality (e.g. API calls) with respect to its IaaS product line, overall, but upon request may provide technical information requested by Lead State or any Participating State or Purchasing Entity, although it State of Utah Bid CH16012
3/22/2016 4:23 PM p. 371
#2..
- 415 -
Question 351
Part 1 of question:

Microsoft has observed that this clause differs from Section 9 in Exhibit 2 to Attachment A to the extent that it includes technical requirements pertaining to API calls. However, specifically as it applies to access to Microsoftâ€™s security logs and reports for Microsoftâ€™s PaaS and IaaS Services, there is no difference from the logs and reports for our SaaS products. Additionally, Microsoft cannot make contractual statements pertaining to this level of functionality (e.g. API calls) with respect to its IaaS product line, overall, but upon request may provide technical information requested by Lead State or any Participating State or Purchasing Entity, although it should be noted that functionality evolves over time.

Microsoft provides standardized multitenant Online Services that reasonably cannot be customized for any one of its many thousands of customers. Additionally, Microsoftâ€™s SLA does not pertain to security logs and reports. (Submitted: Jan 28, 2016 6:24:35 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 352
Part 2 of question:

Microsoft shall allow Purchasing Entities reasonable self-service access to security information, latency data, and other related SaaS security data that affect this Contract and the Purchasing Entityâ€™s Data, at no cost to the Purchasing Entity. The parties recognize that the type of self-service access and security data made available to Purchasing Entities may be subject to change.â€ (Submitted: Jan 28, 2016 6:25:16 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 353
Unduly Restrictive:

The next question is based on the following:

Exhibit 3 to Attachment A, Section 11 11. Data Center Audit: The Contractor shall perform an independent audit of its data centers at least annually and at its own expense, and provide an unredacted version of the audit report upon request. The Contractor may remove its proprietary information from the unredacted version. For example, a Service Organization Control (SOC) 2 audit report would be sufficient. (Submitted: Jan 28, 2016 6:27:08 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 354
Question:

Microsoft respectfully requests to substitute its own language, in lieu of the RFP language as written, to the extent that it more accurately describes Microsoftâ€™s standard processes and procedures. That language is also found in the Microsoft Online Services Terms (although with references to â€œCustomerâ€ rather than â€œPurchasing Entityâ€ ), and is thereby incorporated by reference, and is as follows:
â€œMicrosoft Audits of Online Services
For each Online Service, Microsoft will conduct audits of the security of the computers, computing environment and physical data centers that it uses in processing Customer Data (including personal data), as follows:
â€¢ â€œWhere a standard or framework provides for audits, an audit of such control standard or framework will be initiated at least annually for each Online Service. â€¢ â€œEach audit will be performed according to the standards and rules of the regulatory or accreditation body for each applicable control standard or framework.
â€¢ â€œEach audit will be performed by qualified, independent, third party security auditors at Microsoftâ€™s State of Utah Bid CH16012
3/22/2016 4:23 PM p. 372
#2..
- 416 -
â€œMicrosoft Audits of Online Services
For each Online Service, Microsoft will conduct audits of the security of the computers, computing environment and physical data centers that it uses in processing Customer Data (including personal data), as follows:
â€¢ â€œWhere a standard or framework provides for audits, an audit of such control standard or framework will be initiated at least annually for each Online Service. â€¢ â€œEach audit will be performed according to the standards and rules of the regulatory or accreditation body for each applicable control standard or framework.
â€¢ â€œEach audit will be performed by qualified, independent, third party security auditors at Microsoftâ€™s selection and expense.
â€œEach audit will result in the generation of an audit report (â€œMicrosoft Audit Reportâ€ ), which will be Microsoftâ€™s Confidential Information. The Microsoft Audit Report will clearly disclose any material findings by the auditor. Microsoft will promptly remediate issues raised in any Microsoft Audit Report to the satisfaction of the auditor.

If a Purchasing Entity requests, Microsoft will provide the Purchasing Entity with each Microsoft Audit Report so that Purchasing Entity can verify Microsoftâ€™s compliance with the security obligations under the Data Processing Terms (DPT) section of the Microsoft Online Services Terms. The Microsoft Audit Report will be subject to nondisclosure and distribution limitations of Microsoft and the auditor.â€ (Submitted: Jan 28, 2016 6:27:42 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 355
Unduly Restrictive:

Attachments C and D <See the attachments> Please see the Exception and Clarifying Statement for RFP Sections 5.5.9 and 5,6,1, in our previous questions.. (Submitted: Jan 28, 2016 6:28:54 PM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 356
Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions; 13. Indemnification (a); p 52 The Contractor shall defend, indemnify and hold harmless NASPO, NASPO ValuePoint, the Lead State, Participating Entities, and Purchasing Entities, along with their officers, agents, and employees as well as any person or entity for which they may be liable, from and against claims, damages or causes of action including reasonable
attorneysâ€™ fees and related costs for any death, injury, or damage to property arising directly from act(s), error (s), or omission(s) of the Contractor, its employees or subcontractors or volunteers, at any tier, relating to the performance under the Master Agreement.

Offeror requests to remove â€œindirectlyâ€ . Offeror will indemnify for damages/claims that are directly caused by us and our subs, employees, etc but not those that are far removed that we should not be responsible for. (Submitted: Jan 29, 2016 4:29:15 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 357
ValuePoint Master Agreement Terms and Conditions; 16. Insurance (b)(2) CLOUD MINIMUM INSURANCE; p 53 â€œ(2) Contractor shall ensure the cloud providers carry the below CLOUD MINIMUM INSURANCE COVERAGE:
â€¦â€
Offeror is a reseller of the cloud products, not the provider. As such, we donâ€™t control the data centers and donâ€™t carry this insurance. IS it acceptable that we will ensure the providers we contract with carry this insurance and request to have the language reflect that? (Submitted: Jan 29, 2016 4:31:30 AM MST) Answer
- The awarded contractor should have this insurance. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 358
We offer a managed service offering designed to solve the problem of managing a collection of physical and virtual servers and systemsâ€”some in-house, others run by third-party vendors and cloud service providers. This managed service is based on a platform that enables governance over an assemblage of varied internal and external IT service providers, and establishes service efficiencies by providing a single view of an organizationâ€™s IT spending, service performance, operational configurations, and security posture regardless of where their workload is hosted. While this type of service can be critical to the success of any organization moving workload to the cloud, it does not fit neatly in any of the NIST service models. Would the State consider the inclusion of such a service in our proposal response and, if so, how should it be represented? (Submitted: Jan 29, State of Utah Bid CH16012
3/22/2016 4:23 PM p. 373
#2..
- 417 -
We offer a managed service offering designed to solve the problem of managing a collection of physical and virtual servers and systemsâ€”some in-house, others run by third-party vendors and cloud service providers. This managed service is based on a platform that enables governance over an assemblage of varied internal and external IT service providers, and establishes service efficiencies by providing a single view of an organizationâ€™s IT spending, service performance, operational configurations, and security posture regardless of where their workload is hosted. While this type of service can be critical to the success of any organization moving workload to the cloud, it does not fit neatly in any of the NIST service models. Would the State consider the inclusion of such a service in our proposal response and, if so, how should it be represented? (Submitted: Jan 29, 2016 5:00:13 AM MST)
Answer
- An Offeror must present the solution as part of its response and the evaluation committee will decide whether it complies with the requirements and receives the minimum point threshold required by this RFP. (Answered: Jan 29, 2016 1:48:32 PM MST)
Question 359
The following questions (titled by PT) is based on the following within the RFP:

Attachment A, Section 22 Data Access Controls: Contractor will provide access to Purchasing Entityâ€™s Data only to those Contractor employees, contractors and subcontractors (â€œContractor Staffâ€ ) who need to access the Data to fulfill Contractorâ€™s obligations under this Agreement. Contractor shall not access a Purchasing Entityâ€™s user accounts or Data, except on the course of data center operations, response to service or technical issues, as required by the express terms of this Master Agreement, or at a Purchasing Entityâ€™s written request.

Contractor may not share a Purchasing Entityâ€™s Data with its parent corporation, other affiliates, or any other third party without the Purchasing Entityâ€™s express written consent.

Contractor will ensure that, prior to being granted access to the Data, Contractor Staff who perform work under this Agreement have successfully completed annual instruction of a nature sufficient to enable them to effectively comply with all Data protection provisions of this Agreement; and possess all qualifications appropriate to the nature of the employeesâ€™ duties and the sensitivity of the Data they will be handling. (Submitted: Jan 29, 2016 5:37:55 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 360
PT Part 1:

Microsoft, as subcontractor to Offeror, will be the provider of the cloud services sold under the Master Agreement.

As such, Microsoft personnel (including in some cases Microsoftâ€™s subcontractors) may from time to time access Customer Data, as necessary for the operation and maintenance of the service, and for purposes of providing support. The Microsoft Online Services Terms (OST) which are incorporated by reference, including robust protective terms which assure Purchasing Entities that their Customer Data will be protected, and that access will be restricted to only those personnel with need for such access, and only for the amount of time necessary. There are many more protective terms pertaining to data access in the OST (found at www.microsoft.com/contracts, and the latest copy of which will be included with the Proposal). We encourage NASPO to review these terms, including but not limited to the section titled â€œSecurityâ€ beginning on page 11 thereof. (Submitted: Jan 29, 2016 5:39:25 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 361
PT part 2:

Additionally, as set forth in the OST (see the section titled â€œDisclosure of Customer Dataâ€ on page 7), Microsoft may disclose Customer Data to law enforcement, but only when and if required by law. If law enforcement contacts Microsoft with a demand for Customer Data, Microsoft will attempt to redirect the law enforcement agency to request that data directly from Customer. If compelled to disclose Customer Data to law enforcement, Microsoft will promptly notify Customer and provide a copy of the demand unless legally prohibited from doing so.

Upon receipt of any other third party request for Customer Data, Microsoft will promptly notify Customer unless prohibited by law. Microsoft will reject the request unless required by law to comply. If the request is valid, Microsoft will attempt to redirect the third party to request the data directly from Customer.

Microsoft will not provide any third party: (a) direct, indirect, blanket or unfettered access to Customer Data; (b) platform encryption keys used to secure Customer Data or the ability to break such encryption; or (c) access to Customer Data if Microsoft is aware that the data is to be used for purposes other than those stated in the third partyâ€™s request. (Submitted: Jan 29, 2016 5:40:19 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 374
#2..
- 418 -
prohibited by law. Microsoft will reject the request unless required by law to comply. If the request is valid, Microsoft will attempt to redirect the third party to request the data directly from Customer.

PM MST)
Question 362
PT part 3:

In support of the above, Microsoft may provide Customerâ€™s basic contact information to the third party.

Additionally, Microsoft informs its personnel about relevant security procedures and their respective roles.

Microsoft also informs its personnel of possible consequences of breaching the security rules and procedures.

Microsoft will only use anonymous data in training. See â€œHuman Resources Securityâ€ on page 11 of the current OST. And for those Microsoft Government Community Cloud Services for which Microsoftâ€™s CJIS assurances apply (see our Exception and Clarifying Statements to Appendix A Section 17, above in this document), personnel with access to unencrypted CJI (and other Customer Data Content) are provided training in accordance with FBI CJIS Policy. However, such training may not necessarily be annual, so to that extent neither Microsoft nor Contractor are able to accept this clause as written. We ask instead that the terms and conditions of the OST apply in lieu of this Section 22. (Submitted: Jan 29, 2016 5:40:46 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 363
Unduly Restrictive:

This question will be in several parts as it is too large per the max content allowed. Part 1 is the referenced section. The next parts will be the RFP language and the final parts will be our questions. All will be titled PT in case they do not end up in order in this Q and A period. (Submitted: Jan 29, 2016 5:43:22 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 364
PT Part 2:

Section 4) Security Incident or Data Breach Notification:
a. Incident Response: Contractor may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the contract. Discussing security incidents with the Purchasing Entity should be handled on an urgent as-needed basis, as part of Contractorâ€™s communication and mitigation processes as mutually agreed upon, defined by law or contained in the Master Agreement. b. Security Incident Reporting Requirements: The Contractor shall report a security incident to the Purchasing Entity identified contact immediately as soon as possible or promptly without out reasonable delay, or as defined in the SLA.
c. Breach Reporting Requirements: If the Contractor has actual knowledge of a confirmed data breach that affects the security of any purchasing entityâ€™s content that is subject to applicable data breach notification law, the Contractor shall (1) as soon as possible or promptly without out reasonable delay notify the Purchasing Entity, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the data breach in a timely manner. (Submitted: Jan 29, 2016 5:43:57 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 365
PT part 3:
(Section 5) Personal Data Breach Responsibilities: This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the Contractor. a. The Contractor, unless stipulated otherwise, shall immediately notify the appropriate Purchasing Entity identified contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident. b. The Contractor, unless stipulated otherwise, shall promptly notify the appropriate Purchasing Entity identified contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it has confirmed that there is, or reasonably believes that there has been a Data Breach. (Submitted: Jan 29, 2016 5:45:07

AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 366
PT part 4:

The Contractor shall (1) cooperate with the Purchasing Entity as reasonably requested by the Purchasing Entity to investigate and resolve the Data Breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary. c. Unless otherwise stipulated, if a data breach is a direct result of Contractorâ€™s breach of its contractual obligation to encrypt personal data or otherwise prevent its release as reasonably determined by the Purchasing Entity, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a tollfree number and call center for affected individuals required by federal and state laws â€” all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $217 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause. (Submitted: Jan 29, 2016 5:45:35 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 367
PT part 5:

The proposed alternative language below is the same as that proposed above in this document for the related Section 4 and 5 in Exhibits 2 and 3 to Attachment A. Because of differences in the language, we have added a few additional explanatory notes.

Microsoft follows standardized procedures for reporting Security Incidents. Those procedures are described (and contractually committed) in the Microsoft Online Services Terms (OST). Microsoft, as provider of a standardized multitenant cloud service to thousands of customers and millions of users, cannot customize these processes for any individual customer. Microsoft therefore respectfully requests that the language this Section 4 be struck, and replaced with the applicable language from the OST, as well as the language below pertaining to reimbursement of reasonable remediation costs in the event of a Security Incident involving PII.

Following are Microsoftâ€™s contractual commitments pertaining to Security Incident Notification, from the OST (note that â€œCustomerâ€ represents â€œPurchasing Entityâ€ ): (Submitted: Jan 29, 2016 5:46:06 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 368
PT part 6:

Compliance with Laws
Microsoft will comply with all laws and regulations applicable to its provision of the Online Services, including security breach notification law. However, Microsoft is not responsible for compliance with any laws or regulations applicable to Customer or Customerâ€™s industry that are not generally applicable to information technology service providers. Microsoft does not determine whether Customer Data includes information subject to any State of Utah Bid CH16012
3/22/2016 4:23 PM p. 376
#2..
- 420 -
Question 368
PT part 6:

Compliance with Laws
Microsoft will comply with all laws and regulations applicable to its provision of the Online Services, including security breach notification law. However, Microsoft is not responsible for compliance with any laws or regulations applicable to Customer or Customerâ€™s industry that are not generally applicable to information technology service providers. Microsoft does not determine whether Customer Data includes information subject to any specific law or regulation. All Security Incidents are subject to the Security Incident Notification terms below. (Submitted: Jan 29, 2016 5:46:30 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 369
PT part 7
Security Incident Notification
If Microsoft becomes aware of any unlawful access to any Customer Data stored on Microsoftâ€™s equipment or in Microsoftâ€™s facilities, or unauthorized access to such equipment or facilities resulting in loss, disclosure, or alteration of Customer Data (each a â€œSecurity Incidentâ€ ), Microsoft will promptly (1) notify Customer of the Security Incident; (2) investigate the Security Incident and provide Customer with detailed information about the Security Incident; and (3) take reasonable steps to mitigate the effects and to minimize any damage resulting from the Security Incident.

Notification(s) of Security Incidents will be delivered to one or more of Customerâ€™s administrators by any means Microsoft selects, including via email. It is Customerâ€™s sole responsibility to ensure Customerâ€™s administrators maintain accurate contact information on each applicable Online Services portal. Microsoftâ€™s obligation to report or respond to a Security Incident under this section is not an acknowledgement by Microsoft of any fault or liability with respect to the Security Incident.

Customer must notify Microsoft promptly about any possible misuse of its accounts or authentication credentials or any security incident related to an Online Service. (Submitted: Jan 29, 2016 5:46:57 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 370
PT part 8:

As an exception to the foregoing, notification of Security Incident will be delivered within 5 days after Microsoft determines that a Security Incident has occurred, provided that Purchasing Entity must comply with the following requirements:

For each Online Service Tenant or Azure subscription, as applicable, as a condition of receiving notifications within 5 days, as set forth in the preceding paragraph, the State must register the following information by sending email to [email protected], and must keep such information current at all times:
1) Purchasing Entityâ€™s Microsoft Online Direct Routing Domain (MODRD); 2) For one or more individual(s) to be contacted, each of whom must be registered as an administrator on the applicable Online Services, each of the following:
a. Name;
b. Title;
c. Email address registered as an administrator on the Online Services; d. Email address not registered as a user on the Online Services; 3) Name of Purchasing Entity;
4) Enrollment number assigned by Microsoft to represent Purchasing Entityâ€™s Tenant or Azure Subscription, on Offerorâ€™s subcontract with Microsoft. (Submitted: Jan 29, 2016 5:47:31 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 371
PT part 9:

Microsoft expects to change the above process by which the Purchasing Entity for each tenant or subscription will be able to register their MODRD and other information for five-day Security Incident notification pursuant to these terms and conditions. In the event that a Purchasing Entity is notified by Microsoft, in the administrative console or otherwise, of revised instructions necessary to ensure five-day Security Incident notification, the Purchasing Entity must comply with such revised instructions. (Submitted: Jan 29, 2016 5:48:26 AM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 377
#2..
- 421 -
Question 371
PT part 9:

Microsoft expects to change the above process by which the Purchasing Entity for each tenant or subscription will be able to register their MODRD and other information for five-day Security Incident notification pursuant to these terms and conditions. In the event that a Purchasing Entity is notified by Microsoft, in the administrative console or otherwise, of revised instructions necessary to ensure five-day Security Incident notification, the Purchasing Entity must comply with such revised instructions. (Submitted: Jan 29, 2016 5:48:26 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 372
PT part 10:

Additional language pertaining to reimbursements of costs:

To the extent that a Security Incident results from Microsoftâ€™s failure to comply with its obligations under this Master Agreement (and, where applicable, Participating Addenda), and subject to the limitations of liability set forth in Attachment A, Section 43 (Limitation of Liability), Microsoft will reimburse Purchasing Entities for reasonable out-of-pocket remediation costs incurred by such Purchasing Entities in connection with that Security Incident. â€œReasonable out-of-pocket remediation costsâ€ are costs that (a) are customary, reasonable and expected to be paid by entities similar to Purchasing Entity, based on the nature and scope of the Security Incident, and (b) do not arise from or relate to Purchasing Entityâ€™s violation of (i) laws applicable to Purchasing Entity or (ii) Purchasing Entityâ€™s obligations to third parties, and (c) in no event include costs arising related to compliance with laws applicable to Purchasing Entity or its industry or government function that are not generally applicable to information technology services providers. Purchasing Entity must document all such expenditures and, upon Microsoftâ€™s request, those expenditures must be validated by an independent, internationally-recognized third party industry expert chosen by both parties. For avoidance of doubt, the costs reimbursed by Microsoft under this paragraph will be characterized as direct damages subject to the limitation on liability set forth in this Section, and not as special damages excluded under the â€œEXCLUSION OF CERTAIN DAMAGESâ€ in Attachment A, Section 43 (Limitation of Liability). (Submitted: Jan 29, 2016 5:48:50 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 373
Unduly Restrictive:

The following question will be presented relating to section Exhibit 2 to Attachment A, Sections 4 and 5
The RFP language will be first listed and named PT Part 1,2, etc and then the questions will follow in sequential part numbers. (Submitted: Jan 29, 2016 5:58:52 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 374
Part 1:

Section 4) Security Incident or Data Breach Notification: The Contractor shall inform the Purchasing Entity of any security incident or data breach within the possession and control of the Contractor and related to the service provided under the Master Agreement, Participating Addendum, or SLA. Such notice shall include, to the best of Contractorâ€™s knowledge at that time, the persons affected, their identities, and the Confidential Information and Data disclosed, or shall include if this information is unknown. a. Incident Response: The Contractor may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the Master Agreement, Participating Addendum, or SLA.

Discussing security incidents with the Purchasing Entity should be handled on an urgent as-needed basis, as part of Contractorâ€™s communication and mitigation processes as mutually agreed, defined by law or contained in the Master Agreement, Participating Addendum, or SLA. b. Security Incident Reporting Requirements: Unless otherwise stipulated, the Contractor shall immediately report a security incident related to its service under the Master Agreement, Participating Addendum, or SLA to the appropriate Purchasing Entity (Submitted: Jan 29, 2016 5:59:17 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 378
#2..
- 422 -
part of Contractorâ€s communication and mitigation processes as mutually agreed, defined by law or contained in the Master Agreement, Participating Addendum, or SLA. b. Security Incident Reporting Requirements: Unless otherwise stipulated, the Contractor shall immediately report a security incident related to its service under the Master Agreement, Participating Addendum, or SLA to the appropriate Purchasing Entity (Submitted: Jan 29, 2016 5:59:17 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 375
Part 2:
(Section 5) 5. Breach Responsibilities: This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the Contractor. a. The Contractor, unless stipulated otherwise, shall immediately notify the appropriate Purchasing Entity identified contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident. b. The Contractor, unless stipulated otherwise, shall promptly notify the appropriate Purchasing Entity identified contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it has confirmed that there is, or reasonably believes that there has been a data breach. (Submitted: Jan 29, 2016 6:00:16

AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 376
Part 3:

The Contractor shall (1) cooperate with the Purchasing Entity as reasonably requested by the Purchasing Entity to investigate and resolve the data breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the data breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary. c. Unless otherwise stipulated, if a Data Breach is a direct result of Contractorâ€™s breach of its contractual obligation to encrypt Personal Data or otherwise prevent its release, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a toll-free number and call center for affected individuals required by federal and state laws â€” all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $217 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause. (Submitted: Jan 29, 2016 6:00:38 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 377
Part 4:

The proposed alternative language below is the same as that proposed above in this document for the related Section 4 and 5 in Exhibits 1 and 3 to Attachment A. Because of differences in the language, we have added a few additional explanatory notes.

Microsoft does not keep track of the identities of individuals whose PII a Purchasing Entity may choose to store on our Online Services, so it must be the responsibility of the Purchasing Entity to keep track of the names and contact information for all such users, in order that the Purchasing Entity may notify those individuals of the breach after having received notification from Microsoft that a breach occurred. Microsoft does not notify individuals, but will reimburse Purchasing Entities for their notification and credit monitoring costs (subject to its Limitation of Liability), in accordance with the alternative contract language proposed below (Submitted: Jan 29, 2016 6:01:13 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 379
#2..
- 423 -
Microsoft does not keep track of the identities of individuals whose PII a Purchasing Entity may choose to store on our Online Services, so it must be the responsibility of the Purchasing Entity to keep track of the names and contact information for all such users, in order that the Purchasing Entity may notify those individuals of the breach after having received notification from Microsoft that a breach occurred. Microsoft does not notify individuals, but will reimburse Purchasing Entities for their notification and credit monitoring costs (subject to its Limitation of Liability), in accordance with the alternative contract language proposed below (Submitted: Jan 29, 2016 6:01:13 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 378
Part 5:

Additionally, Microsoft is not able to agree to a 24 hour or less notification of a Security Incident. Once Microsoft has verified that Customer Data has been subject to a Security Incident, it will notify promptly thereof. For Microsoft Azure Core Services when delivered from Microsoftâ€™s Government Community Cloud, Microsoft is able to provide a 5-day notice of Security Incident, subject to the terms and conditions below.

Following are Microsoftâ€™s contractual commitments pertaining to Security Incident Notification, from the OST (note that â€œCustomerâ€ represents â€œPurchasing Entityâ€ ):

Compliance with Laws
Microsoft will comply with all laws and regulations applicable to its provision of the Online Services, including security breach notification law. However, Microsoft is not responsible for compliance with any laws or regulations applicable to Customer or Customerâ€™s industry that are not generally applicable to information technology service providers. Microsoft does not determine whether Customer Data includes information subject to any specific law or regulation. All Security Incidents are subject to the Security Incident Notification terms below.

Security Incident Notification
If Microsoft becomes aware of any unlawful access to any Customer Data stored on Microsoftâ€™s equipment or in Microsoftâ€™s facilities, or unauthorized access to such equipment or facilities resulting in loss, disclosure, or alteration of Customer Data (each a â€œSecurity Incidentâ€ ), Microsoft will promptly (1) notify Customer of the Security Incident; (2) investigate the Security Incident and provide Customer with detailed information about the Security Incident; and (3) take reasonable steps to mitigate the effects and to minimize any damage resulting from the Security Incident. (Submitted: Jan 29, 2016 6:01:42 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 379
Part 6:

Customer must notify Microsoft promptly about any possible misuse of its accounts or authentication credentials or any security incident related to an Online Service.

For each Online Service Tenant or Azure subscription, as applicable, as a condition of receiving notifications within 5 days, as set forth in the preceding paragraph, the State must register the following information by sending email to [email protected], and must keep such information current at all times:
1) Purchasing Entityâ€™s Microsoft Online Direct Routing Domain (MODRD); 2) For one or more individual(s) to be contacted, each of whom must be registered as an administrator on the applicable Online Services, each of the following:
a. Name;
b. Title;
c. Email address registered as an administrator on the Online Services; d. Email address not registered as a user on the Online Services; 3) Name of Purchasing Entity;
4) Enrollment number assigned by Microsoft to represent Purchasing Entityâ€™s Tenant or Azure Subscription, on Offerorâ€™s subcontract with Microsoft. (Submitted: Jan 29, 2016 6:02:14 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 380
#2..
- 424 -
4) Enrollment number assigned by Microsoft to represent Purchasing Entityâ€s Tenant or Azure Subscription, on Offerorâ€™s subcontract with Microsoft. (Submitted: Jan 29, 2016 6:02:14 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 380
Part 7:

Microsoft expects to change the above process by which the Purchasing Entity for each tenant or subscription will be able to register their MODRD and other information for five-day Security Incident notification pursuant to these terms and conditions. In the event that a Purchasing Entity is notified by Microsoft, in the administrative console or otherwise, of revised instructions necessary to ensure five-day Security Incident notification, the Purchasing Entity must comply with such revised instructions. (Submitted: Jan 29, 2016 6:03:08 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 381
part 8:

Additional language pertaining to reimbursements of costs:

To the extent that a Security Incident results from Microsoftâ€™s failure to comply with its obligations under this Master Agreement (and, where applicable, Participating Addenda), and subject to the limitations of liability set forth in Attachment A, Section 43 (Limitation of Liability), Microsoft will reimburse Purchasing Entities for reasonable out-of-pocket remediation costs incurred by such Purchasing Entities in connection with that Security Incident. â€œReasonable out-of-pocket remediation costsâ€ are costs that (a) are customary, reasonable and expected to be paid by entities similar to Purchasing Entity, based on the nature and scope of the Security Incident, and (b) do not arise from or relate to Purchasing Entityâ€™s violation of (i) laws applicable to Purchasing Entity or (ii) Purchasing Entityâ€™s obligations to third parties, and (c) in no event include costs arising related to compliance with laws applicable to Purchasing Entity or its industry or government function that are not generally applicable to information technology services providers. Purchasing Entity must document all such expenditures and, upon Microsoftâ€™s request, those expenditures must be validated by an independent, internationally-recognized third party industry expert chosen by both parties. For avoidance of doubt, the costs reimbursed by Microsoft under this paragraph will be characterized as direct damages subject to the limitation on liability set forth in this Section, and not as special damages excluded under the â€œEXCLUSION OF CERTAIN DAMAGESâ€ in Attachment A, Section 43 (Limitation of Liability). (Submitted: Jan 29, 2016 6:03:37 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 382
Unduly Restrictive:

This question will be structured in parts first noting language in the RFP followed by the question based on the following section of the RFP:

Exhibit 3 to Attachment A, Sections 4 and 5 (Submitted: Jan 29, 2016 6:06:11 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 383
Part 1
Notification: The Contractor shall inform the Purchasing Entity of any security incident or data breach related to Purchasing Entityâ€™s Data within the possession or control of the Contractor and related to the service provided under the Master Agreement, Participating Addendum, or SLA. Such notice shall include, to the best of Contractorâ€™s knowledge at that time, the persons affected, their identities, and the Confidential Information and Data disclosed, or shall include if this information is unknown. a. Security Incident Reporting Requirements: The Contractor shall report a security incident to the Purchasing Entity identified contact immediately as soon as possible or promptly without out reasonable delay, or as defined in the SLA.
b. Breach Reporting Requirements: If the Contractor has actual knowledge of a confirmed data breach that affects the security of any purchasing entityâ€™s content that is subject to applicable data breach notification law, the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 381
#2..
- 425 -
under the Master Agreement, Participating Addendum, or SLA. Such notice shall include, to the best of Contractorâ€™s knowledge at that time, the persons affected, their identities, and the Confidential Information and Data disclosed, or shall include if this information is unknown. a. Security Incident Reporting Requirements: The Contractor shall report a security incident to the Purchasing Entity identified contact immediately as soon as possible or promptly without out reasonable delay, or as defined in the SLA.
b. Breach Reporting Requirements: If the Contractor has actual knowledge of a confirmed data breach that affects the security of any purchasing entityâ€™s content that is subject to applicable data breach notification law, the Contractor shall (1) as soon as possible or promptly without out reasonable delay notify the Purchasing Entity, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the data breach in a timely manner. (Submitted: Jan 29, 2016 6:06:43 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 384
Part 2:
(Section 5) 5. Breach Responsibilities: This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the Contractor and related to the service provided under the Master Agreement, Participating Addendum, or SLA.
a. The Contractor, unless stipulated otherwise, shall immediately notify the appropriate Purchasing Entity identified contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident. b. The Contractor, unless stipulated otherwise, shall promptly notify the appropriate Purchasing Entity identified contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it has confirmed that there is, or reasonably believes that there has been a data breach. The Contractor shall (1) cooperate with the Purchasing Entity as reasonably requested by the Purchasing Entity to investigate and resolve the Data Breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary. (Submitted: Jan 29, 2016 6:07:12 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 385
Part 3:
c. Unless otherwise stipulated, if a Data Breach is a direct result of Contractorâ€™s breach of its contractual obligation to encrypt Personal Data or otherwise prevent its release, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a toll-free number and call center for affected individuals required by federal and state laws â€” all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $217 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause (Submitted: Jan 29, 2016 6:08:57 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 386
Part 4
The proposed alternative language below is the same as that proposed above in this document for the related Section 4 and 5 in Exhibits 1 and 2 to Attachment A. Because of differences in the language, we have added a few additional explanatory notes.

Microsoft does not keep track of the identities of individuals whose PII a Purchasing Entity may choose to store on State of Utah Bid CH16012
3/22/2016 4:23 PM p. 382
#2..
- 426 -
additional explanatory notes.

PM MST)
Question 387
part 5:

Following are Microsoftâ€™s contractual commitments pertaining to Security Incident Notification, from the OST (note that â€œCustomerâ€ represents â€œPurchasing Entityâ€ ): (Submitted: Jan 29, 2016 6:09:55 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 388
part 6:

Compliance with Laws
Microsoft will comply with all laws and regulations applicable to its provision of the Online Services, including security breach notification law. However, Microsoft is not responsible for compliance with any laws or regulations applicable to Customer or Customerâ€™s industry that are not generally applicable to information technology service providers. Microsoft does not determine whether Customer Data includes information subject to any specific law or regulation. All Security Incidents are subject to the Security Incident Notification terms below.

Security Incident Notification
If Microsoft becomes aware of any unlawful access to any Customer Data stored on Microsoftâ€™s equipment or in Microsoftâ€™s facilities, or unauthorized access to such equipment or facilities resulting in loss, disclosure, or alteration of Customer Data (each a â€œSecurity Incidentâ€ ), Microsoft will promptly (1) notify Customer of the Security Incident; (2) investigate the Security Incident and provide Customer with detailed information about the Security Incident; and (3) take reasonable steps to mitigate the effects and to minimize any damage resulting from the Security Incident. (Submitted: Jan 29, 2016 6:10:20 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 389
part 7:

Customer must notify Microsoft promptly about any possible misuse of its accounts or authentication credentials or any security incident related to an Online Service.

PM MST)
Question 390
Part 8:
1) Purchasing Entityâ€™s Microsoft Online Direct Routing Domain (MODRD); 2) For one or more individual(s) to be contacted, each of whom must be registered as an administrator on the applicable Online Services, each of the following:
a. Name;
b. Title;
c. Email address registered as an administrator on the Online Services; d. Email address not registered as a user on the Online Services; 3) Name of Purchasing Entity;
4) Enrollment number assigned by Microsoft to represent Purchasing Entityâ€™s Tenant or Azure Subscription, on Offerorâ€™s subcontract with Microsoft.

Microsoft expects to change the above process by which the Purchasing Entity for each tenant or subscription will be able to register their MODRD and other information for five-day Security Incident notification pursuant to these terms and conditions. In the event that a Purchasing Entity is notified by Microsoft, in the administrative console or otherwise, of revised instructions necessary to ensure five-day Security Incident notification, the Purchasing Entity must comply with such revised instructions. (Submitted: Jan 29, 2016 6:11:39 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 391
Part 9:

Additional language pertaining to reimbursements of costs:

To the extent that a Security Incident results from Microsoftâ€™s failure to comply with its obligations under this Master Agreement (and, where applicable, Participating Addenda), and subject to the limitations of liability set forth in Attachment A, Section 43 (Limitation of Liability), Microsoft will reimburse Purchasing Entities for reasonable out-of-pocket remediation costs incurred by such Purchasing Entities in connection with that Security Incident. â€œReasonable out-of-pocket remediation costsâ€ are costs that (a) are customary, reasonable and expected to be paid by entities similar to Purchasing Entity, based on the nature and scope of the Security Incident, and (b) do not arise from or relate to Purchasing Entityâ€™s violation of (i) laws applicable to Purchasing Entity or (ii) Purchasing Entityâ€™s obligations to third parties, and (c) in no event include costs arising related to compliance with laws applicable to Purchasing Entity or its industry or government function that are not generally applicable to information technology services providers. Purchasing Entity must document all such expenditures and, upon Microsoftâ€™s request, those expenditures must be validated by an independent, internationally-recognized third party industry expert chosen by both parties. For avoidance of doubt, the costs reimbursed by Microsoft under this paragraph will be characterized as direct damages subject to the limitation on liability set forth in this Section, and not as special damages excluded under the â€œEXCLUSION OF CERTAIN DAMAGESâ€ in Attachment A, Section 43 (Limitation of Liability). (Submitted: Jan 29, 2016 6:12:16 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 392
We are a privately held company and do not publicly release our annual financial statements. Because D&B has not reviewed them, it has not measured us consistently with publicly held companies. D&B has assigned us the score of 1R3, which seems to be based simply on the number of employees (10+). However, our financial condition is quite sound. What documentation or information can we provide to establish that our financial condition is at least equivalent to companies receiving a 4A2 score? (Submitted: Jan 29, 2016 6:32:22 AM MST) Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 384
#2..
- 428 -
Question 392
We are a privately held company and do not publicly release our annual financial statements. Because D&B has not reviewed them, it has not measured us consistently with publicly held companies. D&B has assigned us the score of 1R3, which seems to be based simply on the number of employees (10+). However, our financial condition is quite sound. What documentation or information can we provide to establish that our financial condition is at least equivalent to companies receiving a 4A2 score? (Submitted: Jan 29, 2016 6:32:22 AM MST) Answer
- Offerors must, if they do not have a D&B rating, provide adequate information to demonstrate that it is capable of receiving that rating. (Answered: Jan 29, 2016 1:52:44 PM MST) Question 393
Section 8.22 (E) SUPPORTING INFRASTRUCTURE

8.22.1 Describe what infrastructure is required by the Purchasing Entity to support your Services or deployment models.

8.22.2 If required, who will be responsible for installation of new infrastructure and who will incur those costs? Can we assume that any Purchasing Entity would have infrastructure supporting sufficient and secure access to the internet and the Oracle Public Cloud? Can we also assume that any such costs associated with these requirements would be the responsibility of the Purchasing Entity? (Submitted: Jan 29, 2016 7:24:58 AM MST) Answer
- Yes and Yes. (Answered: Jan 29, 2016 1:52:44 PM MST)
Question 394

5.2.3 and 5.2.9, pp 20-21 Govt statements: 1) "A statement indicating the Offerorâ€™s understanding that they may be required to negotiate additional terms and conditions, including additional administrative fees, with Participating Entities when executing a Participating Addendum." 2) "A statement acknowledging that a 0.25% NASPO ValuePoint Administrative Fee will apply to total sales for the Master Agreement(s) awarded from the RFP."
Question: We understand 5.2.3 and 5.2.9 individually, but please provide some sense of how much the administrative fee for Participating Entities may be; this may include offering a range of lowest to highest fees across (Submitted: Jan 29, 2016 7:43:28 AM MST)
Answer
- For the State of Utah the usual administrative fee is 1%. However, Utah cannot comment on what other states may charge as an administrative fee. (Answered: Feb 1, 2016 4:29:33 PM MST) Question 395

5.5.8, 5.5.10, 6.7.1, 9.1; pp 22, 26, and 34. Govt statements:

1. Complete Level 1 CSA STAR Registry Self-Assessment

2. State that auditing capabilities/reports are consistent w/SAS 70 and SSAE 16 6/2011

3. Specify 3rd-party attestations, reports, and certs relating to data security and integrity your company has received; describe how you use latest technologies

4. Pricing catalogs should include the price structures of the cloud solutions models and deployment models that it intends to provide including the types of data it is able to hold under each model. Pricing must be all-inclusive of infrastructure and software costs and management of infrastructure, network, OS, and software.

Question: Please clarify whether these requirements apply to the bidding vendor or to their CSPs. (Submitted: Jan 29, 2016 7:45:14 AM MST)
Answer
- IF the bidding vendor is relying on the CSP for questions 1-3 then it needs to describe that it in its proposal.

For question number 4 the bidding vendor must provide the cost structure that it will charge for the solutions it offers. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 396
RFP 7; p 27; Govt Statement: "The State has identified a number of roles that are necessary based on the requirements of Attachment D; these titles are not meant to be restrictive, but are used to identify key roles." Question: RFP refers to roles (plural), but in 7.1 identifies only one role. Please confirm that the only key-personnel role is the contract manager. If this is not the case, please indicate what other roles the State of Utah considers key. (Submitted: Jan 29, 2016 7:46:22 AM MST)
Answer
- Section 7 has been modified to include only the contract manager role. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 397
RFP 8.1.1, p. 28; Govt statement: â€œif you choose to submit separate offerings for a SaaS service and a PaaS service, submit one response for each service through Offer. Keep responses brief and to the point of how the service meets the requirement, within the indicated page limit.â€ Questions:
a. Please clarify what the Government means when it instructs the Offeror to submit service â€œthrough Offerâ€ b. States â€œwithin the indicated page limitâ€ ; we do not find page limit statements; did we miss something? (Submitted: Jan 29, 2016 7:47:35 AM MST)
Answer
- The language â€œthrough Offerâ€ and â€œwithin the indicated page limitâ€ has been deleted from 8.1.1. (Answered: Jan 29, 2016 4:28:56 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 385
#2..
- 429 -
a. Please clarify what the Government means when it instructs the Offeror to submit service â€œthrough Offerâ€ b. States â€œwithin the indicated page limitâ€ ; we do not find page limit statements; did we miss something? (Submitted: Jan 29, 2016 7:47:35 AM MST)
Answer
- The language â€œthrough Offerâ€ and â€œwithin the indicated page limitâ€ has been deleted from 8.1.1. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 398
RFP 8.1.3, p. 28; Govt Statement: â€œOfferor must identify for each service category(ies) the areas that each service category.â€
Question: It appears that a verb is missing at the end of the sentence; please indicate what the Offeror must identify about each service category. (Submitted: Jan 29, 2016 7:48:34 AM MST) Answer
- 8.1.3 has been modified to state: Offeror must identify for each service model the subcategories that it offers for each service model. For example if an Offeror provides a SaaS offering then it should be divided into education SaaS offerings, e-procurement SaaS offerings, information SaaS offering, etc. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 399
RFP 8.4.2; p. 29; Govt statement: "You must have one lead representative for each entity that executes a Participating Addendum. Contact information shall be kept current." Question: Please confirm that this statement means that each participating state has a single POC and not that each state has a dedicated FTE. In other words, a given Offeror representative could be the single POC for more than one state. (Submitted: Jan 29, 2016 7:49:38 AM MST) Answer
- Correct. A given Offeror representative could be the single POC for more than one state. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 400
RFP 8.8.1.c ; p. 30; Govt statement: "Specify how you would respond to the following situations; include any contingency plan or policy: c.Experiences a business failure." Question: Please clarify what the Government means by a business failure: the CSP failing, a hardware OEM failing, the Offeror failing? (Submitted: Jan 29, 2016 7:50:41 AM MST) Answer
- The section has been modified to state: Offeror experiences a system failure. (Answered: Feb 1, 2016 4:29:33 PM MST)
Question 401
General: May individual states require bonding and if so at what levels? (Submitted: Jan 29, 2016 7:51:22 AM MST) Answer
- Individual states may require bonds depending on the project, but this is a purchasing entity decision. (Answered:

Jan 29, 2016 4:28:56 PM MST)
Question 402
General: May state participants hold back portions of the invoice payment? (Submitted: Jan 29, 2016 7:51:53 AM MST)
Answer
- Only as described in the terms and conditions or SLA. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 403
General: For contracts in place on the current WSCA Cloud contract, will those continue through to their stated Period-of-Performance end date, or will all existing WSCA Cloud contracts need to be re-competed immediately after award of the new contract? (Submitted: Jan 29, 2016 7:52:48 AM MST) Answer
- Those will continue through to their stated Period-of-Performance end date (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 404
RFP Section 5.2.5 prohibits employment of â€œany company or person other than a bona fide employee working solely for the Offeror or a company regularly employed as its marketing agent, to respond to the RFP.â€ What about cases where authorized resellers or value added resellers of a service provider wish to submit proposals as prime contractors, for the purpose of providing cloud services for which the cloud service provider sells via an â€œindirect through resellerâ€ sales model â€“ is this allowed? (Submitted: Jan 29, 2016 8:14:59 AM MST)
Answer
- This has been answered above. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 405
RFP Section 5.5.12 refers to SLA requirements in RFP Section 8.13. But Section 8.13 appears to apply to the STAR Registry Self-Assessment, not SLA. Is this a typo, and if so then what section was intended? If not, please explain the relationship to SLA. (Submitted: Jan 29, 2016 8:16:01 AM MST) Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 386
#2..
- 430 -
Answer
- This has been answered above. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 405
RFP Section 5.5.12 refers to SLA requirements in RFP Section 8.13. But Section 8.13 appears to apply to the STAR Registry Self-Assessment, not SLA. Is this a typo, and if so then what section was intended? If not, please explain the relationship to SLA. (Submitted: Jan 29, 2016 8:16:01 AM MST) Answer
- The reference to 8.13 should by 8.12. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 406
RFP Section 9.1 requires that Offerors bid a minimum discount off of their published government price catalog.

Will alternative models be considered in cases where no such published price list exists? For example, in the case of an Offeror which is a systems integrator or reseller of cloud services provided by another company that does not publicly publish such a price catalog. (Submitted: Jan 29, 2016 8:16:33 AM MST) Answer
- The State needs to know what price the minimum discount price is being applied to. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 407
Attachment A contains the defined terms â€œDisabling Code,â€ â€œFulfilment Partner,â€ and that do not appear to be used anywhere in that Attachment or the other RFP documents. Please advise if, and how, NASPO intends to use these terms in the Master Agreement. (Submitted: Jan 29, 2016 8:17:13 AM MST) Answer
- This question has been answered above. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 408
Section 9 of Attachment A (â€œRight to Publishâ€ ) appears to prohibit any sort of mention of the Agreement without advance permission. Will a Contractor need to seek permission in each case where it wants to alert a prospective Purchasing Entity in a Participating State of the existence of the Master Agreement, in order that the Contractor may encourage the prospective Purchasing Entity to utilize the Master Agreement for its needs? (Submitted: Jan 29, 2016 8:17:50 AM MST)
Answer
- No. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 409
RFP Section 7.2 requires incorporation of all Attachments. If an exception is not taken to Attachment E would an offeror be bound by those state specific terms and conditions when they attempt to negotiate a Participating Addendum with that respective State? Must exceptions to Attachment Eâ€™s state specific terms and conditions be taken at this phase? Or will additional time be granted for Offerors to prepare exceptions to the Participating Addenda in Attachment E? (Submitted: Jan 29, 2016 8:18:24 AM MST) Answer
- Offerors do not need to take exceptions to each document in Attachment E. Negotiations with participating entities will take place during the participating addendum stage. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 410
In each of the Exhibits 1 and 2 to Attachment A, please explain what is meant by the section titled â€œWeb Servicesâ€ which says â€œthe Contractor shall use Web services exclusively to interface with the Purchasing Entityâ€™s data in near real time.â€ (Submitted: Jan 29, 2016 8:18:54 AM MST) Answer
- This question has been answered above. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 411
Can we embed documents within the RFP response? (Submitted: Jan 29, 2016 8:46:59 AM MST) Answer
- No. They should be attachments. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 412
Can you please specify if both the IT documents, CAIQ and CSM would need to be filled or one is optional, based on the services we provide (Submitted: Jan 29, 2016 8:47:48 AM MST) Answer
- Both forms should be filled out based on the services provided. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 413
Can you please provide the definition of â€˜an instanceâ€™ from section 5.6.13 in the document - Cloud Solutions - Request for Proposals - CH16012 (Submitted: Jan 29, 2016 8:48:12 AM MST) Answer
- The definition is flexible based on the services offered by an offeror. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 414
Are we to attach functional specifications of the proposed solution (E.g. Our SaaS offering) If so is there a specific section that we could use for this response? (Submitted: Jan 29, 2016 8:48:42 AM MST) Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 387
#2..
- 431 -
Solutions - Request for Proposals - CH16012 (Submitted: Jan 29, 2016 8:48:12 AM MST) Answer
- The definition is flexible based on the services offered by an offeror. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 414
Are we to attach functional specifications of the proposed solution (E.g. Our SaaS offering) If so is there a specific section that we could use for this response? (Submitted: Jan 29, 2016 8:48:42 AM MST) Answer
- That would be beneficial for review and evaluation of proposals. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 415
If any questions are not applicable for SAAS environment mentioned in the security alliance questionnaire, whether those questions and control measures will be allowed as exception for compliance? (Submitted: Jan 29, 2016 8:49:11 AM MST)
Answer
- If questions do not apply then Offerors should describe why the questions do not apply. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 416
Are we allowed to negotiate indemnification and limitation of liability in participating addendum document, we want to limit our liability upto 12 months of fees paid (Submitted: Jan 29, 2016 8:49:31 AM MST) Answer
- Yes. Offerors must identify which terms and conditions they want to negotiate. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 417
Are we allowed to negotiate indemnification and limitation of liability in state specific terms and conditions , we want to limit our liability upto 12 months of fees paid (Submitted: Jan 29, 2016 8:50:08 AM MST) Answer
- Yes. Offerors must identify which terms and conditions they want to negotiate. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 418
In which document should the offeror enlist its products and the related cost, the cost schedule template merely contains space for depicting discount percentage. (Submitted: Jan 29, 2016 8:50:35 AM MST) Answer
- As part of the cost proposal. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 419
Is there any â€œcost structureâ€ which we need to adhere fixed cost or time and material cost, differential cost for different states, or based on small tier, medium tier or large tier? (Submitted: Jan 29, 2016 8:51:07 AM MST) Answer
- No. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 420
In which document should we mention the payment milestones if any for e.g. annual advance Also, The prices which we will quote, would it need to be exclusive of tax or inclusive of any taxes (Submitted: Jan 29, 2016 8:51:53 AM MST)
Answer
- Most purchasing entities are tax exempt.

All items discussing cost should be part of the cost proposal. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 421
Are we allowed to submit other product specific documents like SOW, SLA or are we supposed to review any specific SOW template (Submitted: Jan 29, 2016 8:52:16 AM MST) Answer
- Offerors are allowed to submit specific documents. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 422
What is the process to negotiate the terms and conditions of participating addendum, at what stage the negotiation to this document can be done? (Submitted: Jan 29, 2016 8:52:40 AM MST) Answer
- Once a Master Agreement has been signed then the awarded contractor can negotiate a participating addendum. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 423
What is the process to negotiate the terms and conditions of attachment Aâ€ - master agreement, at what stage the negotiation to this document can be done. (Submitted: Jan 29, 2016 8:53:03 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. The Lead State will not consider proposed modifications and/or additions to the Master Agreement Terms and Conditions after the deadline for proposals.

If an Offeror is awarded a contract then the lead state will initiate the negotiations for the Master Agreement.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 388
#2..
- 432 -
Question 423
What is the process to negotiate the terms and conditions of attachment Aâ€ - master agreement, at what stage the negotiation to this document can be done. (Submitted: Jan 29, 2016 8:53:03 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. The Lead State will not consider proposed modifications and/or additions to the Master Agreement Terms and Conditions after the deadline for proposals.

If an Offeror is awarded a contract then the lead state will initiate the negotiations for the Master Agreement. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 424
In the Attachment E, there is a template of participating addendum of state of Hawaii, need to understand whether this is a common template for all the states. (Submitted: Jan 29, 2016 8:53:26 AM MST) Answer
- A participating addendum template will be created once contracts have been awarded. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 425
Attachment E consists of various state specific terms and conditions. While submitting RFP do we need to call out our proposed changes for all the state specific terms and conditions or the selected offeror can negotiate state specific terms even after award stage (Submitted: Jan 29, 2016 8:53:51 AM MST) Answer
- No. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 426
In Exhibit H there is a column of â€œdeployment modelsâ€ , need clarity about the same. (Submitted: Jan 29, 2016 8:54:17 AM MST)
Answer
- Offerors should list which deployment models in Attachment D is Offeror able to provide. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 427
Need to know the order of precedence of contractual documents pertaining to â€¢ Attachment Aâ€™-master agreement
â€¢ Exhibits to master agreement
â€¢ State specific terms and conditions/General provisions â€“information technology which are there in Attachment E.
â€¢ Participating Addendum Template provided in Attachment E â€¢ The scope of work document which provider would submit â€¢ Any other documents-please specify (Submitted: Jan 29, 2016 8:54:49 AM MST) Answer
- (1) A Participating Entityâ€™s Participating Addendum (â€œPAâ€ ); (2) NASPO ValuePoint Master Agreement Terms & Conditions, including the applicable Exhibits to the Master Agreement;
(3) The Solicitation;
(4) Contractorâ€™s response to the Solicitation, as revised (if permitted) and accepted by the Lead State; and (5) A Service Level Agreement issued against the Participating Addendum. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 428
For the terms and conditions of â€œindemnificationâ€ and limitation of liability â€œ, which document will be construed as supreme over all documents. (Submitted: Jan 29, 2016 8:55:18 AM MST) Answer
- The participating addendum will control all other documents, as some states may have additional requirements then what it listed in the Master Agreement. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 429
For the terms and conditions for â€œtermination and termâ€ which document will be construed as supreme over all documents? (Submitted: Jan 29, 2016 8:55:44 AM MST) Answer
- The participating addendum will control all other documents, as some states may have additional requirements then what it listed in the Master Agreement. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 430
In attachment E , there Is a document about supplier diversity program, could you please provide some details on the same (Submitted: Jan 29, 2016 8:56:06 AM MST)
Answer
- Attachment E contains state specific terms and conditions and will be negotiated/discussed in the participating addendum stage. (Answered: Jan 29, 2016 9:20:21 AM MST) Question 431
With respect to encryption for data at rest, we provide the same for a selected set of modules, and for some we do not. Can we use the technical response in the proposal to specify this as an exception? (Submitted: Jan 29, 2016 8:56:30 AM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 389
#2..
- 433 -
Answer
- Attachment E contains state specific terms and conditions and will be negotiated/discussed in the participating addendum stage. (Answered: Jan 29, 2016 9:20:21 AM MST) Question 431
With respect to encryption for data at rest, we provide the same for a selected set of modules, and for some we do not. Can we use the technical response in the proposal to specify this as an exception? (Submitted: Jan 29, 2016 8:56:30 AM MST)
Answer
- Yes. (Answered: Jan 29, 2016 9:20:21 AM MST)
Question 432
In Attachment F: Usage Report Summary â€“Sample :: What is expected to be updated in Tab 2 of the specification mentions about total dollars spent per each customer, is it the dollar amount purchases made by each state using Procurement Solution? and in Summary by state sheet? (Submitted: Jan 29, 2016 8:56:51 AM MST) Answer
- This is a sample usage report, for reference only.

The final usage report will be provided to the awarded vendors. (Answered: Jan 29, 2016 9:20:21 AM MST) Question 433
(Attachment A, Section 23. Operations Management) What, if any certifications might be required by solicitation? (Submitted: Jan 29, 2016 8:58:17 AM MST)
Answer
- The last sentence has been deleted in the section. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 434
In order to improve marketing efforts and greater competition in the marketplace, would the State be willing to allow a contract holder to add agents to this contract? These agents would quote and accept orders on the contract holderâ€™s behalf. (Submitted: Jan 29, 2016 8:58:25 AM MST) Answer
- Sales agents are acceptable. (Answered: Jan 29, 2016 9:20:21 AM MST) Question 435
If agents are allowed on this contract, what is the process for adding them to the RFP response? What information would the State need in order to authorize these agents? (Submitted: Jan 29, 2016 8:58:56 AM MST) Answer
- If an Offeror intends to use sales agents then it should identify that in Section 8.20. Offerors do not need to name each sales agent. However, some states may require if a sales agent is entering on to certain property of the state that the sales agent receives a background check. (Answered: Jan 29, 2016 9:20:21 AM MST) Question 436
If additional products that fit into the scope of this RFP become available post-award, will this contract allow for the addition of these products to the contract? (Submitted: Jan 29, 2016 8:59:12 AM MST) Answer
- Yes. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 437
If additional manufacturers become a part of the contract holderâ€™s portfolio that fit into the scope of this RFP, would the State allow for these manufacturers to be added post-award? (Submitted: Jan 29, 2016 8:59:40 AM MST) Answer
- Yes Section 2.8 allows for this. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 438
Do managed services fit into the scope of this RFP? If so, what category of services should they be placed under in the response? Managed Services is defined as the proactive management of an IT (Information Technology) asset or object, by a third party typically known as a MSP, on behalf of a customer. (Submitted: Jan 29, 2016 8:59:58 AM MST)
Answer
- Offeror must demonstrate how their offerings fit into the service models described in Attachment D. (Answered:

Feb 1, 2016 4:29:33 PM MST)
Question 439
Do implementation services fit into the scope of this RFP? If so, what category of services should they be placed under in the response? (Submitted: Jan 29, 2016 9:00:11 AM MST) Answer
- An offeror's offering should fit into categories listed in Attachment D. (Answered: Feb 1, 2016 4:29:33 PM MST) Question 440
If the state receives multiple bid responses for the separate cloud categories within the scope of this RFP, how will the state plan to award each category? (Submitted: Jan 29, 2016 9:00:29 AM MST) Answer
- Every vendor that meets the minimum point threshold and provides a responsive cost proposal form may be awarded a contract. (Answered: Jan 29, 2016 4:28:56 PM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 390
#2..
- 434 -
- An offerors offering should fit into categories listed in Attachment D. (Answered: Feb 1, 2016 4:29:33 PM MST) Question 440
If the state receives multiple bid responses for the separate cloud categories within the scope of this RFP, how will the state plan to award each category? (Submitted: Jan 29, 2016 9:00:29 AM MST) Answer
- Every vendor that meets the minimum point threshold and provides a responsive cost proposal form may be awarded a contract. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 441
(Attachment A, Section 31. Warranty)
c. Contractor represents and warrants that the representations contained in its response to the Solicitation by the Lead State.

This appears to be an incomplete sentenceâ€”can you please clarify? (Submitted: Jan 29, 2016 9:00:37 AM MST) Answer
- Contractor is representing any representation made its proposal as true and accurate. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 442
If one company provides multiple bid responses for different cloud categories would the state be willing to provide multiple contracts to the company? (Submitted: Jan 29, 2016 9:00:46 AM MST) Answer
- Yes. (Answered: Feb 1, 2016 4:29:33 PM MST)
Question 443
Approximately how many awards are the state planning on making as a result of this RFP? (Submitted: Jan 29, 2016 9:01:02 AM MST)
Answer
- Every vendor that meets the minimum point threshold and provides a responsive cost proposal form may be awarded a contract. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 444
Please describe the Stateâ€™s anticipated award model and evaluation procedures for this RFP. (Submitted:

Jan 29, 2016 9:01:18 AM MST)
Answer
- This is identified in Section 4 of the RFP document. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 445
In regards to 5.6.6 and attachment A data location: Most modern data security standards (including FedRAMP and DoD Cloud SRG) have moved away from the concept of data location as providing value. Can this requirement either be clarified as to its rational or removed? (Submitted: Jan 29, 2016 9:01:36 AM MST) Answer
- If an Offeror cannot meet this mandatory minimum requirement it will not be rejected, but it will restrict the type of award the Offeror can receive. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 446
In regards to 5.6.13: This question implies a 100% requirement for scale up/down; Is it, instead, possible to provide an SLA or other similar documentation to help account for Acts of God and other factors which may not have been reasonably foreseen? (Submitted: Jan 29, 2016 9:02:13 AM MST) Answer
- An Offeror's proposal and SLA should details these instances. (Answered: Feb 1, 2016 4:29:33 PM MST) Question 447
Please provide a list of master eDiscovery requirements. (Submitted: Jan 29, 2016 9:02:24 AM MST) Answer
- These may vary from State to State. This will be negotiated during the participating addendum stage. (Answered:

Feb 1, 2016 4:29:33 PM MST)
Question 448
In regards to Section 8, Attachment A: Does NASPO require that a full staff list and background check results be shared as a prerequisite for placing data in the contractorâ€™s facility? Is NASPO amenable to alternate strategies used by other government entities? (Submitted: Jan 29, 2016 9:02:38 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 449
In regards to Change Control and advance notice: Many cloud providers are in a virtually constant refresh cycle of hardware and software. How will NASPO allow for constant refresh in cases where the offeror has robust management and rollback capabilities? (Submitted: Jan 29, 2016 9:02:51 AM MST) Answer
- Please include these details in your proposal. (Answered: Feb 1, 2016 2:43:08 PM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 391
#2..
- 435 -
Question 449
In regards to Change Control and advance notice: Many cloud providers are in a virtually constant refresh cycle of hardware and software. How will NASPO allow for constant refresh in cases where the offeror has robust management and rollback capabilities? (Submitted: Jan 29, 2016 9:02:51 AM MST) Answer
- Please include these details in your proposal. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 450
In regards to access to security logs and reports(A-9): Certain of the report elements (e.g. latency, IP address) may or may not be able to be accurately reported on by the cloud provider without correlation to systems like on premise firewalls (ie. NAT-ed IP addresses; last mile latency, etc). Is it possible, instead, to provide what is reported on and give purchasers the ability to determine goodness of fit? (Submitted: Jan 29, 2016 9:03:03 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Feb 1, 2016 3:40:06 PM MST) Question 451
Question on 8.6.2
List all government or standards organization security certifications you currently hold that apply specifically to the hosted environment described in your firmâ€™s RFP response, as well as those in process at time of response.

Specifically include HIPAA, FERPA, CJIS Security Policy, PCI Data Security Standards (DSS), IRS Publication 1075, FISMA, NIST 800-53, NIST SP 800-171, and FIPS 200 if they apply.

There is presently no Vendor Certification for CJIS, each Law Enforcement Agency must define how the Cloud Solution will be used with respect to CJ data and execute an Information Exchange Agreement with the Vendor. If a Cloud Vendor can define how they ensure compliance with CJIS in the absence of any certification program, will that ensure that points will not be deducted? (Submitted: Jan 29, 2016 9:03:21 AM MST) Answer
- Yes. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 452
Score Sheet - The instructions in the excel file are as follows: â€œDRAFT: This document is intended to be a draft and should not be returned to the Division of Purchasing. Please return this document to the evaluation committee chairperson.â€
Our understanding is that we do not have to submit the score sheet with our proposal. But, could you clarify the instruction above? Do we have to score ourselves, and return (submit) the score sheet to the evaluation committee chairperson, or is that an instruction for the Division of Purchasing evaluators? If yes, could you please provide us with the contact information for submission? (Submitted: Jan 29, 2016 9:09:58 AM MST) Answer
- Correct. The score sheet is for your reference. The score sheet will be used by the evaluation committee. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 453
(RFP Section 3.13 CONFIDENTIAL OR PROPRIETARY INFORMATION) (2) commercial information or non-individual financial information obtained from a person if:
(c) the person submitting the information has provided the governmental entity with the information specified in UCA Â§ 63G-2-309;
* * * * *
(6) records
Is there something missing here or perhaps mislabeled? (Submitted: Jan 29, 2016 9:12:48 AM MST) Answer
- Subsection (3) through (5) have been removed as they are not relevant. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 454
RFP Section 5.5.11. Please specify what technical support is required at no additional cost. (Submitted: Jan 29, 2016 9:15:16 AM MST)
Answer
- General technical support. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 455
Please clarify that both the CAIQ and the CCM need to be completed with the submission? (Submitted: Jan 29, 2016 9:17:24 AM MST)
Answer
- Yes both forms should be completed. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 456
How is pricing graded? Is it compared within a vertical or a pricing structure (a platform price compared to priced solely by users)?
Can you better explain the risk levels for the data? What is defined as low risk data, medium risk data and high risk data? Is any data that is covered by each stateâ€™s Freedom of Information Act considered low risk? Can we add and subtract sub-contractors throughout the length of the contract or are we bound by the list we submit with the proposal?
How does the scale pricing work? Obviouslyeach respondent provides a different product and therefore will have State of Utah Bid CH16012
3/22/2016 4:23 PM p. 392
#2..
- 436 -
Question 456
How is pricing graded? Is it compared within a vertical or a pricing structure (a platform price compared to priced solely by users)?
Can you better explain the risk levels for the data? What is defined as low risk data, medium risk data and high risk data? Is any data that is covered by each stateâ€™s Freedom of Information Act considered low risk? Can we add and subtract sub-contractors throughout the length of the contract or are we bound by the list we submit with the proposal?
How does the scale pricing work? Obviously, each respondent provides a different product and therefore will have completely different pricing. (Submitted: Jan 29, 2016 9:28:37 AM MST) Answer
- 1. Price is evaluated by an offeror providing a minimum discount for each category listed.

2. The levels of risk have been defined by FIPS PUB 199. And each state will decide that during the participating addendum stage.

3. Yes. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 457
In regards to item 5.5.8 Does the RFP require us to submit the CAIQ to the CSA and maintain a STAR registry entry with that program or only complete the assessment and provide it as part of the RFP and upon request? (Submitted: Jan 29, 2016 9:39:06 AM MST)
Answer
- The RFP only requires that Offerors complete the assessment. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 458

Page 31 ends

Finance CommitteeApril 29, 2024

Finance Committee
April 29, 2024