Agenda packet — Modesto City Council, June 4, 2024 (part 6 of 11)

Please confirm that this is a statement that Contractor is representing that the Contractorâ€™s representations in response to the Solicitation by the Lead State are accurate. (Submitted: Jan 26, 2016 12:33:24 PM MST) Answer
- Yes. (Answered: Feb 1, 2016 4:19:32 PM MST)
Question 217
Document: Cloud_Solutions_-_Request_for_Proposals_-_CH16012; Page: 30; Section: 8.8.1.c â€œSpecify how you would respond to the following situations; include any contingency plan or policy. c. Experiences a business failure.â€
Can you provide a couple of specific example scenarios to clarify the type of event you intend in this question? (c.

Experiences a business failure) (Submitted: Jan 26, 2016 12:39:27 PM MST) Answer
- No. Offeros should provide their general policies on how they respond to situations. (Answered: Feb 1, 2016 4:19:32

PM MST)
Question 218
The answer to question 69. CH16012 - NASPO ValuePoint Cloud Solutions, in part states "However, if an Offeror is not awarded a Service Category during this solicitation then an Offeror may attempt to be awarded a Service Category if the Lead State re-issues the solicitation, as permitted in 2.8." Service Category is not defined in the RFP. Please clarify the definition of this term. (Submitted: Jan 26, 2016 1:16:19

PM MST)
Answer
- Answer 69 should replace "Service Category" with Service Model, as defined in Attachment D. (Answered: Feb 1, 2016 4:19:32 PM MST)
Question 219
RFP 8.2.13(B) asks for "b. Level 2 CSA STAR Registry Assessment Certification." Our CSP will certify that they have this, but their standard practice is to only provide the certification document by request under NDA. We can therefore make a statement but we cannot provide the actual document.

Is this acceptable to NASPO? (Submitted: Jan 26, 2016 1:20:38 PM MST) Answer
- An Offeror must demonstrate how it meets this requirement under 8.2.13. (Answered: Feb 1, 2016 4:19:32 PM MST) Question 220
If an Offeror is awarded one Cloud Service Type may the offeror add offerings from another Cloud Service Type during the term of the Master Agreement? For example if an offeror is awarded SAAS, are they permited to later add IAAS products to the Master Agreement? (Submitted: Jan 26, 2016 1:23:16 PM MST) Answer
- If an Offeror is awarded an offering for SaaS during this solicitation then it would be permitted to later add IaaS or PaaS if there was a re solicitation. An Offeror could amend its contract to later add on an offering. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 221
RFP section 7.0 states ".....The State has identified a number of roles that are necessary based on the requirements of Attachment D; these titles are not meant to be restrictive, but are used to identify key roles." We are unable to locate the roles the State has identified. They are not listed in Attachment D. What section contains the list of key roles, as identified by the State? (Submitted: Jan 26, 2016 2:08:27 PM MST) Answer
- Section 7 have been modified to only include the role of a contract manager. (Answered: Feb 1, 2016 4:19:32 PM MST)
Question 222
"8.13 (E) CLOUD SECURITY ALLIANCE QUESTIONNAIRES - A" references a Mandatory Minimum Requirement described in section 4.1.9 though I don't see anything in the RFP doc beyond 4.1.2, did I miss it? Also, is the expectation that each response will include both the CCM and CAIQ or is it either / or? The language "can submit two different types of reports" in attachment B implies the option to choose which one we include, is that correct? (Submitted: Jan 26, 2016 2:43:39 PM MST)
Answer
- This was a mistake in the RFP document. The reference should be to Section 5.5.8. This will be corrected in the final version of the RFP document
(Answered: Jan 262016 4:42:34 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 344
#15..
- 675 -

8.13 (E) CLOUD SECURITY ALLIANCE QUESTIONNAIRES A references a Mandatory Minimum Requirement described in section 4.1.9 though I don't see anything in the RFP doc beyond 4.1.2, did I miss it? Also, is the expectation that each response will include both the CCM and CAIQ or is it either / or? The language "can submit two different types of reports" in attachment B implies the option to choose which one we include, is that correct? (Submitted: Jan 26, 2016 2:43:39 PM MST)
Answer
- This was a mistake in the RFP document. The reference should be to Section 5.5.8. This will be corrected in the final version of the RFP document. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 223
If we are a current NASPO ValuePoint contract holder would it be possible to use the terms and conditions of the previous contract that are already negotiated and approved? (Submitted: Jan 26, 2016 4:14:20 PM MST) Answer
- This cannot be guarantee. This solicitation contains specific terms and conditions that are specific to this solicitation. (Answered: Jan 26, 2016 4:43:16 PM MST)
Question 224
Mandatory Minimum Requirements Section 5.5.10 our data is housed in colocation centers. Can we submit the data center SOC reports? (Submitted: Jan 26, 2016 4:44:13 PM MST) Answer
- Yes. This should be the 5.5.10 requirement. (Answered: Jan 27, 2016 11:24:19 AM MST) Question 225
Can you please provide us with the excel sheet format (showing the specific 20+ column headers) of the Quarterly Sales Reports that will be required under the contract? (Submitted: Jan 26, 2016 8:37:31 PM MST) Answer
- NASPO ValuePoint is going to work with awarded contractors, once awards are made, to create a reasonable and effective detailed report template.

What NASPO ValuePoint will want to know is very limited in the Cloud case - what entities are using it, which offerings and how much are they paying. (Answered: Jan 28, 2016 1:14:43 PM MST) Question 226
Document: Cloud_Solutions_-_Request_for_Proposals_-_CH16012; Page: 23; Section: 8.15.2. This section

8.15.2 appears to be a duplicate of section 8.8.2. Is that correct, or is there a different answer expected? Can you please clarify? (Submitted: Jan 27, 2016 8:01:00 AM MST) Answer
- Section 8.15.2 has been deleted from the final version of the RFP. (Answered: Jan 27, 2016 11:24:19 AM MST) Question 227
Document: Cloud_Solutions_-_Request_for_Proposals_-_CH16012; Page: 30; Section: 8.14.2 â€œDescribe in detail the standard lead-time for provisioning Services defined in section 8.4.2 of the RFP.â€ Section 8.4.2 reads, â€œSpecify your ability to comply with the following customer service requirements:
a. You must have one lead representative for each entity that executes a Participating Addendum. Contact information shall be kept current.
b. Customer Service Representative(s) must be available by phone or email at a minimum, from 7AM to 6PM on Monday through Sunday for the applicable time zones.
c. Customer Service Representative will respond to inquiries within one business day. d. You must provide design services for the applicable categories. e. You must provide Installation Services for the applicable categories.â€ Can you clarify how these two sections are related? (Submitted: Jan 27, 2016 8:03:24 AM MST) Answer
- These section are not related. And Section 8.14.2 has been modified to remove the reference to 8.4.2. (Answered:

Jan 27, 2016 11:24:19 AM MST)
Question 228

Page 31 ends

agreed to in the Master Agreement Terms and Conditions or in a Participating Addendum. Will NASPO review new terms and conditions over the term of the contract, as appropriate to keep pace with changes and new technologies?

Page 31 ends

Page 43 ends

costs and management of infrastructure, network, OS, and software.â€ We interpret this to mean that pricing should be provided for all aspects of the cloud solution that are typically offered by the manufacturer, can you confirm? Alternatively, if there are additional expectations around infrastructure and management of infrastructure beyond what might typically be offered by a cloud solutions provider, can you please clarify what those expectations are? (Submitted: Jan 27, 2016 1:08:12 PM MST) Answer
- Your interpretation is correct. (Answered: Jan 28, 2016 1:14:43 PM MST) Question 230
RFP Section 5.2.5 prohibits employment of â€œany company or person other than a bona fide employee working solely for the Offeror or a company regularly employed as its marketing agent, to respond to the RFP.â€ What about cases where authorized resellers or value added resellers of a service provider wish to submit proposals as prime contractors, for the purpose of providing cloud services for which the cloud service provider sells via an â€œindirect through resellerâ€ sales model â€“ is this allowed? (Submitted: Jan 27, 2016 1:09:09 PM MST)
Answer
- This is allowed. (Answered: Jan 28, 2016 1:14:43 PM MST) Question 231
RFP Section 5.5.12 refers to SLA requirements in RFP Section 8.13. But Section 8.13 appears to apply to the STAR Registry Self-Assessment, not SLA. Is this a typo, and if so then what section was intended? If not, please explain the relationship to SLA. (Submitted: Jan 27, 2016 1:10:48 PM MST) Answer
- The reference should be to 8.12. (Answered: Jan 28, 2016 1:14:43 PM MST) Question 232
RFP Section 9.1 requires that Offerors bid a minimum discount off of their published government price catalog.

Fulfillment Partner means a third-party contractor qualified and authorized by Contractor, and approved by the Participating State under a Participating Addendum, who may, to the extent authorized by Contractor, fulfill any of the requirements of this Master Agreement including but not limited to providing Services under this Master Agreement and billing Customers directly for such Services. Contractor may, upon written notice to the Participating State, add or delete authorized Fulfillment Partners as necessary at any time during the contract term.

Fulfillment Partner has no authority to amend this Master Agreement or to bind Contractor to any additional terms and conditions. (Answered: Jan 28, 2016 11:00:02 AM MST) Question 234
Section 9 of Attachment A (â€œRight to Publishâ€ ) appears to prohibit any sort of mention of the Agreement without advance permission. Will a Contractor need to seek permission in each case where it wants to alert a prospective Purchasing Entity in a Participating State of the existence of the Master Agreement, in order that the Contractor may encourage the prospective Purchasing Entity to utilize the Master Agreement for its needs? (Submitted: Jan 27, 2016 1:12:39 PM MST)
Answer
- No. (Answered: Jan 28, 2016 9:12:16 AM MST)
Question 235
RFP Section 7.2 requires incorporation of all Attachments. If an exception is not taken to Attachment E would an offeror be bound by those state specific terms and conditions when they attempt to negotiate a Participating Addendum with that respective State? Must exceptions to Attachment Eâ€™s state specific terms and conditions State of Utah Bid CH16012
3/22/2016 4:23 PM p. 346
#15..
- 677 -
(Submitted: Jan 27, 2016 1:12:39 PM MST)
Answer
- No. (Answered: Jan 28, 2016 9:12:16 AM MST)
Question 235
RFP Section 7.2 requires incorporation of all Attachments. If an exception is not taken to Attachment E would an offeror be bound by those state specific terms and conditions when they attempt to negotiate a Participating Addendum with that respective State? Must exceptions to Attachment Eâ€™s state specific terms and conditions be taken at this phase? Or will additional time be granted for Offerors to prepare exceptions to the Participating Addenda in Attachment E? (Submitted: Jan 27, 2016 1:13:05 PM MST) Answer
- No. State specific terms and conditions will be negotiated when an awarded contractor negotiates a participating addendum (the same applies for the State of Utah's terms and conditions).

The only set of terms and conditions that an Offeror needs to take exception to are the Master Agreement Terms and Conditions. (Answered: Jan 28, 2016 9:12:16 AM MST) Question 236
In each of the Exhibits 1 and 2 to Attachment A, please explain what is meant by the section titled â€œWeb Servicesâ€ which says â€œthe Contractor shall use Web services exclusively to interface with the Purchasing Entityâ€™s data in near real time.â€ (Submitted: Jan 27, 2016 1:13:44 PM MST) Answer
- The applications are accessible from various client devices through a thin-client interface such as a Web browser (e.g., Web-based email) or a program interface. (Answered: Jan 28, 2016 10:34:42 AM MST) Question 237
Our company currently has a D&B rating of 1R2. We would like to confirm if this is considered an equivalent rating to the required D&B of 3A2 or higher? Our company is a Private S Corporation and like many other similar companies, we do not submit financials to D&B and therefore D&B cannot provide us a â€œAâ€ rating. D&B has therefore provided us a rating of 1R2. We believe that 1R2 + financials (which we will be submitting with our proposal) to show our standing and financial strength is equivalent to 3A2 - this is based on satisfying the 3A2 threshold as a $100M+ company and a composite rating of 2 which is equivalent.

Please confirm if 1R2 with financials submitted directly to NASPO with our proposal will be deemed equivalent to 3A2. (Submitted: Jan 27, 2016 2:24:14 PM MST)
Answer
- The State's concerns with the D&B rating is the financial strength of the company. An Offeror's submitted financials must meet this requirement. (Answered: Jan 28, 2016 9:12:16 AM MST) Question 238
When does the State intend to publish the revised, final RFP? (Submitted: Jan 28, 2016 2:11:45 AM MST) Answer
- As soon as all the revisions have been made to the document. It is anticipated that it will be released by February 5, 2016. (Answered: Jan 28, 2016 9:12:16 AM MST)
Question 239
The RFP refers to a 'contract vendor'. In each cloud category, will multiple cloud vendors be chosen by the Lead State? (Submitted: Jan 28, 2016 7:18:21 AM MST)
Answer
- Yes, this is a multiple award contract, so the State intends to award multiple contracts to each category. (Answered: Jan 28, 2016 9:12:16 AM MST)
Question 240
Is there a document associated with Addendum #6? If not, can you specify what information was added? (Submitted: Jan 28, 2016 9:08:55 AM MST)
Answer
- This addendum is being provided to inform Offerors that the State of Alabama has provided its intent to participate in this RFP. (Answered: Jan 28, 2016 9:12:49 AM MST) Question 241
Does the SSAE 16 requirement apply to every service offering? (Submitted: Jan 28, 2016 9:32:35 AM MST) Answer
- If an Offeror does not believe the SSAE 16 requirement applies to its offering then it needs to describe why the requirement does not apply. However, the State reserves the right to determine if it does apply. (Answered: Jan 28, 2016 10:58:31 AM MST)
Question 242
Please provide additional details of the applicable roles for subcontractors and/or third party resellers. (Submitted: Jan 28, 2016 9:39:13 AM MST)
Answer
- Subcontractor means any organization, whether designated as a subcontractor , fulfillment partner, reseller, etc., that will assist an Offeror to provide an Offering if awarded a Master Agreement. (Answered: Jan 28, 2016 10:58:31 AM MST)
Question 243
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 347
#15..
- 678 -
Please provide additional details of the applicable roles for subcontractors and/or third party resellers. (Submitted: Jan 28, 2016 9:39:13 AM MST)
Answer
- Subcontractor means any organization, whether designated as a subcontractor , fulfillment partner, reseller, etc., that will assist an Offeror to provide an Offering if awarded a Master Agreement. (Answered: Jan 28, 2016 10:58:31 AM MST)
Question 243
Will subcontractors and/or third parties be able to provide functions of the service delivery? For example, if an OEM has a offering on it's GPL but part of that delivery will include a "wrapper" value added services from an authorized reseller. Is this joint offering from the OEM and it's authorized reseller permissible under the scope of this RFP? (Submitted: Jan 28, 2016 9:39:39 AM MST)
Answer
- Yes. (Answered: Jan 28, 2016 10:58:31 AM MST)
Question 244
Will subcontractors and/or third parties be able to list their service offerings under a Subcontractor price list? (Submitted: Jan 28, 2016 9:40:07 AM MST)
Answer
- Subcontractor will only be able to offer what the awarded contractor is able to offer. (Answered: Jan 28, 2016 10:58:31

AM MST)
Question 245
How can a cloud provider certify its offerings are NIST compliant? We can attest that our offering is NIST compliant but how can we certify it? (Submitted: Jan 28, 2016 9:40:24 AM MST) Answer
- This requirement has been modified to request that Offerors describe how its offerings are NIST compliant. (Answered: Jan 28, 2016 10:58:31 AM MST)
Question 246
Section 5.6.13 seems to be applicable to IaaS only. If a requirement such as 5.6.13 is only applicable to IaaS, how can it be a mandatory requirement? (Submitted: Jan 28, 2016 9:40:54 AM MST) Answer
- If a mandatory minimum does not apply to an Offeror's offering/solution then the Offeror must describe how that mandatory minimum does not apply. (Answered: Jan 28, 2016 10:58:31 AM MST) Question 247
Is Cloud brokering and/or resale of other Cloud Service Providers offerings allowed in a respondents proposal? (Submitted: Jan 28, 2016 9:41:28 AM MST)
Answer
- Brokering and/or resale were not contemplated for this RFP apart from an Offeror using resellers. (Answered: Jan 28, 2016 1:14:43 PM MST)
Question 248
Attachment A T&Cs, Section 42B. Please explain what is meant ship date in the detailed sales report that is required. (Submitted: Jan 28, 2016 9:41:48 AM MST)
Answer
- "Ship date" should be removed. It is not applicable to this RFP. (Answered: Jan 28, 2016 1:14:43 PM MST) Question 249
It appears that not all the sales reporting requirements in Attachment A 42B are reflected in the reporting template provided in Attachment F. Which document has precedents? (Submitted: Jan 28, 2016 9:42:22 AM MST) Answer
- The sales reporting document will be modified once contracts have been awarded. (Answered: Jan 28, 2016 1:14:43 PM MST)
Question 250
Would the State entertain providing an extension to the submittal deadline in order to allow reponders to provide a more detailed accurate response? (Submitted: Jan 28, 2016 9:42:55 AM MST) Answer
- No. The RFP will have been posted for over 60 days. The State believes that it has provided Offerors time to provide a detailed accurate response. (Answered: Jan 28, 2016 10:00:55 AM MST) Question 251
Revisions will be included in a final document available Feb. 5th, the responses are due Feb. 26th. This would require a complete review of the final document for any and all changes, which by the way include a new review by legal, finance/purchasing, product management, contractual review team, etc., is it normal to expect a complete response in this timeframe of 21 days? We would like to formally request a 30 day extension be granted to everyone. (Submitted: Jan 28, 2016 10:17:50 AM MST)
Answer
- The revisions that are being made are the ones being discussed during the question and answer period to address typos, numbering issues, and clarifications. (Answered: Jan 28, 2016 10:25:20 AM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 348
#15..
- 679 -
require a complete review of the final document for any and all changes, which by the way include a new review by legal, finance/purchasing, product management, contractual review team, etc., is it normal to expect a complete response in this timeframe of 21 days? We would like to formally request a 30 day extension be granted to everyone. (Submitted: Jan 28, 2016 10:17:50 AM MST)
Answer
- The revisions that are being made are the ones being discussed during the question and answer period to address typos, numbering issues, and clarifications. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 252
If selected as an approved Offeror, is the vendor/Offeror required to accept all requests for services? Or can the vendor/Offeror decline service requests posed to them? (Submitted: Jan 28, 2016 10:37:15 AM MST) Answer
- No. An Offeror may negotiate participating addendums with Participating Entities as they choose. (Answered: Jan 28, 2016 10:58:31 AM MST)
Question 253
Section #8.3- refers to roles, iidentified in Section 7, which refers to roles identified in Attachment D. Attachment D, has no roles identified.

What are the roles NASPO would like identified and described? (Submitted: Jan 28, 2016 10:48:52 AM MST) Answer
- Section 7 has been modified to only reference the role of the Contract Manager. (Answered: Jan 28, 2016 10:58:31

AM MST)
Question 254
Section 8.15.1 is matching 8.8.1(e). This appears to be a duplicate question. Please confirm which question should be answered. (Submitted: Jan 28, 2016 10:51:06 AM MST) Answer
- Yes this is a duplicate and 8.15.1 has been deleted from the final RFP document. (Answered: Jan 28, 2016 10:58:31

AM MST)
Question 255

5.5.5 (p.22) Please clarify that this requirement only applies to SaaS solutions (Submitted: Jan 28, 2016 10:54:49

AM MST)
Answer
- If an Offeror beleives that a requirement or technical criteria only applies to a certain offering then it must describe that in its RFP. (Answered: Feb 1, 2016 4:19:32 PM MST) Question 256

5.5.11 (p. 22) Please confirm that the no-cost training is limited to the training that the vendor will describe in response to RFP Section 8.18 (Submitted: Jan 28, 2016 10:55:12 AM MST) Answer
- The word "training" in 5.5.11. will be removed from the final RFP document. (Answered: Jan 28, 2016 1:14:43 PM MST)
Question 257

5.6.2 (p. 23) Does the SLA have to include payment provisions for violation of the SLA? (Submitted: Jan 28, 2016 10:55:32 AM MST)
Answer
- Yes, if included in the Offeror's SLA. (Answered: Jan 28, 2016 1:14:43 PM MST) Question 258

5.6.14 (p.23) Please confirm if the applicable production environment interfaces with purchasing party applications, the purchasing party will be responsible for providing test/staging interfaces in order to make the test/staging environment identical to production? (Submitted: Jan 28, 2016 10:56:00 AM MST) Answer
- Correct. (Answered: Jan 28, 2016 1:14:43 PM MST)
Question 259

5.6.14 (p. 23) Please confirm that only the hardware/software configuration between test/staging and production environments needs to be identical. The actual data in various environments can be different. (Submitted: Jan 28, 2016 10:56:27 AM MST)
Answer
- Correct. (Answered: Jan 28, 2016 1:14:43 PM MST)
Question 260

8.1.1 (p. 28) This section refers to page limit for response. Please provide the page limit. (Submitted: Jan 28, 2016 10:56:51 AM MST)
Answer
- 8.1.1. has been modified so that ",within the indicated page limit." has been deleted. (Answered: Jan 28, 2016 11:02:01 AM MST)
Question 261
General Question
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 349
#15..
- 680 -
(p) pgpppg
10:56:51 AM MST)
Answer
- 8.1.1. has been modified so that ",within the indicated page limit." has been deleted. (Answered: Jan 28, 2016 11:02:01 AM MST)
Question 261
General Question
Will the vendors be scored individually for each solution submitted, or one combined score for all solutions provided? (Submitted: Jan 28, 2016 10:57:34 AM MST)
Answer
- Combined for all of the offering provided. (Answered: Jan 28, 2016 11:02:01 AM MST) Question 262
We are a privately held corporation and do not have publicly traded debt; Therefore we do not file any financial / annual report documents with the Securities and Exchange Commission (SEC). We only distribute financial information to a limited number of parties; investors, debt holders/lenders, and customers and vendors with whom we have confidentiality or non-disclosure agreements with. Furthermore, financial statements are NOT generally available to the public since we neither file with the SEC nor do we disclose financials without confidentiality or non-disclosure agreements. Please confirm if the State will hold financial statements as Confidential should bidder clearly marks as confidential. (Submitted: Jan 28, 2016 1:05:27 PM MST) Answer
- If documents, such as financial information as marked as Confidential and an Offeror has completed the appropriate form (Claim of Business Confidentiality form) then the State will not disclose the documents. (Answered: Jan 28, 2016 1:18:45 PM MST)
Question 263

5.6.13: some of the service offerings rely on connectivity to the PSTN (e.g.: mobile numbers for texting/sms services, local area voice calling, long distance access, audio circuits for web-based conferencing) may require non-automated intervention to increase capacity â€“ is exclusion of such services from compliance to 5.6.13 a disqualifying event for a service offering relying on the PSTN connectivity? (Submitted: Jan 28, 2016 1:07:28 PM MST) Answer
- An Offeror should discuss this issue in their proposal. It should not disqualify. (Answered: Jan 28, 2016 1:18:45 PM MST)
Question 264
Unlimited Training:

Is unlimited electronic training, such as online forums, API and SDK reference documents, video on demand and other electronic, automatic, self-paced documentation and training, considered a compliant response to requirement 5.5.11? Is there any expectation of in-person, or 1:1, or 1:many live training in this requirement? If so, what quantities of persons and session might contractor need to consider to establish cost basis for proposal? (Submitted: Jan 28, 2016 1:07:59 PM MST)
Answer
- This would meet the requirement. However, the word "training" has been removed form 5.5.11. (Answered: Jan 28, 2016 1:18:45 PM MST)
Question 265
Section 5.5.7; Is a Level 1 CSA STAR Registry Self-Assessment required for a remotely managed, on customer premises IaaS offer? (Submitted: Jan 28, 2016 1:10:01 PM MST) Answer
- If an Offeror believes that a mandatory minimum requirement or technical criteria is not applicable to its offering then it should describe why it is not applicable in its proposal. (Answered: Feb 1, 2016 4:19:32 PM MST) Question 266
Will NASPO supply a Vendor information Sheet that is unlocked for ease of use in developing the proposal? (Submitted: Jan 28, 2016 2:00:18 PM MST)
Answer
- The Vendor Information Sheet does not have a password to protect it. (Answered: Jan 28, 2016 2:02:38 PM MST) Question 267
FP Section 5.2.5 prohibits employment of â€œany company or person other than a bona fide employee working solely for the Offeror or a company regularly employed as its marketing agent, to respond to the RFP.â€ What about cases where authorized resellers or value added resellers of a service provider wish to submit proposals as prime contractors, for the purpose of providing cloud services for which the cloud service provider sells via an â€œindirect through resellerâ€ sales model â€“ is this allowed? (Submitted: Jan 28, 2016 2:25:26 PM MST)
Answer
- Yes, this is allowed. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 268
RFP Section 5.5.12 refers to SLA requirements in RFP Section 8.13. But Section 8.13 appears to apply to the STAR Registry Self-Assessment, not SLA. Is this a typo, and if so then what section was intended? If not, please explain the relationship to SLA. (Submitted: Jan 28, 2016 2:25:40 PM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 350
#15..
- 681 -
MST)
Answer
- Yes, this is allowed. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 268
RFP Section 5.5.12 refers to SLA requirements in RFP Section 8.13. But Section 8.13 appears to apply to the STAR Registry Self-Assessment, not SLA. Is this a typo, and if so then what section was intended? If not, please explain the relationship to SLA. (Submitted: Jan 28, 2016 2:25:40 PM MST) Answer
- The reference to Section 8.13 should be 8.12. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 269
RFP Section 9.1 requires that Offerors bid a minimum discount off of their published government price catalog.

An Offeror may request that the term disabling code be removed from the Master Terms and Conditions if it is not used in the final Master Agreement. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 271
Section 9 of Attachment A (â€œRight to Publishâ€ ) appears to prohibit any sort of mention of the Agreement without advance permission. Will a Contractor need to seek permission in each case where it wants to alert a prospective Purchasing Entity in a Participating State of the existence of the Master Agreement, in order that the Contractor may encourage the prospective Purchasing Entity to utilize the Master Agreement for its needs? (Submitted: Jan 28, 2016 2:26:14 PM MST)
Answer
- No. (Answered: Jan 28, 2016 5:04:29 PM MST)
Question 272
RFP Section 7.2 requires incorporation of all Attachments. If an exception is not taken to Attachment E would an offeror be bound by those state specific terms and conditions when they attempt to negotiate a Participating Addendum with that respective State? Must exceptions to Attachment Eâ€™s state specific terms and conditions be taken at this phase? Or will additional time be granted for Offerors to prepare exceptions to the Participating Addenda in Attachment E? (Submitted: Jan 28, 2016 2:26:25 PM MST) Answer
- No. An offeror will negotiate State specific terms and conditions during the participating addendum process. (Answered: Jan 28, 2016 5:04:29 PM MST)
Question 273
In each of the Exhibits 1 and 2 to Attachment A, please explain what is meant by the section titled â€œWeb Servicesâ€ which says â€œthe Contractor shall use Web services exclusively to interface with the Purchasing Entityâ€™s data in near real time.â€ (Submitted: Jan 28, 2016 2:26:34 PM MST) Answer
- This question has been answered above. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 274
Regarding the following question:

6.2.2 Describe in detail the size and scope of the cloud solutions for which you have provided the types of services required by in this RFP.

What kind of details are you looking for? $ value? Number of users? Duration? Other? And how many customer solutions would be appropriate? (Submitted: Jan 28, 2016 3:03:22 PM MST) Answer
- Yes, all of those things list. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 275
Regarding Section 8.4.2.b, Customer Service: Is it acceptable for customer services representative(s) to be offshore, as long as they are available during the time frame defined by the Purchasing Agencies? (Submitted: Jan 28, 2016 3:06:16 PM MST)
Answer
- Yes. As long as no sensitive data (high risk data) is being transferred to them. (Answered: Jan 28, 2016 5:04:29 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 351
#15..
- 682 -
Question 275
Regarding Section 8.4.2.b, Customer Service: Is it acceptable for customer services representative(s) to be offshore, as long as they are available during the time frame defined by the Purchasing Agencies? (Submitted: Jan 28, 2016 3:06:16 PM MST)
Answer
- Yes. As long as no sensitive data (high risk data) is being transferred to them. (Answered: Jan 28, 2016 5:04:29 PM MST)
Question 276
In Section 3.14, the RFP mentions References. It is unclear how these will be scored, if at all, in the Evaluation process. Can this be clarified? And how many references are requested for maximum scoring? Finally, please define what information should be provided with these references. (Submitted: Jan 28, 2016 3:22:37

PM MST)
Answer
- Section 3.14 has been deleted. The State will not score/evaluate any references. (Answered: Jan 28, 2016 5:04:29

PM MST)
Question 277
There appears to be an ambiguity and inconsistency between section 3.1 requiring that all â€œexceptions to scope/contentâ€ be â€œaddressed within the Q&A periodâ€ and section 3.4 which requires that exceptions be made in the Offerorâ€™s Proposal. Please clarify whether exceptions need to be submitted through BidSync pursuant to Section 3.1 of the RFP to later be considered within the Offerorâ€™s proposal pursuant to section 3.4.

If an Offeror wishes to proposes its commercial terms as an exception to an RFP requirement which is not specifically in the Master Ts and Cs, should it submit those commercial terms as an exception in its proposal, and not as a question via BidSync? If an Offeror only proposes and submits its commercial terms as an exception to the Master Ts and Cs when it submits its final proposal will that Offerorâ€™s exceptions be allowed or considered responsive since it was not addressed in the Q&A period per section 3.1 of the RFP? (Submitted: Jan 28, 2016 3:25:00 PM MST)
Answer
- 3.4 states that: Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

3.1 states: Exceptions to scope/content of the RFP within an Offerorâ€™s proposal that have not been previously addressed within the Q&A period of the procurement are not allowed and may result in the Offerorâ€™s proposal being considered non-responsive.

The difference between the two sections is that 3.1 relates to RFP document. If an Offeror questions a mandatory minimum or scoreable criteria then it needs to address it during the Q&A period.

If an Offeror wants to modify the T&Cs then it can submit a redline version as part of its proposal. (Answered: Jan 28, 2016 5:04:29 PM MST)
Question 278
Section 3.4 states that â€œURLs provided with a proposal may result in that proposal being rejected as nonresponsive.â€ Does this apply to the total RFP or only to any Exceptions the Offerer submits? Can URLs be referenced in the response? (Submitted: Jan 28, 2016 4:22:04 PM MST) Answer
- URLs relates to Offerors taking exception to terms and conditions. An Offeror cannot take exception to the Master Agreement terms and conditions by stating that an Offerors terms and conditions can only be found at a URL. (Answered: Jan 28, 2016 5:04:29 PM MST)
Question 279

6.3 states "Offeror must provide audited financial statements to the State." How many years of audited financial statements does the State require? (Submitted: Jan 28, 2016 4:22:31 PM MST) Answer
- 6.3 has be been modified to require the last two years. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 280

6.3 states that the Offeror "should meet a minimum Dun and Bradstreet (D&B) credit rating of 4A2 or better, or a recognized equivalent rating." Our D&B service does not provide a credit rating. Will you accept other forms of credit reference e.g. A letter of reference from our bank? (Submitted: Jan 28, 2016 4:23:00 PM MST) Answer
- Yes. As long as you meet the financial strength component of the D&B rating. (Answered: Jan 28, 2016 5:04:29 PM MST)
Question 281
Which security certifications must the Offeror hold, or be in the process of obtaining, in order to comply with the RFP? (Submitted: Jan 28, 2016 4:23:35 PM MST)
Answer
- There is no requirement. An Offeror must list its security certifications to help purchasing entities make best value determinations. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 282

8.16 seems to imply that the Offeror will be storing data (other than CDR and similar data). Is there an expectation that the Offeror will be database of record for customer data? (Submitted: Jan 28, 2016 4:23:53 PM MST) Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 352
#15..
- 683 -
Answer
- There is no requirement. An Offeror must list its security certifications to help purchasing entities make best value determinations. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 282

8.16 seems to imply that the Offeror will be storing data (other than CDR and similar data). Is there an expectation that the Offeror will be database of record for customer data? (Submitted: Jan 28, 2016 4:23:53 PM MST) Answer
- For some solutions this could be the case. If 8.16 is not relevant to an Offeror's solution then an Offeror must describe why it is not relevant. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 283
Attachment A, Exhibits 1 and 2, Web Services state "The Contractor shall use Web services exclusively to interface with the Purchasing Entityâ€™s data in near real time." Will NASPO guarantee all Purchasing Entities are not only capable of consuming web services, but also willing to deny other potentially more desirable interface options, so that we as a Contractor may exclusively limit ourselves to their use as interfaces? (Submitted: Jan 28, 2016 4:24:13 PM MST)
Answer
- An offeror may take exceptions/additions to the master agreement terms and conditions in its proposal. (Answered: Feb 1, 2016 4:19:32 PM MST)
Question 284
Attachment A, Exhibits 1 and 2, Encryption of Data at Rest state "The Contractor shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data as identified in the SLA, unless the Contractor presents a justifiable position that is approved by the Purchasing Entity that Personal Data, is required to be stored on a Contractor portable device in order to accomplish work as defined in the scope of work." As this is a defined requirement for software and platform as a service options, is this requirement absolute, as it requires all hard drives containing personal data to be encrypted, regardless of platform, database, or operating system? (Submitted: Jan 28, 2016 4:24:26 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 285
Please confirm that Offerors need to provide only the CAIQ or CCM and not both reports. (Submitted: Jan 28, 2016 4:25:12 PM MST)
Answer
- The State is requesting that Offerors complete both documents to help purchasing entities make "best value" determinations. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 286
Can you provide specific direction regarding our insertion of list pricing into the response documents? The cost proposal section supports the insertion of discount percentages and only references itemized pricing. Where should the itemized pricing be included? (Submitted: Jan 28, 2016 4:25:27 PM MST) Answer
- The items pricing should be included in the cost proposal. (Answered: Jan 28, 2016 5:04:29 PM MST) Question 287
Unduly Restrictive
Attachment A Section 16
Microsoft is self-insured, so this must be noted. Microsoftâ€™s program of self-assurance does cover the amounts listed in this section, however it should be noted that (as of the time of Proposal) â€œModerateâ€ is the highest Level of Risk that any Microsoft product is represented to be suitable for. Please see our Exception and Clarifying Statements to Section 5.6.4 for additional information on FedRAMP and NIST 800-53 Moderate controls.

Additionally, as it pertains to its program of self-insurance, Microsoft does not agree to name individual customers (whether Lead State, Participating Entities, or Purchasing Entities) as named insureds.

Additionally, while Microsoft is able to provide its renewal certificates upon request, but (as a provider of standardized services to many thousands of customers and millions of user) cannot be expected to institute a one-off operational process to notify any particular customer of renewals, let alone within any time frame.

Microsoft therefore respectfully requests the following changes to the subsections identified below, but otherwise accepts the remaining subsections of Section 16.

Revised Subsection a:
â€œUnless otherwise agreed in a Participating Addendum, Contractor shall, during the term of this Master Agreement, maintain in full force and effect, a program of self-insurance or the insurance described in this section. Contractor shall acquire such insurance from an insurance carrier or carriers licensed to conduct business in each Participating Entityâ€™s state and having a rating of A-, Class VII or better, in the most recently published edition of Bestâ€™s Reports. Failure to buy and maintain the required insurance may result in this Master Agreementâ€™s termination or, at a Participating Entityâ€™s option, result in termination of its Participating Addendum.â€ (Submitted: Jan 28, 2016 5:12:54 PM MST) Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 353
#15..
- 684 -
Agreement, maintain in full force and effect, a program of selfinsurance or the insurance described in this section. Contractor shall acquire such insurance from an insurance carrier or carriers licensed to conduct business in each Participating Entityâ€™s state and having a rating of A-, Class VII or better, in the most recently published edition of Bestâ€™s Reports. Failure to buy and maintain the required insurance may result in this Master Agreementâ€™s termination or, at a Participating Entityâ€™s option, result in termination of its Participating Addendum.â€ (Submitted: Jan 28, 2016 5:12:54 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 288
Unduly Restrictive
Attachment A Section 16
Revised Subsection d:

Prior to commencement of performance, Contractor shall provide to the Lead State a written endorsement to the Contractorâ€™s general liability insurance policy or other documentary evidence acceptable to the Lead State that provides that the Contractorâ€™s liability insurance policy shall be primary, with any liability insurance of any Participating State as secondary and noncontributory. Before performance of any Purchase Order issued after execution of a Participating Addendum authorizing it, the Contractor shall provide to a Purchasing Entity or Participating Entity who requests it the same information described in this subsection.

Revised Subsection e:
e. Contractor shall furnish to the Lead State, Participating Entity, and, on request, the Purchasing Entity copies of certificates of all required insurance within thirty (30) calendar days of the execution of this Master Agreement, the execution of a Participating Addendum, or the Purchase Orderâ€™s effective date and prior to performing any work. The insurance certificate shall provide the following information: the name and address of the insured; name, address, telephone number and signature of the authorized agent; name of the insurance company (authorized to operate in all states); a description of coverage in detailed standard terminology (including policy period, policy number, limits of liability, exclusions and endorsements); and an acknowledgment of the requirement for notice of cancellation. Copies of renewal certificates of all required insurance shall be furnished upon request. These certificates of insurance must expressly indicate compliance with each and every insurance requirement specified in this section. Failure to provide evidence of coverage may, at sole option of the Lead State, or any Participating Entity, result in this Master Agreementâ€™s termination or the termination of any Participating Addendum E (Submitted: Jan 28, 2016 5:14:24 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 289
Unduly Restrictive
The following 11 questions are based upon the following language:

Any and all Services offered and furnished shall comply fully with all applicable Federal and State laws and regulations.

The federal and state laws, regulations, policies, standards, and guidelines that Contractors doing business with the Participating Entities must be aware of, include, but not limited to: Criminal Justice Information Services (CJIS) Security Policy; Federal Educational Rights and Privacy Act (FERPA); Federal Information Security Management Act (FISMA); National Institute of Technology Standards; Gramm-Leach-Bliley Act (GLB) Act; Health Insurance Portability and Accountability Act (HIPAA); Health Information Technology for Economic and Clinical Health Act (HITECH); IRS Publication 1075; Payment Card Industry Data Security Standard (PCI DSS); Sarbanes-Oxley Act (SOX); Electronic Communications Privacy Act, Stored Communications Act and the PATRIOT Act. The list is intentionally United States-centric, and is not intended to be all-inclusive. Further, since laws, regulations, requirements and industry guidelines change, consulting definitive sources to assure a clear understanding of compliance requirements is critical. Many State Entities have additional program compliance requirements that must be considered in addressing compliance. (e.g..DMV Privacy Act, Public Service Law, etc.). (Submitted: Jan 28, 2016 5:22:54 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 290
Unduly Restrictive
To take each of the individual laws and standards that are mentioned in the 2nd paragraph:
1) CJIS. Specifically as it pertains to certain (but not all) Government Community Cloud Services, Microsoft will execute an FBI CJIS Addendum Certification. This certifies Microsoft agreement to comply with Appendix H to FBI CJIS Policy (applicable to private contractors) but not to comply with all other portions of CJIS Policy, which are intended to apply to the Purchasing Entities that are subject to CJIS Policy. Microsoftâ€™s ability and willingness to execute FBI CJIS Addendum Certifications currently only applies to those 16 States (not currently including Utah, but including several other potential Participating States such as California, Massachusetts, Minnesota, Kansas, and others) in which the Stateâ€™s CJIS Systems Agency (CSA) has executed a special Microsoft agreement called the CJIS Information Agreement, in which Microsoft and the CSA agree upon terms pursuant to which CJIS Policy audits will be conducted, and how the privacy of Microsoft personnel (subject to background checks by the CSA) will be protected, among other mutually-protective terms and conditions. Additionally, after each Statesâ€™ CSA executes CJIS Information Agreement, each individual Purchasing Entity in those States with CJIS Policy State of Utah Bid CH16012
3/22/2016 4:23 PM p. 354
#15..
- 685 -
intended to apply to the Purchasing Entities that are subject to CJIS Policy. Microsoftâ€ s ability and willingness
to execute FBI CJIS Addendum Certifications currently only applies to those 16 States (not currently including Utah, but including several other potential Participating States such as California, Massachusetts, Minnesota, Kansas, and others) in which the Stateâ€™s CJIS Systems Agency (CSA) has executed a special Microsoft agreement called the CJIS Information Agreement, in which Microsoft and the CSA agree upon terms pursuant to which CJIS Policy audits will be conducted, and how the privacy of Microsoft personnel (subject to background checks by the CSA) will be protected, among other mutually-protective terms and conditions. Additionally, after each Statesâ€™ CSA executes CJIS Information Agreement, each individual Purchasing Entity in those States with CJIS Policy requirements must also execute an Amendment in which the Purchasing Entity agrees to delegate its rights to audit and adjudicate employees to the CSA. Microsoft will be happy to provide a copy of the standard boilerplate Microsoft CJIS Information Agreement for review, however this is not something that can be incorporated into the Master Agreement as it must be executed by each Participating Stateâ€™s CSA, specifically (Submitted: Jan 28, 2016 5:23:44 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 291
unduly restrictive:
2) FERPA. The following contract language is included in the OST (Microsoft Online Services Terms, which is contractually incorporated). Note that â€œCustomerâ€ in this case â€œCustomerâ€ is equivalent to â€œPurchasing Entityâ€ : If a Customer is an educational agency or institution to which regulations under the Family Educational Rights and Privacy Act, 20 U.S.C. Â§ 1232g (FERPA) apply, Microsoft acknowledges that for the purposes of the OST, Microsoft is a â€œschool officialâ€ with â€œlegitimate educational interestsâ€ in the Customer Data, as those terms have been defined under FERPA and its implementing regulations, and Microsoft agrees to abide by the limitations and requirements imposed by 34 CFR 99.33(a) on school officials.

Customer understands that Microsoft may possess limited or no contact information for Customerâ€™s students and studentsâ€™ parents. Consequently, Customer will be responsible for obtaining any parental consent for any end userâ€™s use of the Online Service that may be required by applicable law and to convey notification on behalf of Microsoft to students (or, with respect to a student under 18 years of age and not in attendance at a postsecondary institution, to the studentâ€™s parent) of any judicial order or lawfully-issued subpoena requiring the disclosure of Customer Data in Microsoftâ€™s possession as may be required under applicable law. (Submitted: Jan 28, 2016 5:24:14 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 292
Unduly Restrictive
3) Federal Information Security Management Act (FISMA). Microsoft commits itself to certifying for FISMA via FedRAMP. Please see our clarifying statement and proposed alternative contract language above, for Section

5.6.4, which explains our commitment in this regard. Note that this only applies to our Government Community Cloud services (Submitted: Jan 28, 2016 5:24:51 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 293
Unduly Restrictive
4) National Institute of Technology. Here, we are unclear what the requirement is, because NIST is an organization that creates many different standards, only a few of which are applicable to cloud services. However, if NASPO means â€œNIST 800-53â€ then please see our response and proposed contract commitment pertaining to this, above in our Exception to RFP Section 5.6.4. (Submitted: Jan 28, 2016 5:25:16 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 294
Unduly Restrictive
5) GLB. Without representing that it is subject to Gramm-Leach-Bliley Act (GLB), Microsoft understands that it may have access under the contract to a Purchasing Entityâ€™s financial information and other nonpublic personal information protected thereby. To assist Purchasing Entities in meeting their GLB obligations, Microsoft will implement, maintain, and use appropriate administrative, technical and physical security measures to protect the confidentiality and integrity of all electronically maintained or transmitted Customer Data. Microsoft will protect the Customer Data it receives from or on behalf of Purchasing Entities according to commercially acceptable standards and no less rigorously than it protects its own confidential information. (Submitted: Jan 28, 2016 5:25:36 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 295
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 355
#15..
- 686 -
Customer Data it receives from or on behalf of Purchasing Entities according to commercially acceptable standards and no less rigorously than it protects its own confidential information. (Submitted: Jan 28, 2016 5:25:36 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 295
Unduly Restrictive
6) and 7) Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH). Microsoft has provided a Business Associate Agreement with this Proposal, and subject to that will comply with its obligations as Business Associate under these Statutes. (Submitted: Jan 28, 2016 5:26:17 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 296
LEVEL TWO: CSA STAR Certification
If the offeror possesses FedRAMP third party certification, would that meet requirements? (Submitted: Jan 28, 2016 5:26:45 PM MST)
Answer
- No. The certification is specific. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 297
Unduly Restrictive
8) IRS Publication 1075. For Purchasing Entities that must comply with this IRS regulation, Microsoft will execute the IRS â€œSafeguarding Contract Language for Technology Servicesâ€ (which is Exhibit 7 to IRS Publication 1075), solely for its Government Community Cloud versions of the following Online Services: Exchange Online, SharePoint Online, Exchange Online Archiving, Skype for Business, Office Web Apps when delivered as part of Office 365 Government E1 (formerly G1), E3 (formerly G3) and E4 (formerly G4) or other Government Community Cloud Offers, as well as the Azure Government services listed as being in the scope for IRS 1075 at http://azure.microsoft.com/en-us/support/trust-center/compliance/irs1075/ or its successor site. As a condition of doing this, each applicable Purchasing Entity must execute Microsoftâ€™s protective and clarifying Amendment related to this. A copy of this Amendment has been enclosed with Offerorâ€™s Proposal. (Submitted: Jan 28, 2016 5:26:57 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 298

8.15.1 Ability to recover and restore data within 4 business hours in the event of a severe outage. Describe your Recovery Point Objective (RPO) and Recovery Time Objective (RTO).

Please confirm the intent of the 4 business hours recovery is for system outage and not those facility outages requiring activation of the Disaster Recovery Plan, which is where offerors are asked to provide their current service level RPO and RTO. (Submitted: Jan 28, 2016 5:27:18 PM MST) Answer
- Yes. This has been modified. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 299
Unduly Restrictive
9) Payment Card Industry Data Security Standard (PCI DSS). A) The Azure platform is certified as compliant under PCI DSS version 3.0 at Service Provider Level 1 (the highest volume of transactionsâ€”more than 6 million a year).

Azure provides a platform that complies with the PCI DSS on which customers can develop a cardholder environment or card processing service. Customers can leverage Azureâ€™s validation in many of the underlying portions, thereby reducing the associated effort and costs of getting their own PCI DSS certification. It is, however, important to understand that Azureâ€™s PCI DSS compliance status does not automatically translate to PCI DSS certification for the services that Purchasing Entities (or their contractors) build or host on the Azure platform.

Purchasing Entities are responsible for ensuring that they achieve compliance with some PCI DSS requirements.

Microsoft publishes an Azure Customer PCI Guide (a copy of which is enclosed with the Proposal) which specifies areas of responsibility for each PCI DSS requirement, and whether it is assigned to Azure or the customer, or if the responsibility is shared. B) Other Microsoft cloud services are not certified for PCI-DSS Compliance, and Microsoft does not recommend storing or processing payment card numbers with such other services. Certain levels of Office 365 licenses provide Data Loss Prevention (DLP) capability, and those cases Microsoft provides DLP templates for PCI-DSS, in order to help Purchasing Entities ensure that their users are not improperly using payment card information on the services. (Submitted: Jan 28, 2016 5:27:25 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 300
Unduly Restrictive
10) Sarbanes Oxley (SOX)
As a corporationMicrosoftâ€™s business operations are subject to SOX However
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 356
#15..
- 687 -
improperly using payment card information on the services. ( , )
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 300
Unduly Restrictive
10) Sarbanes Oxley (SOX). As a corporation, Microsoftâ€™s business operations are subject to SOX. However, this is related to our own accounting practices and therefore not directly related to our customers use of any of our Online Services. Microsoft does not represent that its Online Services will assist Purchasing Entities with their SOX compliance, which is entirely the responsibility of the Purchasing Entities. (Submitted: Jan 28, 2016 5:27:45 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 301
Unduly Restrictive
11), 12) and 13) Electronic Communications Privacy Act, Stored Communications Act and the PATRIOT Act. As stated above, Microsoft complies with all laws that apply to it as a corporation, and as an IT Service Provider.

Microsoft does not accept responsibility for any portions of such laws that, as written, apply solely to Purchasing Entities.

Having explained the above, Microsoft respectfully declines to agree to Section 17, as written, but (a) will agree to comply with laws applicable to it as a corporation and as an IT Service Provider; and (b) to the extent that any of the above notes indicate specific Microsoftâ€™s willingness to sign amendments or agree to contract language, subject to the conditions outlined above, Microsoft will do so. (Submitted: Jan 28, 2016 5:28:19 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

However, the second paragraph in Section 17 has been deleted. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 302
Unduly Restrictive:

Attachment A, Section 23 Operations Management: Contractor shall maintain the administrative, physical, technical, and procedural infrastructure associated with the provision of the Product in a manner that is, at all times during the term of this Master Agreement, at a level equal to or more stringent than those specified in the Solicitation. Contractor must maintain any certifications required under the Solicitation As stated in the Microsoft Online Services Terms (OST), which is contractually incorporated, Microsoft is committed to helping protect the security of Customerâ€™s information. Microsoft has implemented and will maintain and follow appropriate technical and organizational measures intended to protect Customer Data against accidental, unauthorized or unlawful access, disclosure, alteration, loss, or destruction.

However, to the extent that Exceptions have been provided by Offeror to any of the requirements of the Solicitation, Microsoft cannot guarantee compliance with the requirement in this section to meet or exceed those Solicitation standards to which Exceptions have been taken, nor that it will maintain certifications to which Exceptions have been taken. Microsoft sincerely hopes that the terms and conditions that it is able to offer NASPO through the Offerors of its cloud services, subject to final negotiation, will meet the needs of all Participating Entities and Purchasing Entities in all Participating States. (Submitted: Jan 28, 2016 5:30:20 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 303
Unduly Restrictive:

Attachment A, Section 25 Purchasing Entity Data: Purchasing Entity retains full right and title to Data provided by it and any Data derived therefrom, including metadata.

Contractor shall not collect, access, or use user-specific Purchasing Entity Data except as strictly necessary to provide Service to the Purchasing Entity. No information regarding Purchasing Entityâ€™s use of the Service may be disclosed, provided, rented or sold to any third party for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. The obligation shall extend beyond the term of this Master Agreement in perpetuity.

Contractor shall not use any information collected in connection with this Master Agreement, including Purchasing Entity Data, for any purpose other than fulfilling its obligations under this Master Agreement.

Microsoft respectfully takes exception with the following words in the first sentence â€œand any data derived therefrom, including metadata,â€ and asks that these words be struck. Microsoft has no objection to the other words in this clause.

For clarity, Microsoft may use metadata derived from Customer Data for purposes necessary for the provision of the Online Services. Such use of metadata may include, but is not limited to, spam and virus filtering, data loss prevention, spillage support, transaction logs, temp files, and memory buffers. Microsoft shall not use metadata (or any other Customer Data) stored or transmitted by the Covered Service, or derive information from it, for any advertising or other commercial purpose of Microsoft or any third party.

However, Metadata is not retrievable or extractable, and may not be deleted, by Purchasing Entities. It is stored in Microsoftâ€™s internal databases, and retained and protected by Microsoft. (Submitted: Jan 28, 2016 5:31:03 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 304
Unduly Restrictive
Attachment A, Section 29 Title to Product: If access to the Product requires an application program interface (API), Contractor shall convey to Purchasing Entity an irrevocable and perpetual license to use the API.

Microsoft respectfully takes exception to this clause, as unreasonable. To the extent that all Products provided by Microsoft shall be Online Services provided pursuant to subscription licenses, all aspects of such Online Services (including APIs, to the extent applicable) are only licensed for the duration of that subscription. (Submitted: Jan 28, 2016 5:31:53 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 305
Unduly Restrictive
Attachment A, Section 30 Data Privacy: The Contractor must comply with all applicable laws related to data privacy and security, including IRS Pub 1075. Prior to entering into a SLA with a Purchasing Entity, the Contractor and Purchasing Entity must cooperate and hold a meeting to determine the Data Categorization to determine whether the Contractor will hold, store, or process High Risk Data, Moderate Risk Data and Low Risk Data. The Contractor must document the Data Categorization in the SLA or Statement of Work.

Please refer to our Exception and Clarifying Statements for Attachment A, Section 17, above in this document, which clarifies which laws and regulations Microsoft agrees to comply with, as applicable to Microsoft as a corporation and IT Service Provider. Our Statements clarify how Microsoft approaches compliance to specific standards, such as IRS 1075, and which of our various cloud services are in scope for each of those standards.

To reiterate a point made in that previous section, Microsoft does not agree to comply with laws (or portions of laws) that are written as applicable only to its customers and their industry or government function. (Submitted: Jan 28, 2016 5:32:43 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 306
Unduly Restrictive
Attachment A, Section 33 Waiver of Breach: Failure of the Lead State, Participating Entity, or Purchasing Entity to declare a default or enforce any rights and remedies shall not operate as a waiver under this Master Agreement or Participating Addendum. Any waiver by the Lead State, Participating Entity, or Purchasing Entity must be in writing.

Waiver by the Lead State or Participating Entity of any default, right or remedy under this Master Agreement or Participating Addendum, or by Purchasing Entity with respect to any Purchase Order, or breach of any terms or requirements of this Master Agreement, a Participating Addendum, or Purchase Order shall not be construed or operate as a waiver of any subsequent default or breach of such term or requirement, or of any other term or requirement under this Master Agreement, Participating Addendum, or Purchase Order.

Microsoft respectfully request to make this section reciprocal, to the extent we believe this is reasonable. As such, we have modified it accordingly, as follows.

Revised language:

Waiver of Breach: Failure of a party to declare a default or enforce any rights and remedies shall not operate as a waiver under this Master Agreement or Participating Addendum. Any waiver by a party must be in writing. Waiver by a party of any default, right or remedy under this Master Agreement or Participating Addendum, or by Purchasing Entity with respect to any Purchase Order, or breach of any terms or requirements of this Master Agreement, a Participating Addendum, or Purchase Order shall not be construed or operate as a waiver of any subsequent default or breach of such term or requirement, or of any other term or requirement under this Master Agreement, Participating Addendum, or Purchase Order. (Submitted: Jan 28, 2016 5:33:37 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 307
Unduly Restrictive
RFP Section 44 (which was renumbered from the original number 43 pursuant to Offerorâ€™s request to add a Limitation of Liability clause as Section 43) Entire Agreement: This Master Agreement, along with any attachment, contains the entire understanding of the parties hereto with respect to the Master Agreement unless a term is State of Utah Bid CH16012
3/22/2016 4:23 PM p. 358
#15..
- 689 -
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 307
Unduly Restrictive
RFP Section 44 (which was renumbered from the original number 43 pursuant to Offerorâ€™s request to add a Limitation of Liability clause as Section 43) Entire Agreement: This Master Agreement, along with any attachment, contains the entire understanding of the parties hereto with respect to the Master Agreement unless a term is modified in a Participating Addendum with a Participating Entity. No click-through, or other end user terms and conditions or agreements required by the Contractor (â€œAdditional Termsâ€ ) provided with any Services hereunder shall be binding on Participating Entities or Purchasing Entities, even if use of such Services requires an affirmative â€œacceptanceâ€ of those Additional Terms before access is permitted. Please see Exception and Clarifying Statements for RFP Section 5.5.14, pertain to â€œAdditional Terms.â€ Offer and Microsoft are willing to make the commitments shown in the Clarifying Statements, but respectfully takes exception with this clause as written. (Submitted: Jan 28, 2016 5:34:47 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 308
Unduly Restrictive
Exhibit 1 to Attachment A, Section 2c
Also Exhibit 2 to Attachment A, Section 2c All Personal Data shall be encrypted at rest and in transit with controlled access. Unless otherwise stipulated, the Contractor is responsible for encryption of the Personal Data. Any stipulation of responsibilities will identify specific roles and responsibilities and shall be included in the service level agreement (SLA), or otherwise made a part of the Master Agreement.

Please see explanations and definition of Customer Content in our exception to RFP Section 5.6.6, above. In that Exception, we explain that Customer Content in SaaS (of which, most Personal Data is a subset) is stored at rest in the US, and in what cases it is encrypted.

However, specifically as it pertains to the limited set of data in the Directory which is used to manage user accounts contains the names and email addresses of licensed users, that specific data is not encrypted at rest.

This is not sensitive Customer Content. Microsoft respectfully takes exception with any requirement that Directory data be encrypted.

Please refer to Microsoftâ€™s proposed contract language in its Exception and Clarifying Statements pertaining to RFP Section 5.6.6, above in this document. (Submitted: Jan 28, 2016 5:35:34 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 309
Unduly Restrictive
Exhibit 1 to Attachment A, Section 2d
Also Exhibit 2 to Attachment A, Section 2d Unless otherwise stipulated, the Contractor shall encrypt all Non-Public Data at rest and in transit. The Purchasing Entity shall identify data it deems as Non-Public Data to the Contractor.

The level of protection and encryption for all Non -Public Data shall be identified in the SLA.

As it pertains to Directory data (and the definition of Customer Content), please See Exception and Clarifying Statement for Section 2c, immediately above. Additionally, Microsoft treats all Customer Content in its SaaS services equally, and does not monitor whether data is public or non-public (it is all assumed to be non-public and treated according, except in cases where the services are used by Purchasing Entities to display data on their public Website). The level of Encryption is controlled by Microsoft based upon its system design, and is not selectable by individual Purchasing Entities, and is not identified in Microsoftâ€™s SLA.

As such, Microsoft respectfully takes exception to this requirement as written, and requests that it be struck. â€¢ Please refer to the Microsoft Online Services Terms for Microsoftâ€™s contractual commitments pertaining to encryption.
â€¢ Please refer to Microsoftâ€™s proposed contract language in its Exception and Clarifying Statements pertaining to RFP Section 5.6.6, above in this document. (Submitted: Jan 28, 2016 5:36:18 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 310
Unduly Restrictive
Exhibit 1 to Attachment A, Section 2e
Also Exhibit 2 to Attachment A, Section 2e At no time shall any data or processes â€” that either belong to or are intended for the use of a Purchasing Entity or its officers, agents or employees â€” be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the Purchasing Entity. Clarifying Statement As per Microsoftâ€™s previous Exceptions and Clarifying Statements above in this document, (1) metadata is owned and retained by Microsoft; (2) no form of Customer Data or metadata is used for any purpose other than State of Utah Bid CH16012
3/22/2016 4:23 PM p. 359
#15..
- 690 -
Unduly Restrictive
Exhibit 1 to Attachment A, Section 2e
Also Exhibit 2 to Attachment A, Section 2e At no time shall any data or processes â€” that either belong to or are intended for the use of a Purchasing Entity or its officers, agents or employees â€” be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the Purchasing Entity. Clarifying Statement As per Microsoftâ€™s previous Exceptions and Clarifying Statements above in this document, (1) metadata is owned and retained by Microsoft; (2) no form of Customer Data or metadata is used for any purpose other than operating and supporting the Online Services; and (3) disclosure of Customer Data to law enforcement is subject to law, but is protected by Microsoft according to the terms and conditions cited above in this document and in the Microsoft Online Services Terms. (Submitted: Jan 28, 2016 5:36:52 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 311
Unduly Restrictive
Exhibit 1 to Attachment A, Section 3
Also Exhibit 1 to Attachment A, Section 3 Data Location: The Contractor shall provide its services to the Purchasing Entity and its end users solely from data centers in the U.S. Storage of Purchasing Entity data at rest shall be located solely in data centers in the U.S. The Contractor shall not allow its personnel or contractors to store Purchasing Entity data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The Contractor shall permit its personnel and contractors to access Purchasing Entity data remotely only as required to provide technical support. The Contractor may provide technical user support on a 24/7 basis using a Follow the Sun model, unless otherwise prohibited in a Participating Addendum.

Please see the Exception and Clarifying Statements for RFP Section 5.6.6, above in this document, for information pertaining to Microsoftâ€™s contractual commitments to storing and processing Customer Content and other forms of Customer Data in the United States. To the extent that such commitments accurately describe Microsoftâ€™s commitments, Microsoft respectfully requests that this Section 3 be struck and that the aforementioned commitments apply in lieu thereof. (Submitted: Jan 28, 2016 5:37:33 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 312
Unduly Restrictive
The next question is based on the following- question following next per maximum word limit:

Exhibit 1 to Attachment A, Section 8 Background Checks:

Upon the request of the Purchasing Entity, the Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Master Agreement who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or misdemeanor offense for which incarceration for up to 1 year is an authorized penalty. The Contractor shall promote and maintain an awareness of the importance of securing the Purchasing Entityâ€™s information among the Contractorâ€™s employees and agents. If any of the stated personnel providing services under a Participating Addendum is not acceptable to the Purchasing Entity in its sole opinion as a result of the background or criminal history investigation, the Purchasing Entity, in itsâ€™ sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate the Participating Addendum and any related service agreement. (Submitted: Jan 28, 2016 5:40:09 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 313
question:

Microsoft respectfully requests to replace the wording from the RFP with the following contractual commitment, which more accurately describes Microsoftâ€™s procedures pertaining to each of its personnel that are expected to have access to Customer Content:

Microsoft performs the following background checks on all US personnel who have potential to access Customer Data. Adherence to this policy is one of the control procedures addressed by the Microsoft Audit Report per the section of the Microsoft Online Services Terms titled â€œMicrosoft Audits of Online Services.â€ Such Background Checks will be performed in accordance with the Fair Credit Reporting Act and will consist of Social Security Number trace, seven (7) year felony and misdemeanor criminal records check of federal, state, or local records (as applicable) for job related crimes, Office of Foreign Assets Control List (OFAC) check, Bureau of Industry and Security List (BIS) check and Office of Defense Trade Controls Debarred Persons List (DDTC) check.

Additionally, for States with which Microsoft has entered into a Microsoft CJIS Information Agreement and provided an FBI CJIS Addendum Certification to the applicable CJIS Systems Agency (CSA, e.g. the California Department of Justice), for its CJIS Covered Services (which are most of the Microsoft Government Community Cloud Services), Microsoft submits its personnel that have access to unencrypted Criminal Justice Information and other Customer Content (including both employees and subcontractors, where applicable) for FBI NCIC fingerprint background checks and adjudication by each such CSA (Submitted: Jan 28, 2016 5:41:24 PM MST) Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 360
#15..
- 691 -
Additionally, for States with which Microsoft has entered into a Microsoft CJIS Information Agreement and provided an FBI CJIS Addendum Certification to the applicable CJIS Systems Agency (CSA, e.g. the California Department of Justice), for its CJIS Covered Services (which are most of the Microsoft Government Community Cloud Services), Microsoft submits its personnel that have access to unencrypted Criminal Justice Information and other Customer Content (including both employees and subcontractors, where applicable) for FBI NCIC fingerprint background checks and adjudication by each such CSA (Submitted: Jan 28, 2016 5:41:24 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 314
Unduly Restrictive
Language question is following per maximum word limit:

Access to Security Logs and Reports: The Contractor shall provide reports on a schedule specified in the SLA to the Purchasing Entity in a format as specified in the SLA agreed to by both the Contractor and the Purchasing Entity. Reports shall include latency statistics, user access, user access IP address, user access history and security logs for all public jurisdiction files related to this Master Agreement and applicable Participating Addendum. (Submitted: Jan 28, 2016 5:43:28 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 315
question:

For certain key Microsoft Online Services (at minimum, those referenced in the proposed alternative language, below), Purchasing Entities are provided with self-service access to a number of security-related reports through the Administrator Console. These reports may change from time to time, and Microsoft is committed to designing services which meet the demands of its customers. However, Microsoft does not provide access to other internally-kept logs to its customers, as this would be disruptive to operations. Microsoft does not provide such reports for all its services, but more will provide more information upon request as to the reporting capabilities of its services.

Microsoft respectfully requests to replace the RFP language with this section with the following alternative language:
â€œFor the Online Services included in the Data Processing Terms section of the Microsoft Online Services Terms, Event Logging. Microsoft logs, or enables Customer to log, access and use of information systems containing Customer Data, registering the access ID, time, authorization granted or denied, and relevant activity.

Microsoft shall allow Purchasing Entities reasonable self-service access to security information, latency data, and other related SaaS security data that affect this Contract and the Purchasing Entityâ€™s Data, at no cost to the Purchasing Entity. The parties recognize that the type of self-service access and security data made available to Purchasing Entities may be subject to change. (Submitted: Jan 28, 2016 5:44:27 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 316
Unduly Restrictive:

The next question is based on the following per the maximum word limit:

Exhibit 1 to Attachment A, Section 11
Also Exhibit 2 to Attachment A, Section 11 Data Center Audit: The Contractor shall perform an independent audit of its data centers at least annually at its expense, and provide an unredacted version of the audit report upon request to a Purchasing Entity. The Contractor may remove its proprietary information from the unredacted version. A Service Organization Control (SOC) 2 audit report or approved equivalent sets the minimum level of a third-party audit. (Submitted: Jan 28, 2016 5:48:58 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 317
question based on previous comment:

Microsoft respectfully requests that this entire section be struck and not apply. Neither Microsoft nor, we believe, any similarly situated provider of standardized cloud services at mass scale, can reasonably be expected to customize their procedures and processes for such notification for any individual customers.

That said, Microsoft strives to provide as much advance notice as possible of changes (both major and minor) to its services, and in most if not all cases will provide at least 12 months advance notice of any changes expected to have significant impact to its customers.

Finally, regarding updates and upgrades, Microsoft does not charge extra for new and updated features added to any given subscription-licensed â€œplanâ€ for its Online Service. However, Microsoft may reasonably choose to create new license plans in order to monetize new features and functionality (Submitted: Jan 28, 2016 5:50:15 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 361
#15..
- 692 -
customize their procedures and processes for such notification for any individual customers.

Finally, regarding updates and upgrades, Microsoft does not charge extra for new and updated features added to any given subscription-licensed â€œplanâ€ for its Online Service. However, Microsoft may reasonably choose to create new license plans in order to monetize new features and functionality (Submitted: Jan 28, 2016 5:50:15 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 318
Unduly Restrictive
The following two questions are based on the following:

Exhibit 1 to Attachment A, Section 13
Also, Exhibit 2 to Attachment A, Section 13
Also, Exhibit 3 to Attachment A, Section 13 Security: As requested by a Purchasing Entity, the Contractor shall disclose its non-proprietary system security plans (SSP) or security processes and technical limitations to the Purchasing Entity such that adequate protection and flexibility can be attained between the Purchasing Entity and the Contractor. For example: virus checking and port sniffing â€” the Purchasing Entity and the Contractor shall understand each otherâ€™s roles and responsibilities. (Submitted: Jan 28, 2016 5:52:02 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 319
RFP, p. 25, #6.3 â€“ Financials - Your response to providing links as as a response to this section was â€œLinks are acceptableâ€ . Can we also provide links as responses to details requested on other sections of the RFP like SLAâ€™s, product offerings and other sections? A lot of the requested information is available on our public website and where appropriate we would like to refer to these publicly available links as out response. (Submitted: Jan 28, 2016 5:52:24 PM MST) Answer
- An exception is given to financials because it is mandatory requirement and evaluators will not be given that information.

For other criteria evaluators, who may print off a hard copy of a proposal, need to be able to read the information without visiting a website. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 320
part 1:

Microsoft proposes the following alternative language, which is also found in the Microsoft Online Services Terms (OST) and applies exclusively to the Microsoft Services included in the Data Processing Terms, or DPT, Section of the OST. Those DPT-included services include Microsoft Office 365 Services, Dynamics CRM Online Services, Microsoft Azure Core Services, and Microsoft Intune Online Services (each, as defined in the DPT). Proposed language follows:
â€œOnline Services Information Security Policy
â€œEach Online Service follows a written data security policy (â€œInformation Security Policyâ€ ) that complies with the control standards and frameworks shown in the table below.

Microsoft may add industry or government standards at any time. Microsoft will not eliminate a standard or framework in the table above, unless it is no longer used in the industry and it is replaced with a successor (if any). Azure Government Services meet a separate set of control standards and frameworks, as detailed on the Microsoft Azure Trust Center (Submitted: Jan 28, 2016 5:52:50 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 321
part 2:

Subject to non-disclosure obligations, Microsoft will make each Information Security Policy available to Customer, along with other information reasonably requested by Customer regarding Microsoft security practices and policies.

Customer is solely responsible for reviewing each Information Security Policy and making an independent determination as to whether it meets Customerâ€™s requirements. (Submitted: Jan 28, 2016 5:53:16 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 322
Unduly Restrictive
The following questions (labeled parts) are based on the following:

Exhibit 1 to Attachment A, Section 14
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 362
#15..
- 693 -
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 322
Unduly Restrictive
The following questions (labeled parts) are based on the following:

Exhibit 1 to Attachment A, Section 14
Also, Exhibit 2 to Attachment A, Section 14
Also, Exhibit 3 to Attachment A, Section 14 Non-disclosure and Separation of Duties: The Contractor shall enforce separation of job duties, require commercially reasonable non-disclosure agreements, and limit staff knowledge of Purchasing Entity data to that which is absolutely necessary to perform job duties. (Submitted: Jan 28, 2016 5:54:39

PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 323
Part 1:

Microsoft respectfully takes exception to this requirement, as written, and requests that its own language apply, to the extent that it more accurately describes Microsoftâ€™s commitments, which are applied uniformly for its standardized multitenant cloud services.

For this, Microsoft calls attention to the following statements (relevant to the subject matter of these RFP Sections) from the Data Processing Terms (DPT) section of the Microsoft Online Services Terms (OST), which apply solely to those Microsoft Online Services Products listed in the DPT, and which Microsoft is willing to use for these RFP Exhibit Sections, in lieu of the original RFP Language:

Security Ownership. Microsoft has appointed one or more security officers responsible for coordinating and monitoring the security rules and procedures. (Submitted: Jan 28, 2016 5:55:09 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 324
part 2:

Security Roles and Responsibilities. Microsoft personnel with access to Customer Data are subject to confidentiality obligations.

Security Training. Microsoft informs its personnel about relevant security procedures and their respective roles.

Microsoft also informs its personnel of possible consequences of breaching the security rules and procedures.

Microsoft will only use anonymous data in training.

Physical Access to Facilities. Microsoft limits access to facilities where information systems that process Customer Data are located to identified authorized individuals.

Physical Access to Components. Microsoft maintains records of the incoming and outgoing media containing Customer Data, including the kind of media, the authorized sender/recipients, date and time, the number of media and the types of Customer Data they contain.

Operational Policy. Microsoft maintains security documents describing its security measures and the relevant procedures and responsibilities of its personnel who have access to Customer Data. (Submitted: Jan 28, 2016 5:55:37 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 325
part 3:

Access Policy. Microsoft maintains a record of security privileges of individuals having access to Customer Data.

Access Authorization
- Microsoft maintains and updates a record of personnel authorized to access Microsoft systems that contain Customer Data.
- Microsoft deactivates authentication credentials that have not been used for a period of time not to exceed six months.
- Microsoft identifies those personnel who may grant, alter or cancel authorized access to data and resources. - Microsoft ensures that where more than one individual has access to systems containing Customer Data, the individuals have separate identifiers/log-ins.

Least Privilege
- Technical support personnel are only permitted to have access to Customer Data when needed. - Microsoft restricts access to Customer Data to only those individuals who require such access to perform their job function.

Integrity and Confidentiality
- Microsoft instructs Microsoft personnel to disable administrative sessions when leaving premises Microsoft controls or when computers are otherwise left unattended. - Microsoft stores passwords in a way that makes them unintelligible while they are in force.

Authentication (Submitted: Jan 28, 2016 5:56:18 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 363
#15..
- 694 -
job function.

Authentication (Submitted: Jan 28, 2016 5:56:18 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 326
part 4:

Microsoft stores passwords in a way that makes them unintelligible while they are in force.

Authentication
- Microsoft uses industry standard practices to identify and authenticate users who attempt to access information systems.
- Where authentication mechanisms are based on passwords, Microsoft requires that the passwords are renewed regularly.
- Where authentication mechanisms are based on passwords, Microsoft requires the password to be at least eight characters long.
- Microsoft ensures that de-activated or expired identifiers are not granted to other individuals. - Microsoft monitors, or enables Customer to monitor, repeated attempts to gain access to the information system using an invalid password.
- Microsoft maintains industry standard procedures to deactivate passwords that have been corrupted or inadvertently disclosed. (Submitted: Jan 28, 2016 5:57:04 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 327
part 5:

Microsoft uses industry standard password protection practices, including practices designed to maintain the confidentiality and integrity of passwords when they are assigned and distributed, and during storage.

Network Design. Microsoft has controls to avoid individuals assuming access rights they have not been assigned to gain access to Customer Data they are not authorized to access. (Submitted: Jan 28, 2016 5:57:34 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 328
Unduly Restrictive:

The following question is based on the following (per the max letter count):

Exhibit 1 to Attachment A, Section 15
Also, Exhibit 2 to Attachment A, Section 15
Also, Exhibit 3 to Attachment A, Section 15 Import and Export of Data: The Purchasing Entity shall have the ability to import or export data in piecemeal or in entirety at its discretion without interference from the Contractor at any time during the term of Contractorâ€™s contract with the Purchasing Entity. This includes the ability for the Purchasing Entity to import or export data to/from other Contractors. Contractor shall specify if Purchasing Entity is required to provide itsâ€™ own tools for this purpose, including the optional purchase of Contractors tools if Contractors applications are not able to provide this functionality directly. (Submitted: Jan 28, 2016 6:00:28 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 329
question:

Microsoft respectfully takes exception to this clause, as written, for the following reasons:
(a) It does not take into account the diversity of Online Services that Microsoft has to offer, each of which uses Customer Data in different forms and for different purposes. For example, it is reasonable to expect that a Purchasing Entityâ€™s administrator be able to extract emails, calendar entries and attachments thereto. But for an Online Service whose function it is to remotely install software uploaded to it by administrators, it is also reasonable for the service provider to assume that the Administrator has, himself or herself, retained a copy of the software program, and therefore does not need to be able to extract it from the Online Service. (b) It is also reasonable for a service provider to apply a time limit to the amount of time a Purchasing Entity has to extract its data (if applicable), following the expiration or termination of a subscription order for that service, even if the contract remains in effect for purposes of ordering other products. And (c) It is unreasonable to expect a service provider to export data in whatever form a Purchasing Entity wants, including in a format for export to a different service providerâ€™s product.

For additional information about how data is extracted, please refer to our Exceptions and Clarifying Statements above for RFP Section 8.7, as well as for the Sections of these Exhibits titled â€œtermination and Suspension of Services.â€ (Submitted: Jan 28, 2016 6:01:26 PM MST)
Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 364
#15..
- 695 -
6 extract its data (if applicable), following the expiration or termination of a subscription order for that service, even if the contract remains in effect for purposes of ordering other products. And (c) It is unreasonable to expect a service provider to export data in whatever form a Purchasing Entity wants, including in a format for export to a different service providerâ€™s product.

Exhibit 1 to Attachment A, Section 16
Also, Exhibit 2 to Attachment A, Section 16
Also, Exhibit 2 to Attachment A, Section 16 Responsibilities and Uptime Guarantee: The Contractor shall be responsible for the acquisition and operation of all hardware, software and network support related to the services being provided. The technical and professional activities required for establishing, managing and maintaining the environments are the responsibilities of the Contractor. The system shall be available 24/7/365 (with agreed-upon maintenance downtime), and provide service to customers as defined in the SLA.

With the following exception, Microsoft agrees to this language.

Microsoft respectfully takes exception to the parenthetical phrase pertaining to agreed-upon maintenance downtime, and asks that it be struck. As the provider of standardized multitenant services to many thousands of customers, Microsoft must reasonably be able to schedule downtime (which may apply to all Microsoftâ€™s customers simultaneously) without subjecting its scheduling to the approval of any single customer. (Submitted:

Jan 28, 2016 6:02:12 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 331
Unduly Restrictive
The following questions labeled parts, are based on the following:

Exhibit 1 to Attachment A, Section 19
Also, Exhibit 2 to Attachment A, Section 18 Business Continuity and Disaster Recovery: The Contractor shall provide a business continuity and disaster recovery plan upon request and ensure that the Purchasing Entityâ€™s recovery time objective (RTO) of XXX hours/days is met. (XXX hour/days shall be provided to Contractor by the Purchasing Entity.) Contractor must work with the Purchasing Entity to perform an annual Disaster Recovery test and take action to correct any issues detected during the test in a time frame mutually agreed between the Contractor and the Purchasing Entity. (Submitted: Jan 28, 2016 6:03:22 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 332
Part 1:

Microsoft does not guarantee an RTO. Please refer to Microsoftâ€™s Service Level Agreement (provided with Offerorâ€™s proposal) for the extent of Microsoftâ€™s guarantee of uptime performance, including service credits for failure to meet the requirements of the SLA.

Microsoft performs its own tests, not in conjunction with any single customer from among the thousands of customers of its standardized multitenant cloud service. 5 customers of its standardized multitenant cloud service.

Microsoft respectfully declines to agree to the language of this section, as written, but is willing to make the following contractual guarantees in lieu thereof, solely for the Microsoft Online Services identified as in scope for the Data Processing Terms (DPT) section of the Microsoft Online Services Terms (OST), which include Microsoft Office 365 Services, Microsoft Azure Core Services, Dynamics CRM Online Services, and Microsoft Intune Service:

Part 1: Data retention:

Customer Data will be processed and retained intact for the duration of Customerâ€™s subscription (including data retention period defined in the Online Services Terms document) as described in applicable Online Services documentation published by Microsoft. Processing will be, in accordance with Customer instructions provided in this enrollment and provided through end user and administrator actions and inactions during the use of the services (Submitted: Jan 28, 2016 6:03:56 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 333
Part 2:

Microsoft has specific procedures in place governing access to copies of Customer Data State of Utah Bid CH16012
3/22/2016 4:23 PM p. 365
#15..
- 696 -
Part 2:

Part 2: Data Recovery Procedures:
- On an ongoing basis, but in no case less frequently than once a week (unless no Customer Data has been updated during that period), Microsoft maintains multiple copies of Customer Data from which Customer Data can be recovered.
- Microsoft stores copies of Customer Data and data recovery procedures in a different place from where the primary computer equipment processing the Customer Data is located. - Microsoft has specific procedures in place governing access to copies of Customer Data. - Microsoft reviews data recovery procedures at least every six months. - Microsoft logs data restoration efforts, including the person responsible, the description of the restored data and where applicable, the person responsible and which data (if any) had to be input manually in the data recovery process.
- In the event such Customer Data restoration activities are conducted and upon subsequent Customer request, Microsoft will make the forgoing information from such logs available to the State, provided that: i) information will be provided only where it can be extracted from system wide logging with commercially reasonable efforts; ii) Microsoft shall not be subject to an urgent timeframe for completion of the request (except as may be required by applicable law); and iii) any information in such logs which pertains to other Microsoft customers and their data, or would compromise the security of the Office 365 Services, will be withheld. For clarity, â€œdata restoration effortsâ€ does not include automated Customer Data recovery processes such as when one of Microsoftâ€™s datacenters is activated upon failure of another. (Submitted: Jan 28, 2016 6:04:47 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 334
Unduly Restrictive:

Exhibit 1 to Attachment A, Section 20
Also, Exhibit 2 to Attachment A, Section 19 Compliance with Accessibility Standards: The Contractor shall comply with and adhere to Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973, or any other state laws or administrative regulations identified by the Participating Entity.

Microsoft supports governmentsâ€™ obligations to provide accessible technologies to its citizens with disabilities as required by Section 508 of the Rehabilitation Act of 1973, and its state law counterparts. We encourage our customers to judiciously compare product accessibility performance.

The Voluntary Product Accessibility Templates (â€œVPATsâ€ ) for the Microsoft technologies used in providing the online services can be found at Microsoftâ€™s VPAT page. Further information regarding Microsoftâ€™s commitment to accessibility can be found at www.microsoft.com/enable.

However, Microsoft respectfully takes exception to this statement as written, to the extent that Microsoft asserts that it is its customersâ€™ obligation to comply with such accessibility provisions, although Microsoft is committed to aiding its customersâ€™ compliance. Additionally, Section 508 is written to apply to Federal government agencies which use software, not to the manufacturers thereof. In the event that a prospective Participating State has a specific statute that is written to apply to the manufacturer (rather than to each government agency), Microsoft will engage in discussion with the applicable Participating State to determine whether that Stateâ€™s needs may be met. (Submitted: Jan 28, 2016 6:05:55 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 335
â€œSupport at no additional costâ€ as required in the RFP section 5.5.11 is generally quite limited in the marketplace for the offerings that are requested within this RFP.

Furthermore, â€œno-cost supportâ€ is not necessarily always applicable to the entire breadth and depth of products/services requested within this RFP . Generally, enterprises and organizations opt for an â€œadvancedâ€ level of support to meet their required SLAâ€™s for such offerings.

Is the State willing to accept loaded costs inclusive of â€œadvancedâ€ support levels? Or, would the State prefer that the support-costs are listed as a required, separate line item? (Submitted: Jan 28, 2016 6:06:24 PM MST) Answer
- The state has modified 5.5.11 to state that all "general support shall be provided at no additional costs..." The State prefer that the support-costs are listed as a required, separate line item. (Answered: Jan 29, 2016 1:48:33

PM MST)
Question 336
Unduly Restrictive:

Exhibit 1 to Attachment A, Section 22 Encryption of Data at Rest: The Contractor shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data, unless the Purchasing Entity approves in writing for the storage of Personal Data on a Contractor portable device in order to accomplish work as defined in the statement of work Microsoft respectfully takes exception to this clause, as written, and requests to substitute the alternative language below:
â€œTo whatever extent a form or use of encryption is required of Microsoft pursuant to any of the industry and Federal government standards committed by Microsoft in this Master Agreement and the Microsoft Online Services Terms, Microsoft will comply with such requirements.â€ Explanation:

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 366
#15..
- 697 -
Cryptographic Modules for all Personal Data, unless the Purchasing Entity approves in writing for the storage of Personal Data on a Contractor portable device in order to accomplish work as defined in the statement of work Microsoft respectfully takes exception to this clause, as written, and requests to substitute the alternative language below:
â€œTo whatever extent a form or use of encryption is required of Microsoft pursuant to any of the industry and Federal government standards committed by Microsoft in this Master Agreement and the Microsoft Online Services Terms, Microsoft will comply with such requirements.â€ Explanation:

For the primary Online Services offeror intends to sell under the Master Agreement and which store or process Customer Data at rest (which are those Online Services Microsoft lists in the Data Processing Terms <DPT> of the Microsoft Online Services Terms <OST>) Microsoft is committed to comply with the industry standards (and, in the case of our Government Community Cloud services, the government services) that have been cited in Offerorâ€™s proposed alternative contract language, above in this document (and in the OST). Not all forms of data need to be encrypted in order to meet those industry and government standards, but to the extent they do then that data will be encrypted, using whatever standards (whether FIPS 140-2 or other) that are set forth in those standards. To the extent the Encryption requirements of those standards change over time, so will Microsoftâ€™s use of encryption technology. (Submitted: Jan 28, 2016 6:06:39 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:33 PM MST) Question 337
Unduly Restrictive:

Exhibit 1 to Attachment A, Section 23
Also, Exhibit 2 to Attachment A, Section 22
Also, Exhibit 3 to Attachment A, Section 19 Subscription Terms: Contractor grants to a Purchasing Entity a license to: (i) access and use the Service for its business purposes; (ii) for SaaS <Exhibit 1> PaaS <Exhibit 2> IaaS <Exhibit 3>, use underlying software as embodied or used in the Service; and (iii) view, copy, upload and download (where applicable), and use Contractorâ€™s documentation.

No Contractor terms, including standard click through license or website terms or use of privacy policy, shall apply to Purchasing Entities unless such terms are included in this Master Agreement.

Microsoft respectfully takes exception to this Section, and asks that it be struck, to the extent that it is ambiguous and incomplete, and unreasonably conflicts with the reasonable subscription licensing terms Microsoft offers to Purchasing Entities through Offeror.

Microsoftâ€™s license grant to Each Offeror/Contractor (which is passed through to Purchasing Entities) is based upon the quantity and duration of subscription licenses for which orders are placed. The terms of use of such licenses are included in the Microsoft Online Services Terms, which is incorporated into the contract.

As for documentation, that is limited to what Microsoft makes available to all its customers of the same services.

In most cases, that consists of webpages, not all of which may be formatted suitably for printing, although nothing in Microsoftâ€™s terms of use of those websites prohibits end users or administrators from printing the documentation.

Finally, as it pertains to click-through terms, please see the Exception and Clarifying Statement for RFP Section

5.5.14, above in this document. (Submitted: Jan 28, 2016 6:07:34 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

This information should be included in Microsoft's redline version of the Terms and Conditions. The State cannot modify the Master Agreement Terms and Conditions for every Offeror as proposed. (Answered: Jan 29, 2016 1:48:33

PM MST)
Question 338
Unduly Restrictive:

The following questions labeled Parts are based on the following:

Exhibit 2 to Attachment A, Section 8
Also, Exhibit 3 to Attachment A, Section 8 Background Checks:
a. Upon the request of the Purchasing Entity, the Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Master Agreement who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or misdemeanor offense for which incarceration for up to 1 year is an authorized penalty. The Contractor shall promote and maintain an awareness of the importance of securing the Purchasing Entityâ€™s information among the Contractorâ€™s employees and agents.
b. The Contractor and the Purchasing Entity recognize that security responsibilities are shared. The Contractor is responsible for providing a secure infrastructure. The Purchasing Entity is responsible for its secure guest operating system, firewalls and other logs captured within the guest operating system. Specific shared responsibilities are identified within the SLA.
c. If any of the stated personnel providing services under a Participating Addendum is not acceptable to the Purchasing Entity in its sole opinion as a result of the background or criminal history investigation, the Purchasing Entity, in itsâ€™ sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate the Participating Addendum and any related service agreement. (Submitted: Jan 28, 2016 6:12:25 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 367
#15..
- 698 -
responsibilities are identified within the SLA.
c. If any of the stated personnel providing services under a Participating Addendum is not acceptable to the Purchasing Entity in its sole opinion as a result of the background or criminal history investigation, the Purchasing Entity, in itsâ€™ sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate the Participating Addendum and any related service agreement. (Submitted: Jan 28, 2016 6:12:25 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 339
Part 1:

Exception and Clarifying Statement
Microsoft provides standardized multitenant Online Services that reasonably cannot be customized for any one of its many thousands of customers. Additionally, Microsoftâ€™s SLA does not pertain to security logs and reports.

Microsoft shall allow Purchasing Entities reasonable self-service access to security information, latency data, and other related SaaS security data that affect this Contract and the Purchasing Entityâ€™s Data, at no cost to the Purchasing Entity. The parties recognize that the type of self-service access and security data made available to Purchasing Entities may be subject to change (Submitted: Jan 28, 2016 6:14:34 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 342
Unduly Restrictive:

The following questions (parts) are based on the following:

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 368
#15..
- 699 -
This information should be included in Microsoft's redline version of the Terms and Conditions. The State cannot modify the Master Agreement Terms and Conditions for every Offeror as proposed. (Answered: Jan 29, 2016 1:48:32

PM MST)
Question 342
Unduly Restrictive:

The following questions (parts) are based on the following:

Exhibit 2 to Attachment A, Section 8 Background Checks:
a. Upon the request of the Purchasing Entity, the Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Master Agreement who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or misdemeanor offense for which incarceration for up to 1 year is an authorized penalty. The Contractor shall promote and maintain an awareness of the importance of securing the Purchasing Entityâ€™s information among the Contractorâ€™s employees and agents.
b. The Contractor and the Purchasing Entity recognize that security responsibilities are shared. The Contractor is responsible for providing a secure infrastructure. The Purchasing Entity is responsible for its secure guest operating system, firewalls and other logs captured within the guest operating system. Specific shared responsibilities are identified within the SLA.
c. If any of the stated personnel providing services under a Participating Addendum is not acceptable to the Purchasing Entity in its sole opinion as a result of the background or criminal history investigation, the Purchasing Entity, in itsâ€™ sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate the Participating Addendum and any related service agreement. (Submitted: Jan 28, 2016 6:15:45 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 343
Part 1:

Microsoft has observed that this clause differs from Section 8 in Exhibit 1 to Attachment A to the extent that paragraph b. was added. Microsoft agrees that the security for both PaaS and IaaS are shared responsibilities.

However, specifically as it applies to background checks of Microsoft personnel operating Microsoftâ€™s PaaS and IaaS Services, there is no difference from the checks performed on our SaaS personnel.

PM MST)
Question 344
Part 2:

PM MST)
Question 345
Unduly Restrictive:

The following questions (parts) are based on the following:

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 369
#15..
- 700 -
This information should be included in Microsoft's redline version of the Terms and Conditions. The State cannot modify the Master Agreement Terms and Conditions for every Offeror as proposed. (Answered: Jan 29, 2016 1:48:32

PM MST)
Question 345
Unduly Restrictive:

The following questions (parts) are based on the following:

Exhibit 2 to Attachment A, Section 9 Access to Security Logs and Reports:
a. The Contractor shall provide reports on a schedule specified in the SLA to the Purchasing Entity in a format as specified in the SLA and agreed to by both the Contractor and the Purchasing Entity. Reports will include latency statistics, user access, user access IP address, user access history and security logs for all Purchasing Entity files related to the Master Agreement, Participating Addendum, or SLA. b. The Contractor and the Purchasing Entity recognize that security responsibilities are shared. The Contractor is responsible for providing a secure infrastructure. The Purchasing Entity is responsible for its secure guest operating system, firewalls and other logs captured within the guest operating system. Specific shared responsibilities are identified within the SLA. (Submitted: Jan 28, 2016 6:18:03 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 346
Part 1)
Microsoft has observed that this clause differs from Section 9 in Exhibit 1 to Attachment A to the extent that paragraph b. was added. Microsoft agrees that the security for both PaaS and IaaS are shared responsibilities.

However, specifically as it applies to access to Microsoftâ€™s security logs and reports for Microsoftâ€™s PaaS and IaaS Services, there is no difference from the logs and reports for our SaaS products.

PM MST)
Question 347
Part 2:

Microsoft shall allow Purchasing Entities reasonable self-service access to security information, latency data, and other related SaaS security data that affect this Contract and the Purchasing Entityâ€™s Data, at no cost to the Purchasing Entity. The parties recognize that the type of self-service access and security data made available to Purchasing Entities may be subject to change.â€ (Submitted: Jan 28, 2016 6:19:04 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 348
Unduly Restrictive:

The following question is based on the following:

Exhibit 2 to Attachment A, Section 21 Encryption of Data at Rest: The Contractor shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data as identified in the SLA, unless the Contractor presents a justifiable position that is approved by the Purchasing Entity that Personal Data, is required to be stored on a Contractor State of Utah Bid CH16012
3/22/2016 4:23 PM p. 370
#15..
- 701 -
Question 348
Unduly Restrictive:

The following question is based on the following:

Exhibit 2 to Attachment A, Section 21 Encryption of Data at Rest: The Contractor shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data as identified in the SLA, unless the Contractor presents a justifiable position that is approved by the Purchasing Entity that Personal Data, is required to be stored on a Contractor portable device in order to accomplish work as defined in the scope of work. (Submitted: Jan 28, 2016 6:20:44 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 349
Microsoft respectfully takes exception to this clause, as written, and requests to substitute the alternative language below:
â€œTo whatever extent a form or use of encryption is required of Microsoft pursuant to any of the industry and Federal government standards committed by Microsoft in this Master Agreement and the Microsoft Online Services Terms, Microsoft will comply with such requirements.â€ Explanation:

Additionally, as service provider, Microsoft will not be able to consult with a Purchasing Entity or to control whether or not personal data is stored on any of its Online Services. Purchasing Entity is solely responsible for selecting what type of data it uses the Online Services for. (Submitted: Jan 28, 2016 6:21:29 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 350
Unduly Restrictive:

The following question is based on the following:

Exhibit 3 to Attachment A, Section 9 Access to Security Logs and Reports:
a. The Contractor shall provide reports on a schedule specified in the SLA to the Contractor directly related to the infrastructure that the Contractor controls upon which the Purchasing Entityâ€™s account resides. Unless otherwise agreed to in the SLA, the Contractor shall provide the public jurisdiction a history or all API calls for the Purchasing Entity account that includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters and the response elements returned by the Contractor. The report will be sufficient to enable the Purchasing Entity to perform security analysis, resource change tracking and compliance auditing
b. The Contractor and the Purchasing Entity recognize that security responsibilities are shared. The Contractor is responsible for providing a secure infrastructure. The Purchasing Entity is responsible for its secure guest operating system, firewalls and other logs captured within the guest operating system. Specific shared responsibilities are identified within the SLA. (Submitted: Jan 28, 2016 6:23:34 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 351
Part 1 of question:

Microsoft has observed that this clause differs from Section 9 in Exhibit 2 to Attachment A to the extent that it includes technical requirements pertaining to API calls. However, specifically as it applies to access to Microsoftâ€™s security logs and reports for Microsoftâ€™s PaaS and IaaS Services, there is no difference from the logs and reports for our SaaS products. Additionally, Microsoft cannot make contractual statements pertaining to this level of functionality (e.g. API calls) with respect to its IaaS product line, overall, but upon request may provide technical information requested by Lead State or any Participating State or Purchasing Entity, although it State of Utah Bid CH16012
3/22/2016 4:23 PM p. 371
#15..
- 702 -
Question 351
Part 1 of question:

Microsoft has observed that this clause differs from Section 9 in Exhibit 2 to Attachment A to the extent that it includes technical requirements pertaining to API calls. However, specifically as it applies to access to Microsoftâ€™s security logs and reports for Microsoftâ€™s PaaS and IaaS Services, there is no difference from the logs and reports for our SaaS products. Additionally, Microsoft cannot make contractual statements pertaining to this level of functionality (e.g. API calls) with respect to its IaaS product line, overall, but upon request may provide technical information requested by Lead State or any Participating State or Purchasing Entity, although it should be noted that functionality evolves over time.

Microsoft provides standardized multitenant Online Services that reasonably cannot be customized for any one of its many thousands of customers. Additionally, Microsoftâ€™s SLA does not pertain to security logs and reports. (Submitted: Jan 28, 2016 6:24:35 PM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 352
Part 2 of question:

Microsoft shall allow Purchasing Entities reasonable self-service access to security information, latency data, and other related SaaS security data that affect this Contract and the Purchasing Entityâ€™s Data, at no cost to the Purchasing Entity. The parties recognize that the type of self-service access and security data made available to Purchasing Entities may be subject to change.â€ (Submitted: Jan 28, 2016 6:25:16 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 353
Unduly Restrictive:

The next question is based on the following:

Exhibit 3 to Attachment A, Section 11 11. Data Center Audit: The Contractor shall perform an independent audit of its data centers at least annually and at its own expense, and provide an unredacted version of the audit report upon request. The Contractor may remove its proprietary information from the unredacted version. For example, a Service Organization Control (SOC) 2 audit report would be sufficient. (Submitted: Jan 28, 2016 6:27:08 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 354
Question:

Microsoft respectfully requests to substitute its own language, in lieu of the RFP language as written, to the extent that it more accurately describes Microsoftâ€™s standard processes and procedures. That language is also found in the Microsoft Online Services Terms (although with references to â€œCustomerâ€ rather than â€œPurchasing Entityâ€ ), and is thereby incorporated by reference, and is as follows:
â€œMicrosoft Audits of Online Services
For each Online Service, Microsoft will conduct audits of the security of the computers, computing environment and physical data centers that it uses in processing Customer Data (including personal data), as follows:
â€¢ â€œWhere a standard or framework provides for audits, an audit of such control standard or framework will be initiated at least annually for each Online Service. â€¢ â€œEach audit will be performed according to the standards and rules of the regulatory or accreditation body for each applicable control standard or framework.
â€¢ â€œEach audit will be performed by qualified, independent, third party security auditors at Microsoftâ€™s State of Utah Bid CH16012
3/22/2016 4:23 PM p. 372
#15..
- 703 -
â€œMicrosoft Audits of Online Services
For each Online Service, Microsoft will conduct audits of the security of the computers, computing environment and physical data centers that it uses in processing Customer Data (including personal data), as follows:
â€¢ â€œWhere a standard or framework provides for audits, an audit of such control standard or framework will be initiated at least annually for each Online Service. â€¢ â€œEach audit will be performed according to the standards and rules of the regulatory or accreditation body for each applicable control standard or framework.
â€¢ â€œEach audit will be performed by qualified, independent, third party security auditors at Microsoftâ€™s selection and expense.
â€œEach audit will result in the generation of an audit report (â€œMicrosoft Audit Reportâ€ ), which will be Microsoftâ€™s Confidential Information. The Microsoft Audit Report will clearly disclose any material findings by the auditor. Microsoft will promptly remediate issues raised in any Microsoft Audit Report to the satisfaction of the auditor.

If a Purchasing Entity requests, Microsoft will provide the Purchasing Entity with each Microsoft Audit Report so that Purchasing Entity can verify Microsoftâ€™s compliance with the security obligations under the Data Processing Terms (DPT) section of the Microsoft Online Services Terms. The Microsoft Audit Report will be subject to nondisclosure and distribution limitations of Microsoft and the auditor.â€ (Submitted: Jan 28, 2016 6:27:42 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 355
Unduly Restrictive:

Attachments C and D <See the attachments> Please see the Exception and Clarifying Statement for RFP Sections 5.5.9 and 5,6,1, in our previous questions.. (Submitted: Jan 28, 2016 6:28:54 PM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 356
Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions; 13. Indemnification (a); p 52 The Contractor shall defend, indemnify and hold harmless NASPO, NASPO ValuePoint, the Lead State, Participating Entities, and Purchasing Entities, along with their officers, agents, and employees as well as any person or entity for which they may be liable, from and against claims, damages or causes of action including reasonable
attorneysâ€™ fees and related costs for any death, injury, or damage to property arising directly from act(s), error (s), or omission(s) of the Contractor, its employees or subcontractors or volunteers, at any tier, relating to the performance under the Master Agreement.

Offeror requests to remove â€œindirectlyâ€ . Offeror will indemnify for damages/claims that are directly caused by us and our subs, employees, etc but not those that are far removed that we should not be responsible for. (Submitted: Jan 29, 2016 4:29:15 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 357
ValuePoint Master Agreement Terms and Conditions; 16. Insurance (b)(2) CLOUD MINIMUM INSURANCE; p 53 â€œ(2) Contractor shall ensure the cloud providers carry the below CLOUD MINIMUM INSURANCE COVERAGE:
â€¦â€
Offeror is a reseller of the cloud products, not the provider. As such, we donâ€™t control the data centers and donâ€™t carry this insurance. IS it acceptable that we will ensure the providers we contract with carry this insurance and request to have the language reflect that? (Submitted: Jan 29, 2016 4:31:30 AM MST) Answer
- The awarded contractor should have this insurance. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 358
We offer a managed service offering designed to solve the problem of managing a collection of physical and virtual servers and systemsâ€”some in-house, others run by third-party vendors and cloud service providers. This managed service is based on a platform that enables governance over an assemblage of varied internal and external IT service providers, and establishes service efficiencies by providing a single view of an organizationâ€™s IT spending, service performance, operational configurations, and security posture regardless of where their workload is hosted. While this type of service can be critical to the success of any organization moving workload to the cloud, it does not fit neatly in any of the NIST service models. Would the State consider the inclusion of such a service in our proposal response and, if so, how should it be represented? (Submitted: Jan 29, State of Utah Bid CH16012
3/22/2016 4:23 PM p. 373
#15..
- 704 -
We offer a managed service offering designed to solve the problem of managing a collection of physical and virtual servers and systemsâ€”some in-house, others run by third-party vendors and cloud service providers. This managed service is based on a platform that enables governance over an assemblage of varied internal and external IT service providers, and establishes service efficiencies by providing a single view of an organizationâ€™s IT spending, service performance, operational configurations, and security posture regardless of where their workload is hosted. While this type of service can be critical to the success of any organization moving workload to the cloud, it does not fit neatly in any of the NIST service models. Would the State consider the inclusion of such a service in our proposal response and, if so, how should it be represented? (Submitted: Jan 29, 2016 5:00:13 AM MST)
Answer
- An Offeror must present the solution as part of its response and the evaluation committee will decide whether it complies with the requirements and receives the minimum point threshold required by this RFP. (Answered: Jan 29, 2016 1:48:32 PM MST)
Question 359
The following questions (titled by PT) is based on the following within the RFP:

Attachment A, Section 22 Data Access Controls: Contractor will provide access to Purchasing Entityâ€™s Data only to those Contractor employees, contractors and subcontractors (â€œContractor Staffâ€ ) who need to access the Data to fulfill Contractorâ€™s obligations under this Agreement. Contractor shall not access a Purchasing Entityâ€™s user accounts or Data, except on the course of data center operations, response to service or technical issues, as required by the express terms of this Master Agreement, or at a Purchasing Entityâ€™s written request.

Contractor may not share a Purchasing Entityâ€™s Data with its parent corporation, other affiliates, or any other third party without the Purchasing Entityâ€™s express written consent.

Contractor will ensure that, prior to being granted access to the Data, Contractor Staff who perform work under this Agreement have successfully completed annual instruction of a nature sufficient to enable them to effectively comply with all Data protection provisions of this Agreement; and possess all qualifications appropriate to the nature of the employeesâ€™ duties and the sensitivity of the Data they will be handling. (Submitted: Jan 29, 2016 5:37:55 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 360
PT Part 1:

Microsoft, as subcontractor to Offeror, will be the provider of the cloud services sold under the Master Agreement.

As such, Microsoft personnel (including in some cases Microsoftâ€™s subcontractors) may from time to time access Customer Data, as necessary for the operation and maintenance of the service, and for purposes of providing support. The Microsoft Online Services Terms (OST) which are incorporated by reference, including robust protective terms which assure Purchasing Entities that their Customer Data will be protected, and that access will be restricted to only those personnel with need for such access, and only for the amount of time necessary. There are many more protective terms pertaining to data access in the OST (found at www.microsoft.com/contracts, and the latest copy of which will be included with the Proposal). We encourage NASPO to review these terms, including but not limited to the section titled â€œSecurityâ€ beginning on page 11 thereof. (Submitted: Jan 29, 2016 5:39:25 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 361
PT part 2:

Additionally, as set forth in the OST (see the section titled â€œDisclosure of Customer Dataâ€ on page 7), Microsoft may disclose Customer Data to law enforcement, but only when and if required by law. If law enforcement contacts Microsoft with a demand for Customer Data, Microsoft will attempt to redirect the law enforcement agency to request that data directly from Customer. If compelled to disclose Customer Data to law enforcement, Microsoft will promptly notify Customer and provide a copy of the demand unless legally prohibited from doing so.

Upon receipt of any other third party request for Customer Data, Microsoft will promptly notify Customer unless prohibited by law. Microsoft will reject the request unless required by law to comply. If the request is valid, Microsoft will attempt to redirect the third party to request the data directly from Customer.

Microsoft will not provide any third party: (a) direct, indirect, blanket or unfettered access to Customer Data; (b) platform encryption keys used to secure Customer Data or the ability to break such encryption; or (c) access to Customer Data if Microsoft is aware that the data is to be used for purposes other than those stated in the third partyâ€™s request. (Submitted: Jan 29, 2016 5:40:19 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 374
#15..
- 705 -
prohibited by law. Microsoft will reject the request unless required by law to comply. If the request is valid, Microsoft will attempt to redirect the third party to request the data directly from Customer.

PM MST)
Question 362
PT part 3:

In support of the above, Microsoft may provide Customerâ€™s basic contact information to the third party.

Additionally, Microsoft informs its personnel about relevant security procedures and their respective roles.

Microsoft also informs its personnel of possible consequences of breaching the security rules and procedures.

Microsoft will only use anonymous data in training. See â€œHuman Resources Securityâ€ on page 11 of the current OST. And for those Microsoft Government Community Cloud Services for which Microsoftâ€™s CJIS assurances apply (see our Exception and Clarifying Statements to Appendix A Section 17, above in this document), personnel with access to unencrypted CJI (and other Customer Data Content) are provided training in accordance with FBI CJIS Policy. However, such training may not necessarily be annual, so to that extent neither Microsoft nor Contractor are able to accept this clause as written. We ask instead that the terms and conditions of the OST apply in lieu of this Section 22. (Submitted: Jan 29, 2016 5:40:46 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 363
Unduly Restrictive:

This question will be in several parts as it is too large per the max content allowed. Part 1 is the referenced section. The next parts will be the RFP language and the final parts will be our questions. All will be titled PT in case they do not end up in order in this Q and A period. (Submitted: Jan 29, 2016 5:43:22 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 364
PT Part 2:

Section 4) Security Incident or Data Breach Notification:
a. Incident Response: Contractor may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the contract. Discussing security incidents with the Purchasing Entity should be handled on an urgent as-needed basis, as part of Contractorâ€™s communication and mitigation processes as mutually agreed upon, defined by law or contained in the Master Agreement. b. Security Incident Reporting Requirements: The Contractor shall report a security incident to the Purchasing Entity identified contact immediately as soon as possible or promptly without out reasonable delay, or as defined in the SLA.
c. Breach Reporting Requirements: If the Contractor has actual knowledge of a confirmed data breach that affects the security of any purchasing entityâ€™s content that is subject to applicable data breach notification law, the Contractor shall (1) as soon as possible or promptly without out reasonable delay notify the Purchasing Entity, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the data breach in a timely manner. (Submitted: Jan 29, 2016 5:43:57 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 365
PT part 3:
(Section 5) Personal Data Breach Responsibilities: This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the Contractor. a. The Contractor, unless stipulated otherwise, shall immediately notify the appropriate Purchasing Entity identified contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident. b. The Contractor, unless stipulated otherwise, shall promptly notify the appropriate Purchasing Entity identified contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it has confirmed that there is, or reasonably believes that there has been a Data Breach. (Submitted: Jan 29, 2016 5:45:07

AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 366
PT part 4:

The Contractor shall (1) cooperate with the Purchasing Entity as reasonably requested by the Purchasing Entity to investigate and resolve the Data Breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary. c. Unless otherwise stipulated, if a data breach is a direct result of Contractorâ€™s breach of its contractual obligation to encrypt personal data or otherwise prevent its release as reasonably determined by the Purchasing Entity, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a tollfree number and call center for affected individuals required by federal and state laws â€” all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $217 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause. (Submitted: Jan 29, 2016 5:45:35 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 367
PT part 5:

The proposed alternative language below is the same as that proposed above in this document for the related Section 4 and 5 in Exhibits 2 and 3 to Attachment A. Because of differences in the language, we have added a few additional explanatory notes.

Microsoft follows standardized procedures for reporting Security Incidents. Those procedures are described (and contractually committed) in the Microsoft Online Services Terms (OST). Microsoft, as provider of a standardized multitenant cloud service to thousands of customers and millions of users, cannot customize these processes for any individual customer. Microsoft therefore respectfully requests that the language this Section 4 be struck, and replaced with the applicable language from the OST, as well as the language below pertaining to reimbursement of reasonable remediation costs in the event of a Security Incident involving PII.

Following are Microsoftâ€™s contractual commitments pertaining to Security Incident Notification, from the OST (note that â€œCustomerâ€ represents â€œPurchasing Entityâ€ ): (Submitted: Jan 29, 2016 5:46:06 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 368
PT part 6:

Compliance with Laws
Microsoft will comply with all laws and regulations applicable to its provision of the Online Services, including security breach notification law. However, Microsoft is not responsible for compliance with any laws or regulations applicable to Customer or Customerâ€™s industry that are not generally applicable to information technology service providers. Microsoft does not determine whether Customer Data includes information subject to any State of Utah Bid CH16012
3/22/2016 4:23 PM p. 376
#15..
- 707 -
Question 368
PT part 6:

Compliance with Laws
Microsoft will comply with all laws and regulations applicable to its provision of the Online Services, including security breach notification law. However, Microsoft is not responsible for compliance with any laws or regulations applicable to Customer or Customerâ€™s industry that are not generally applicable to information technology service providers. Microsoft does not determine whether Customer Data includes information subject to any specific law or regulation. All Security Incidents are subject to the Security Incident Notification terms below. (Submitted: Jan 29, 2016 5:46:30 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 369
PT part 7
Security Incident Notification
If Microsoft becomes aware of any unlawful access to any Customer Data stored on Microsoftâ€™s equipment or in Microsoftâ€™s facilities, or unauthorized access to such equipment or facilities resulting in loss, disclosure, or alteration of Customer Data (each a â€œSecurity Incidentâ€ ), Microsoft will promptly (1) notify Customer of the Security Incident; (2) investigate the Security Incident and provide Customer with detailed information about the Security Incident; and (3) take reasonable steps to mitigate the effects and to minimize any damage resulting from the Security Incident.

Notification(s) of Security Incidents will be delivered to one or more of Customerâ€™s administrators by any means Microsoft selects, including via email. It is Customerâ€™s sole responsibility to ensure Customerâ€™s administrators maintain accurate contact information on each applicable Online Services portal. Microsoftâ€™s obligation to report or respond to a Security Incident under this section is not an acknowledgement by Microsoft of any fault or liability with respect to the Security Incident.

Customer must notify Microsoft promptly about any possible misuse of its accounts or authentication credentials or any security incident related to an Online Service. (Submitted: Jan 29, 2016 5:46:57 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 370
PT part 8:

As an exception to the foregoing, notification of Security Incident will be delivered within 5 days after Microsoft determines that a Security Incident has occurred, provided that Purchasing Entity must comply with the following requirements:

For each Online Service Tenant or Azure subscription, as applicable, as a condition of receiving notifications within 5 days, as set forth in the preceding paragraph, the State must register the following information by sending email to [email protected], and must keep such information current at all times:
1) Purchasing Entityâ€™s Microsoft Online Direct Routing Domain (MODRD); 2) For one or more individual(s) to be contacted, each of whom must be registered as an administrator on the applicable Online Services, each of the following:
a. Name;
b. Title;
c. Email address registered as an administrator on the Online Services; d. Email address not registered as a user on the Online Services; 3) Name of Purchasing Entity;
4) Enrollment number assigned by Microsoft to represent Purchasing Entityâ€™s Tenant or Azure Subscription, on Offerorâ€™s subcontract with Microsoft. (Submitted: Jan 29, 2016 5:47:31 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 371
PT part 9:

Microsoft expects to change the above process by which the Purchasing Entity for each tenant or subscription will be able to register their MODRD and other information for five-day Security Incident notification pursuant to these terms and conditions. In the event that a Purchasing Entity is notified by Microsoft, in the administrative console or otherwise, of revised instructions necessary to ensure five-day Security Incident notification, the Purchasing Entity must comply with such revised instructions. (Submitted: Jan 29, 2016 5:48:26 AM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 377
#15..
- 708 -
Question 371
PT part 9:

Microsoft expects to change the above process by which the Purchasing Entity for each tenant or subscription will be able to register their MODRD and other information for five-day Security Incident notification pursuant to these terms and conditions. In the event that a Purchasing Entity is notified by Microsoft, in the administrative console or otherwise, of revised instructions necessary to ensure five-day Security Incident notification, the Purchasing Entity must comply with such revised instructions. (Submitted: Jan 29, 2016 5:48:26 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 372
PT part 10:

Additional language pertaining to reimbursements of costs:

To the extent that a Security Incident results from Microsoftâ€™s failure to comply with its obligations under this Master Agreement (and, where applicable, Participating Addenda), and subject to the limitations of liability set forth in Attachment A, Section 43 (Limitation of Liability), Microsoft will reimburse Purchasing Entities for reasonable out-of-pocket remediation costs incurred by such Purchasing Entities in connection with that Security Incident. â€œReasonable out-of-pocket remediation costsâ€ are costs that (a) are customary, reasonable and expected to be paid by entities similar to Purchasing Entity, based on the nature and scope of the Security Incident, and (b) do not arise from or relate to Purchasing Entityâ€™s violation of (i) laws applicable to Purchasing Entity or (ii) Purchasing Entityâ€™s obligations to third parties, and (c) in no event include costs arising related to compliance with laws applicable to Purchasing Entity or its industry or government function that are not generally applicable to information technology services providers. Purchasing Entity must document all such expenditures and, upon Microsoftâ€™s request, those expenditures must be validated by an independent, internationally-recognized third party industry expert chosen by both parties. For avoidance of doubt, the costs reimbursed by Microsoft under this paragraph will be characterized as direct damages subject to the limitation on liability set forth in this Section, and not as special damages excluded under the â€œEXCLUSION OF CERTAIN DAMAGESâ€ in Attachment A, Section 43 (Limitation of Liability). (Submitted: Jan 29, 2016 5:48:50 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 373
Unduly Restrictive:

The following question will be presented relating to section Exhibit 2 to Attachment A, Sections 4 and 5
The RFP language will be first listed and named PT Part 1,2, etc and then the questions will follow in sequential part numbers. (Submitted: Jan 29, 2016 5:58:52 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 374
Part 1:

Section 4) Security Incident or Data Breach Notification: The Contractor shall inform the Purchasing Entity of any security incident or data breach within the possession and control of the Contractor and related to the service provided under the Master Agreement, Participating Addendum, or SLA. Such notice shall include, to the best of Contractorâ€™s knowledge at that time, the persons affected, their identities, and the Confidential Information and Data disclosed, or shall include if this information is unknown. a. Incident Response: The Contractor may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the Master Agreement, Participating Addendum, or SLA.

Discussing security incidents with the Purchasing Entity should be handled on an urgent as-needed basis, as part of Contractorâ€™s communication and mitigation processes as mutually agreed, defined by law or contained in the Master Agreement, Participating Addendum, or SLA. b. Security Incident Reporting Requirements: Unless otherwise stipulated, the Contractor shall immediately report a security incident related to its service under the Master Agreement, Participating Addendum, or SLA to the appropriate Purchasing Entity (Submitted: Jan 29, 2016 5:59:17 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 378
#15..
- 709 -
part of Contractorâ€s communication and mitigation processes as mutually agreed, defined by law or contained in the Master Agreement, Participating Addendum, or SLA. b. Security Incident Reporting Requirements: Unless otherwise stipulated, the Contractor shall immediately report a security incident related to its service under the Master Agreement, Participating Addendum, or SLA to the appropriate Purchasing Entity (Submitted: Jan 29, 2016 5:59:17 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 375
Part 2:
(Section 5) 5. Breach Responsibilities: This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the Contractor. a. The Contractor, unless stipulated otherwise, shall immediately notify the appropriate Purchasing Entity identified contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident. b. The Contractor, unless stipulated otherwise, shall promptly notify the appropriate Purchasing Entity identified contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it has confirmed that there is, or reasonably believes that there has been a data breach. (Submitted: Jan 29, 2016 6:00:16

AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 376
Part 3:

The Contractor shall (1) cooperate with the Purchasing Entity as reasonably requested by the Purchasing Entity to investigate and resolve the data breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the data breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary. c. Unless otherwise stipulated, if a Data Breach is a direct result of Contractorâ€™s breach of its contractual obligation to encrypt Personal Data or otherwise prevent its release, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a toll-free number and call center for affected individuals required by federal and state laws â€” all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $217 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause. (Submitted: Jan 29, 2016 6:00:38 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 377
Part 4:

The proposed alternative language below is the same as that proposed above in this document for the related Section 4 and 5 in Exhibits 1 and 3 to Attachment A. Because of differences in the language, we have added a few additional explanatory notes.

Microsoft does not keep track of the identities of individuals whose PII a Purchasing Entity may choose to store on our Online Services, so it must be the responsibility of the Purchasing Entity to keep track of the names and contact information for all such users, in order that the Purchasing Entity may notify those individuals of the breach after having received notification from Microsoft that a breach occurred. Microsoft does not notify individuals, but will reimburse Purchasing Entities for their notification and credit monitoring costs (subject to its Limitation of Liability), in accordance with the alternative contract language proposed below (Submitted: Jan 29, 2016 6:01:13 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 379
#15..
- 710 -
Microsoft does not keep track of the identities of individuals whose PII a Purchasing Entity may choose to store on our Online Services, so it must be the responsibility of the Purchasing Entity to keep track of the names and contact information for all such users, in order that the Purchasing Entity may notify those individuals of the breach after having received notification from Microsoft that a breach occurred. Microsoft does not notify individuals, but will reimburse Purchasing Entities for their notification and credit monitoring costs (subject to its Limitation of Liability), in accordance with the alternative contract language proposed below (Submitted: Jan 29, 2016 6:01:13 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 378
Part 5:

Additionally, Microsoft is not able to agree to a 24 hour or less notification of a Security Incident. Once Microsoft has verified that Customer Data has been subject to a Security Incident, it will notify promptly thereof. For Microsoft Azure Core Services when delivered from Microsoftâ€™s Government Community Cloud, Microsoft is able to provide a 5-day notice of Security Incident, subject to the terms and conditions below.

Following are Microsoftâ€™s contractual commitments pertaining to Security Incident Notification, from the OST (note that â€œCustomerâ€ represents â€œPurchasing Entityâ€ ):

Compliance with Laws
Microsoft will comply with all laws and regulations applicable to its provision of the Online Services, including security breach notification law. However, Microsoft is not responsible for compliance with any laws or regulations applicable to Customer or Customerâ€™s industry that are not generally applicable to information technology service providers. Microsoft does not determine whether Customer Data includes information subject to any specific law or regulation. All Security Incidents are subject to the Security Incident Notification terms below.

Security Incident Notification
If Microsoft becomes aware of any unlawful access to any Customer Data stored on Microsoftâ€™s equipment or in Microsoftâ€™s facilities, or unauthorized access to such equipment or facilities resulting in loss, disclosure, or alteration of Customer Data (each a â€œSecurity Incidentâ€ ), Microsoft will promptly (1) notify Customer of the Security Incident; (2) investigate the Security Incident and provide Customer with detailed information about the Security Incident; and (3) take reasonable steps to mitigate the effects and to minimize any damage resulting from the Security Incident. (Submitted: Jan 29, 2016 6:01:42 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 379
Part 6:

Customer must notify Microsoft promptly about any possible misuse of its accounts or authentication credentials or any security incident related to an Online Service.

For each Online Service Tenant or Azure subscription, as applicable, as a condition of receiving notifications within 5 days, as set forth in the preceding paragraph, the State must register the following information by sending email to [email protected], and must keep such information current at all times:
1) Purchasing Entityâ€™s Microsoft Online Direct Routing Domain (MODRD); 2) For one or more individual(s) to be contacted, each of whom must be registered as an administrator on the applicable Online Services, each of the following:
a. Name;
b. Title;
c. Email address registered as an administrator on the Online Services; d. Email address not registered as a user on the Online Services; 3) Name of Purchasing Entity;
4) Enrollment number assigned by Microsoft to represent Purchasing Entityâ€™s Tenant or Azure Subscription, on Offerorâ€™s subcontract with Microsoft. (Submitted: Jan 29, 2016 6:02:14 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 380
#15..
- 711 -
4) Enrollment number assigned by Microsoft to represent Purchasing Entityâ€s Tenant or Azure Subscription, on Offerorâ€™s subcontract with Microsoft. (Submitted: Jan 29, 2016 6:02:14 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 380
Part 7:

Microsoft expects to change the above process by which the Purchasing Entity for each tenant or subscription will be able to register their MODRD and other information for five-day Security Incident notification pursuant to these terms and conditions. In the event that a Purchasing Entity is notified by Microsoft, in the administrative console or otherwise, of revised instructions necessary to ensure five-day Security Incident notification, the Purchasing Entity must comply with such revised instructions. (Submitted: Jan 29, 2016 6:03:08 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 381
part 8:

Additional language pertaining to reimbursements of costs:

To the extent that a Security Incident results from Microsoftâ€™s failure to comply with its obligations under this Master Agreement (and, where applicable, Participating Addenda), and subject to the limitations of liability set forth in Attachment A, Section 43 (Limitation of Liability), Microsoft will reimburse Purchasing Entities for reasonable out-of-pocket remediation costs incurred by such Purchasing Entities in connection with that Security Incident. â€œReasonable out-of-pocket remediation costsâ€ are costs that (a) are customary, reasonable and expected to be paid by entities similar to Purchasing Entity, based on the nature and scope of the Security Incident, and (b) do not arise from or relate to Purchasing Entityâ€™s violation of (i) laws applicable to Purchasing Entity or (ii) Purchasing Entityâ€™s obligations to third parties, and (c) in no event include costs arising related to compliance with laws applicable to Purchasing Entity or its industry or government function that are not generally applicable to information technology services providers. Purchasing Entity must document all such expenditures and, upon Microsoftâ€™s request, those expenditures must be validated by an independent, internationally-recognized third party industry expert chosen by both parties. For avoidance of doubt, the costs reimbursed by Microsoft under this paragraph will be characterized as direct damages subject to the limitation on liability set forth in this Section, and not as special damages excluded under the â€œEXCLUSION OF CERTAIN DAMAGESâ€ in Attachment A, Section 43 (Limitation of Liability). (Submitted: Jan 29, 2016 6:03:37 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 382
Unduly Restrictive:

This question will be structured in parts first noting language in the RFP followed by the question based on the following section of the RFP:

Exhibit 3 to Attachment A, Sections 4 and 5 (Submitted: Jan 29, 2016 6:06:11 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 383
Part 1
Notification: The Contractor shall inform the Purchasing Entity of any security incident or data breach related to Purchasing Entityâ€™s Data within the possession or control of the Contractor and related to the service provided under the Master Agreement, Participating Addendum, or SLA. Such notice shall include, to the best of Contractorâ€™s knowledge at that time, the persons affected, their identities, and the Confidential Information and Data disclosed, or shall include if this information is unknown. a. Security Incident Reporting Requirements: The Contractor shall report a security incident to the Purchasing Entity identified contact immediately as soon as possible or promptly without out reasonable delay, or as defined in the SLA.
b. Breach Reporting Requirements: If the Contractor has actual knowledge of a confirmed data breach that affects the security of any purchasing entityâ€™s content that is subject to applicable data breach notification law, the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 381
#15..
- 712 -
under the Master Agreement, Participating Addendum, or SLA. Such notice shall include, to the best of Contractorâ€™s knowledge at that time, the persons affected, their identities, and the Confidential Information and Data disclosed, or shall include if this information is unknown. a. Security Incident Reporting Requirements: The Contractor shall report a security incident to the Purchasing Entity identified contact immediately as soon as possible or promptly without out reasonable delay, or as defined in the SLA.
b. Breach Reporting Requirements: If the Contractor has actual knowledge of a confirmed data breach that affects the security of any purchasing entityâ€™s content that is subject to applicable data breach notification law, the Contractor shall (1) as soon as possible or promptly without out reasonable delay notify the Purchasing Entity, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the data breach in a timely manner. (Submitted: Jan 29, 2016 6:06:43 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 384
Part 2:
(Section 5) 5. Breach Responsibilities: This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the Contractor and related to the service provided under the Master Agreement, Participating Addendum, or SLA.
a. The Contractor, unless stipulated otherwise, shall immediately notify the appropriate Purchasing Entity identified contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident. b. The Contractor, unless stipulated otherwise, shall promptly notify the appropriate Purchasing Entity identified contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it has confirmed that there is, or reasonably believes that there has been a data breach. The Contractor shall (1) cooperate with the Purchasing Entity as reasonably requested by the Purchasing Entity to investigate and resolve the Data Breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary. (Submitted: Jan 29, 2016 6:07:12 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 385
Part 3:
c. Unless otherwise stipulated, if a Data Breach is a direct result of Contractorâ€™s breach of its contractual obligation to encrypt Personal Data or otherwise prevent its release, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a toll-free number and call center for affected individuals required by federal and state laws â€” all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $217 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause (Submitted: Jan 29, 2016 6:08:57 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 386
Part 4
The proposed alternative language below is the same as that proposed above in this document for the related Section 4 and 5 in Exhibits 1 and 2 to Attachment A. Because of differences in the language, we have added a few additional explanatory notes.

Microsoft does not keep track of the identities of individuals whose PII a Purchasing Entity may choose to store on State of Utah Bid CH16012
3/22/2016 4:23 PM p. 382
#15..
- 713 -
additional explanatory notes.

PM MST)
Question 387
part 5:

Following are Microsoftâ€™s contractual commitments pertaining to Security Incident Notification, from the OST (note that â€œCustomerâ€ represents â€œPurchasing Entityâ€ ): (Submitted: Jan 29, 2016 6:09:55 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 388
part 6:

Compliance with Laws
Microsoft will comply with all laws and regulations applicable to its provision of the Online Services, including security breach notification law. However, Microsoft is not responsible for compliance with any laws or regulations applicable to Customer or Customerâ€™s industry that are not generally applicable to information technology service providers. Microsoft does not determine whether Customer Data includes information subject to any specific law or regulation. All Security Incidents are subject to the Security Incident Notification terms below.

Security Incident Notification
If Microsoft becomes aware of any unlawful access to any Customer Data stored on Microsoftâ€™s equipment or in Microsoftâ€™s facilities, or unauthorized access to such equipment or facilities resulting in loss, disclosure, or alteration of Customer Data (each a â€œSecurity Incidentâ€ ), Microsoft will promptly (1) notify Customer of the Security Incident; (2) investigate the Security Incident and provide Customer with detailed information about the Security Incident; and (3) take reasonable steps to mitigate the effects and to minimize any damage resulting from the Security Incident. (Submitted: Jan 29, 2016 6:10:20 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 389
part 7:

Customer must notify Microsoft promptly about any possible misuse of its accounts or authentication credentials or any security incident related to an Online Service.

PM MST)
Question 390
Part 8:
1) Purchasing Entityâ€™s Microsoft Online Direct Routing Domain (MODRD); 2) For one or more individual(s) to be contacted, each of whom must be registered as an administrator on the applicable Online Services, each of the following:
a. Name;
b. Title;
c. Email address registered as an administrator on the Online Services; d. Email address not registered as a user on the Online Services; 3) Name of Purchasing Entity;
4) Enrollment number assigned by Microsoft to represent Purchasing Entityâ€™s Tenant or Azure Subscription, on Offerorâ€™s subcontract with Microsoft.

Microsoft expects to change the above process by which the Purchasing Entity for each tenant or subscription will be able to register their MODRD and other information for five-day Security Incident notification pursuant to these terms and conditions. In the event that a Purchasing Entity is notified by Microsoft, in the administrative console or otherwise, of revised instructions necessary to ensure five-day Security Incident notification, the Purchasing Entity must comply with such revised instructions. (Submitted: Jan 29, 2016 6:11:39 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 391
Part 9:

Additional language pertaining to reimbursements of costs:

To the extent that a Security Incident results from Microsoftâ€™s failure to comply with its obligations under this Master Agreement (and, where applicable, Participating Addenda), and subject to the limitations of liability set forth in Attachment A, Section 43 (Limitation of Liability), Microsoft will reimburse Purchasing Entities for reasonable out-of-pocket remediation costs incurred by such Purchasing Entities in connection with that Security Incident. â€œReasonable out-of-pocket remediation costsâ€ are costs that (a) are customary, reasonable and expected to be paid by entities similar to Purchasing Entity, based on the nature and scope of the Security Incident, and (b) do not arise from or relate to Purchasing Entityâ€™s violation of (i) laws applicable to Purchasing Entity or (ii) Purchasing Entityâ€™s obligations to third parties, and (c) in no event include costs arising related to compliance with laws applicable to Purchasing Entity or its industry or government function that are not generally applicable to information technology services providers. Purchasing Entity must document all such expenditures and, upon Microsoftâ€™s request, those expenditures must be validated by an independent, internationally-recognized third party industry expert chosen by both parties. For avoidance of doubt, the costs reimbursed by Microsoft under this paragraph will be characterized as direct damages subject to the limitation on liability set forth in this Section, and not as special damages excluded under the â€œEXCLUSION OF CERTAIN DAMAGESâ€ in Attachment A, Section 43 (Limitation of Liability). (Submitted: Jan 29, 2016 6:12:16 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

PM MST)
Question 392
We are a privately held company and do not publicly release our annual financial statements. Because D&B has not reviewed them, it has not measured us consistently with publicly held companies. D&B has assigned us the score of 1R3, which seems to be based simply on the number of employees (10+). However, our financial condition is quite sound. What documentation or information can we provide to establish that our financial condition is at least equivalent to companies receiving a 4A2 score? (Submitted: Jan 29, 2016 6:32:22 AM MST) Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 384
#15..
- 715 -
Question 392
We are a privately held company and do not publicly release our annual financial statements. Because D&B has not reviewed them, it has not measured us consistently with publicly held companies. D&B has assigned us the score of 1R3, which seems to be based simply on the number of employees (10+). However, our financial condition is quite sound. What documentation or information can we provide to establish that our financial condition is at least equivalent to companies receiving a 4A2 score? (Submitted: Jan 29, 2016 6:32:22 AM MST) Answer
- Offerors must, if they do not have a D&B rating, provide adequate information to demonstrate that it is capable of receiving that rating. (Answered: Jan 29, 2016 1:52:44 PM MST) Question 393
Section 8.22 (E) SUPPORTING INFRASTRUCTURE

8.22.1 Describe what infrastructure is required by the Purchasing Entity to support your Services or deployment models.

8.22.2 If required, who will be responsible for installation of new infrastructure and who will incur those costs? Can we assume that any Purchasing Entity would have infrastructure supporting sufficient and secure access to the internet and the Oracle Public Cloud? Can we also assume that any such costs associated with these requirements would be the responsibility of the Purchasing Entity? (Submitted: Jan 29, 2016 7:24:58 AM MST) Answer
- Yes and Yes. (Answered: Jan 29, 2016 1:52:44 PM MST)
Question 394

5.2.3 and 5.2.9, pp 20-21 Govt statements: 1) "A statement indicating the Offerorâ€™s understanding that they may be required to negotiate additional terms and conditions, including additional administrative fees, with Participating Entities when executing a Participating Addendum." 2) "A statement acknowledging that a 0.25% NASPO ValuePoint Administrative Fee will apply to total sales for the Master Agreement(s) awarded from the RFP."
Question: We understand 5.2.3 and 5.2.9 individually, but please provide some sense of how much the administrative fee for Participating Entities may be; this may include offering a range of lowest to highest fees across (Submitted: Jan 29, 2016 7:43:28 AM MST)
Answer
- For the State of Utah the usual administrative fee is 1%. However, Utah cannot comment on what other states may charge as an administrative fee. (Answered: Feb 1, 2016 4:29:33 PM MST) Question 395

5.5.8, 5.5.10, 6.7.1, 9.1; pp 22, 26, and 34. Govt statements:

1. Complete Level 1 CSA STAR Registry Self-Assessment

2. State that auditing capabilities/reports are consistent w/SAS 70 and SSAE 16 6/2011

3. Specify 3rd-party attestations, reports, and certs relating to data security and integrity your company has received; describe how you use latest technologies

4. Pricing catalogs should include the price structures of the cloud solutions models and deployment models that it intends to provide including the types of data it is able to hold under each model. Pricing must be all-inclusive of infrastructure and software costs and management of infrastructure, network, OS, and software.

Question: Please clarify whether these requirements apply to the bidding vendor or to their CSPs. (Submitted: Jan 29, 2016 7:45:14 AM MST)
Answer
- IF the bidding vendor is relying on the CSP for questions 1-3 then it needs to describe that it in its proposal.

For question number 4 the bidding vendor must provide the cost structure that it will charge for the solutions it offers. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 396
RFP 7; p 27; Govt Statement: "The State has identified a number of roles that are necessary based on the requirements of Attachment D; these titles are not meant to be restrictive, but are used to identify key roles." Question: RFP refers to roles (plural), but in 7.1 identifies only one role. Please confirm that the only key-personnel role is the contract manager. If this is not the case, please indicate what other roles the State of Utah considers key. (Submitted: Jan 29, 2016 7:46:22 AM MST)
Answer
- Section 7 has been modified to include only the contract manager role. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 397
RFP 8.1.1, p. 28; Govt statement: â€œif you choose to submit separate offerings for a SaaS service and a PaaS service, submit one response for each service through Offer. Keep responses brief and to the point of how the service meets the requirement, within the indicated page limit.â€ Questions:
a. Please clarify what the Government means when it instructs the Offeror to submit service â€œthrough Offerâ€ b. States â€œwithin the indicated page limitâ€ ; we do not find page limit statements; did we miss something? (Submitted: Jan 29, 2016 7:47:35 AM MST)
Answer
- The language â€œthrough Offerâ€ and â€œwithin the indicated page limitâ€ has been deleted from 8.1.1. (Answered: Jan 29, 2016 4:28:56 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 385
#15..
- 716 -
a. Please clarify what the Government means when it instructs the Offeror to submit service â€œthrough Offerâ€ b. States â€œwithin the indicated page limitâ€ ; we do not find page limit statements; did we miss something? (Submitted: Jan 29, 2016 7:47:35 AM MST)
Answer
- The language â€œthrough Offerâ€ and â€œwithin the indicated page limitâ€ has been deleted from 8.1.1. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 398
RFP 8.1.3, p. 28; Govt Statement: â€œOfferor must identify for each service category(ies) the areas that each service category.â€
Question: It appears that a verb is missing at the end of the sentence; please indicate what the Offeror must identify about each service category. (Submitted: Jan 29, 2016 7:48:34 AM MST) Answer
- 8.1.3 has been modified to state: Offeror must identify for each service model the subcategories that it offers for each service model. For example if an Offeror provides a SaaS offering then it should be divided into education SaaS offerings, e-procurement SaaS offerings, information SaaS offering, etc. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 399
RFP 8.4.2; p. 29; Govt statement: "You must have one lead representative for each entity that executes a Participating Addendum. Contact information shall be kept current." Question: Please confirm that this statement means that each participating state has a single POC and not that each state has a dedicated FTE. In other words, a given Offeror representative could be the single POC for more than one state. (Submitted: Jan 29, 2016 7:49:38 AM MST) Answer
- Correct. A given Offeror representative could be the single POC for more than one state. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 400
RFP 8.8.1.c ; p. 30; Govt statement: "Specify how you would respond to the following situations; include any contingency plan or policy: c.Experiences a business failure." Question: Please clarify what the Government means by a business failure: the CSP failing, a hardware OEM failing, the Offeror failing? (Submitted: Jan 29, 2016 7:50:41 AM MST) Answer
- The section has been modified to state: Offeror experiences a system failure. (Answered: Feb 1, 2016 4:29:33 PM MST)
Question 401
General: May individual states require bonding and if so at what levels? (Submitted: Jan 29, 2016 7:51:22 AM MST) Answer
- Individual states may require bonds depending on the project, but this is a purchasing entity decision. (Answered:

Jan 29, 2016 4:28:56 PM MST)
Question 402
General: May state participants hold back portions of the invoice payment? (Submitted: Jan 29, 2016 7:51:53 AM MST)
Answer
- Only as described in the terms and conditions or SLA. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 403
General: For contracts in place on the current WSCA Cloud contract, will those continue through to their stated Period-of-Performance end date, or will all existing WSCA Cloud contracts need to be re-competed immediately after award of the new contract? (Submitted: Jan 29, 2016 7:52:48 AM MST) Answer
- Those will continue through to their stated Period-of-Performance end date (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 404
RFP Section 5.2.5 prohibits employment of â€œany company or person other than a bona fide employee working solely for the Offeror or a company regularly employed as its marketing agent, to respond to the RFP.â€ What about cases where authorized resellers or value added resellers of a service provider wish to submit proposals as prime contractors, for the purpose of providing cloud services for which the cloud service provider sells via an â€œindirect through resellerâ€ sales model â€“ is this allowed? (Submitted: Jan 29, 2016 8:14:59 AM MST)
Answer
- This has been answered above. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 405
RFP Section 5.5.12 refers to SLA requirements in RFP Section 8.13. But Section 8.13 appears to apply to the STAR Registry Self-Assessment, not SLA. Is this a typo, and if so then what section was intended? If not, please explain the relationship to SLA. (Submitted: Jan 29, 2016 8:16:01 AM MST) Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 386
#15..
- 717 -
Answer
- This has been answered above. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 405
RFP Section 5.5.12 refers to SLA requirements in RFP Section 8.13. But Section 8.13 appears to apply to the STAR Registry Self-Assessment, not SLA. Is this a typo, and if so then what section was intended? If not, please explain the relationship to SLA. (Submitted: Jan 29, 2016 8:16:01 AM MST) Answer
- The reference to 8.13 should by 8.12. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 406
RFP Section 9.1 requires that Offerors bid a minimum discount off of their published government price catalog.

Will alternative models be considered in cases where no such published price list exists? For example, in the case of an Offeror which is a systems integrator or reseller of cloud services provided by another company that does not publicly publish such a price catalog. (Submitted: Jan 29, 2016 8:16:33 AM MST) Answer
- The State needs to know what price the minimum discount price is being applied to. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 407
Attachment A contains the defined terms â€œDisabling Code,â€ â€œFulfilment Partner,â€ and that do not appear to be used anywhere in that Attachment or the other RFP documents. Please advise if, and how, NASPO intends to use these terms in the Master Agreement. (Submitted: Jan 29, 2016 8:17:13 AM MST) Answer
- This question has been answered above. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 408
Section 9 of Attachment A (â€œRight to Publishâ€ ) appears to prohibit any sort of mention of the Agreement without advance permission. Will a Contractor need to seek permission in each case where it wants to alert a prospective Purchasing Entity in a Participating State of the existence of the Master Agreement, in order that the Contractor may encourage the prospective Purchasing Entity to utilize the Master Agreement for its needs? (Submitted: Jan 29, 2016 8:17:50 AM MST)
Answer
- No. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 409
RFP Section 7.2 requires incorporation of all Attachments. If an exception is not taken to Attachment E would an offeror be bound by those state specific terms and conditions when they attempt to negotiate a Participating Addendum with that respective State? Must exceptions to Attachment Eâ€™s state specific terms and conditions be taken at this phase? Or will additional time be granted for Offerors to prepare exceptions to the Participating Addenda in Attachment E? (Submitted: Jan 29, 2016 8:18:24 AM MST) Answer
- Offerors do not need to take exceptions to each document in Attachment E. Negotiations with participating entities will take place during the participating addendum stage. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 410
In each of the Exhibits 1 and 2 to Attachment A, please explain what is meant by the section titled â€œWeb Servicesâ€ which says â€œthe Contractor shall use Web services exclusively to interface with the Purchasing Entityâ€™s data in near real time.â€ (Submitted: Jan 29, 2016 8:18:54 AM MST) Answer
- This question has been answered above. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 411
Can we embed documents within the RFP response? (Submitted: Jan 29, 2016 8:46:59 AM MST) Answer
- No. They should be attachments. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 412
Can you please specify if both the IT documents, CAIQ and CSM would need to be filled or one is optional, based on the services we provide (Submitted: Jan 29, 2016 8:47:48 AM MST) Answer
- Both forms should be filled out based on the services provided. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 413
Can you please provide the definition of â€˜an instanceâ€™ from section 5.6.13 in the document - Cloud Solutions - Request for Proposals - CH16012 (Submitted: Jan 29, 2016 8:48:12 AM MST) Answer
- The definition is flexible based on the services offered by an offeror. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 414
Are we to attach functional specifications of the proposed solution (E.g. Our SaaS offering) If so is there a specific section that we could use for this response? (Submitted: Jan 29, 2016 8:48:42 AM MST) Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 387
#15..
- 718 -
Solutions - Request for Proposals - CH16012 (Submitted: Jan 29, 2016 8:48:12 AM MST) Answer
- The definition is flexible based on the services offered by an offeror. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 414
Are we to attach functional specifications of the proposed solution (E.g. Our SaaS offering) If so is there a specific section that we could use for this response? (Submitted: Jan 29, 2016 8:48:42 AM MST) Answer
- That would be beneficial for review and evaluation of proposals. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 415
If any questions are not applicable for SAAS environment mentioned in the security alliance questionnaire, whether those questions and control measures will be allowed as exception for compliance? (Submitted: Jan 29, 2016 8:49:11 AM MST)
Answer
- If questions do not apply then Offerors should describe why the questions do not apply. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 416
Are we allowed to negotiate indemnification and limitation of liability in participating addendum document, we want to limit our liability upto 12 months of fees paid (Submitted: Jan 29, 2016 8:49:31 AM MST) Answer
- Yes. Offerors must identify which terms and conditions they want to negotiate. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 417
Are we allowed to negotiate indemnification and limitation of liability in state specific terms and conditions , we want to limit our liability upto 12 months of fees paid (Submitted: Jan 29, 2016 8:50:08 AM MST) Answer
- Yes. Offerors must identify which terms and conditions they want to negotiate. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 418
In which document should the offeror enlist its products and the related cost, the cost schedule template merely contains space for depicting discount percentage. (Submitted: Jan 29, 2016 8:50:35 AM MST) Answer
- As part of the cost proposal. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 419
Is there any â€œcost structureâ€ which we need to adhere fixed cost or time and material cost, differential cost for different states, or based on small tier, medium tier or large tier? (Submitted: Jan 29, 2016 8:51:07 AM MST) Answer
- No. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 420
In which document should we mention the payment milestones if any for e.g. annual advance Also, The prices which we will quote, would it need to be exclusive of tax or inclusive of any taxes (Submitted: Jan 29, 2016 8:51:53 AM MST)
Answer
- Most purchasing entities are tax exempt.

All items discussing cost should be part of the cost proposal. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 421
Are we allowed to submit other product specific documents like SOW, SLA or are we supposed to review any specific SOW template (Submitted: Jan 29, 2016 8:52:16 AM MST) Answer
- Offerors are allowed to submit specific documents. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 422
What is the process to negotiate the terms and conditions of participating addendum, at what stage the negotiation to this document can be done? (Submitted: Jan 29, 2016 8:52:40 AM MST) Answer
- Once a Master Agreement has been signed then the awarded contractor can negotiate a participating addendum. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 423
What is the process to negotiate the terms and conditions of attachment Aâ€ - master agreement, at what stage the negotiation to this document can be done. (Submitted: Jan 29, 2016 8:53:03 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. The Lead State will not consider proposed modifications and/or additions to the Master Agreement Terms and Conditions after the deadline for proposals.

If an Offeror is awarded a contract then the lead state will initiate the negotiations for the Master Agreement.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 388
#15..
- 719 -
Question 423
What is the process to negotiate the terms and conditions of attachment Aâ€ - master agreement, at what stage the negotiation to this document can be done. (Submitted: Jan 29, 2016 8:53:03 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. The Lead State will not consider proposed modifications and/or additions to the Master Agreement Terms and Conditions after the deadline for proposals.

If an Offeror is awarded a contract then the lead state will initiate the negotiations for the Master Agreement. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 424
In the Attachment E, there is a template of participating addendum of state of Hawaii, need to understand whether this is a common template for all the states. (Submitted: Jan 29, 2016 8:53:26 AM MST) Answer
- A participating addendum template will be created once contracts have been awarded. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 425
Attachment E consists of various state specific terms and conditions. While submitting RFP do we need to call out our proposed changes for all the state specific terms and conditions or the selected offeror can negotiate state specific terms even after award stage (Submitted: Jan 29, 2016 8:53:51 AM MST) Answer
- No. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 426
In Exhibit H there is a column of â€œdeployment modelsâ€ , need clarity about the same. (Submitted: Jan 29, 2016 8:54:17 AM MST)
Answer
- Offerors should list which deployment models in Attachment D is Offeror able to provide. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 427
Need to know the order of precedence of contractual documents pertaining to â€¢ Attachment Aâ€™-master agreement
â€¢ Exhibits to master agreement
â€¢ State specific terms and conditions/General provisions â€“information technology which are there in Attachment E.
â€¢ Participating Addendum Template provided in Attachment E â€¢ The scope of work document which provider would submit â€¢ Any other documents-please specify (Submitted: Jan 29, 2016 8:54:49 AM MST) Answer
- (1) A Participating Entityâ€™s Participating Addendum (â€œPAâ€ ); (2) NASPO ValuePoint Master Agreement Terms & Conditions, including the applicable Exhibits to the Master Agreement;
(3) The Solicitation;
(4) Contractorâ€™s response to the Solicitation, as revised (if permitted) and accepted by the Lead State; and (5) A Service Level Agreement issued against the Participating Addendum. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 428
For the terms and conditions of â€œindemnificationâ€ and limitation of liability â€œ, which document will be construed as supreme over all documents. (Submitted: Jan 29, 2016 8:55:18 AM MST) Answer
- The participating addendum will control all other documents, as some states may have additional requirements then what it listed in the Master Agreement. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 429
For the terms and conditions for â€œtermination and termâ€ which document will be construed as supreme over all documents? (Submitted: Jan 29, 2016 8:55:44 AM MST) Answer
- The participating addendum will control all other documents, as some states may have additional requirements then what it listed in the Master Agreement. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 430
In attachment E , there Is a document about supplier diversity program, could you please provide some details on the same (Submitted: Jan 29, 2016 8:56:06 AM MST)
Answer
- Attachment E contains state specific terms and conditions and will be negotiated/discussed in the participating addendum stage. (Answered: Jan 29, 2016 9:20:21 AM MST) Question 431
With respect to encryption for data at rest, we provide the same for a selected set of modules, and for some we do not. Can we use the technical response in the proposal to specify this as an exception? (Submitted: Jan 29, 2016 8:56:30 AM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 389
#15..
- 720 -
Answer
- Attachment E contains state specific terms and conditions and will be negotiated/discussed in the participating addendum stage. (Answered: Jan 29, 2016 9:20:21 AM MST) Question 431
With respect to encryption for data at rest, we provide the same for a selected set of modules, and for some we do not. Can we use the technical response in the proposal to specify this as an exception? (Submitted: Jan 29, 2016 8:56:30 AM MST)
Answer
- Yes. (Answered: Jan 29, 2016 9:20:21 AM MST)
Question 432
In Attachment F: Usage Report Summary â€“Sample :: What is expected to be updated in Tab 2 of the specification mentions about total dollars spent per each customer, is it the dollar amount purchases made by each state using Procurement Solution? and in Summary by state sheet? (Submitted: Jan 29, 2016 8:56:51 AM MST) Answer
- This is a sample usage report, for reference only.

The final usage report will be provided to the awarded vendors. (Answered: Jan 29, 2016 9:20:21 AM MST) Question 433
(Attachment A, Section 23. Operations Management) What, if any certifications might be required by solicitation? (Submitted: Jan 29, 2016 8:58:17 AM MST)
Answer
- The last sentence has been deleted in the section. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 434
In order to improve marketing efforts and greater competition in the marketplace, would the State be willing to allow a contract holder to add agents to this contract? These agents would quote and accept orders on the contract holderâ€™s behalf. (Submitted: Jan 29, 2016 8:58:25 AM MST) Answer
- Sales agents are acceptable. (Answered: Jan 29, 2016 9:20:21 AM MST) Question 435
If agents are allowed on this contract, what is the process for adding them to the RFP response? What information would the State need in order to authorize these agents? (Submitted: Jan 29, 2016 8:58:56 AM MST) Answer
- If an Offeror intends to use sales agents then it should identify that in Section 8.20. Offerors do not need to name each sales agent. However, some states may require if a sales agent is entering on to certain property of the state that the sales agent receives a background check. (Answered: Jan 29, 2016 9:20:21 AM MST) Question 436
If additional products that fit into the scope of this RFP become available post-award, will this contract allow for the addition of these products to the contract? (Submitted: Jan 29, 2016 8:59:12 AM MST) Answer
- Yes. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 437
If additional manufacturers become a part of the contract holderâ€™s portfolio that fit into the scope of this RFP, would the State allow for these manufacturers to be added post-award? (Submitted: Jan 29, 2016 8:59:40 AM MST) Answer
- Yes Section 2.8 allows for this. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 438
Do managed services fit into the scope of this RFP? If so, what category of services should they be placed under in the response? Managed Services is defined as the proactive management of an IT (Information Technology) asset or object, by a third party typically known as a MSP, on behalf of a customer. (Submitted: Jan 29, 2016 8:59:58 AM MST)
Answer
- Offeror must demonstrate how their offerings fit into the service models described in Attachment D. (Answered:

Feb 1, 2016 4:29:33 PM MST)
Question 439
Do implementation services fit into the scope of this RFP? If so, what category of services should they be placed under in the response? (Submitted: Jan 29, 2016 9:00:11 AM MST) Answer
- An offeror's offering should fit into categories listed in Attachment D. (Answered: Feb 1, 2016 4:29:33 PM MST) Question 440
If the state receives multiple bid responses for the separate cloud categories within the scope of this RFP, how will the state plan to award each category? (Submitted: Jan 29, 2016 9:00:29 AM MST) Answer
- Every vendor that meets the minimum point threshold and provides a responsive cost proposal form may be awarded a contract. (Answered: Jan 29, 2016 4:28:56 PM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 390
#15..
- 721 -
- An offerors offering should fit into categories listed in Attachment D. (Answered: Feb 1, 2016 4:29:33 PM MST) Question 440
If the state receives multiple bid responses for the separate cloud categories within the scope of this RFP, how will the state plan to award each category? (Submitted: Jan 29, 2016 9:00:29 AM MST) Answer
- Every vendor that meets the minimum point threshold and provides a responsive cost proposal form may be awarded a contract. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 441
(Attachment A, Section 31. Warranty)
c. Contractor represents and warrants that the representations contained in its response to the Solicitation by the Lead State.

This appears to be an incomplete sentenceâ€”can you please clarify? (Submitted: Jan 29, 2016 9:00:37 AM MST) Answer
- Contractor is representing any representation made its proposal as true and accurate. (Answered: Jan 29, 2016 4:28:56 PM MST)
Question 442
If one company provides multiple bid responses for different cloud categories would the state be willing to provide multiple contracts to the company? (Submitted: Jan 29, 2016 9:00:46 AM MST) Answer
- Yes. (Answered: Feb 1, 2016 4:29:33 PM MST)
Question 443
Approximately how many awards are the state planning on making as a result of this RFP? (Submitted: Jan 29, 2016 9:01:02 AM MST)
Answer
- Every vendor that meets the minimum point threshold and provides a responsive cost proposal form may be awarded a contract. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 444
Please describe the Stateâ€™s anticipated award model and evaluation procedures for this RFP. (Submitted:

Jan 29, 2016 9:01:18 AM MST)
Answer
- This is identified in Section 4 of the RFP document. (Answered: Jan 29, 2016 4:28:56 PM MST) Question 445
In regards to 5.6.6 and attachment A data location: Most modern data security standards (including FedRAMP and DoD Cloud SRG) have moved away from the concept of data location as providing value. Can this requirement either be clarified as to its rational or removed? (Submitted: Jan 29, 2016 9:01:36 AM MST) Answer
- If an Offeror cannot meet this mandatory minimum requirement it will not be rejected, but it will restrict the type of award the Offeror can receive. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 446
In regards to 5.6.13: This question implies a 100% requirement for scale up/down; Is it, instead, possible to provide an SLA or other similar documentation to help account for Acts of God and other factors which may not have been reasonably foreseen? (Submitted: Jan 29, 2016 9:02:13 AM MST) Answer
- An Offeror's proposal and SLA should details these instances. (Answered: Feb 1, 2016 4:29:33 PM MST) Question 447
Please provide a list of master eDiscovery requirements. (Submitted: Jan 29, 2016 9:02:24 AM MST) Answer
- These may vary from State to State. This will be negotiated during the participating addendum stage. (Answered:

Feb 1, 2016 4:29:33 PM MST)
Question 448
In regards to Section 8, Attachment A: Does NASPO require that a full staff list and background check results be shared as a prerequisite for placing data in the contractorâ€™s facility? Is NASPO amenable to alternate strategies used by other government entities? (Submitted: Jan 29, 2016 9:02:38 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 449
In regards to Change Control and advance notice: Many cloud providers are in a virtually constant refresh cycle of hardware and software. How will NASPO allow for constant refresh in cases where the offeror has robust management and rollback capabilities? (Submitted: Jan 29, 2016 9:02:51 AM MST) Answer
- Please include these details in your proposal. (Answered: Feb 1, 2016 2:43:08 PM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 391
#15..
- 722 -
Question 449
In regards to Change Control and advance notice: Many cloud providers are in a virtually constant refresh cycle of hardware and software. How will NASPO allow for constant refresh in cases where the offeror has robust management and rollback capabilities? (Submitted: Jan 29, 2016 9:02:51 AM MST) Answer
- Please include these details in your proposal. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 450
In regards to access to security logs and reports(A-9): Certain of the report elements (e.g. latency, IP address) may or may not be able to be accurately reported on by the cloud provider without correlation to systems like on premise firewalls (ie. NAT-ed IP addresses; last mile latency, etc). Is it possible, instead, to provide what is reported on and give purchasers the ability to determine goodness of fit? (Submitted: Jan 29, 2016 9:03:03 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Feb 1, 2016 3:40:06 PM MST) Question 451
Question on 8.6.2
List all government or standards organization security certifications you currently hold that apply specifically to the hosted environment described in your firmâ€™s RFP response, as well as those in process at time of response.

Specifically include HIPAA, FERPA, CJIS Security Policy, PCI Data Security Standards (DSS), IRS Publication 1075, FISMA, NIST 800-53, NIST SP 800-171, and FIPS 200 if they apply.

There is presently no Vendor Certification for CJIS, each Law Enforcement Agency must define how the Cloud Solution will be used with respect to CJ data and execute an Information Exchange Agreement with the Vendor. If a Cloud Vendor can define how they ensure compliance with CJIS in the absence of any certification program, will that ensure that points will not be deducted? (Submitted: Jan 29, 2016 9:03:21 AM MST) Answer
- Yes. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 452
Score Sheet - The instructions in the excel file are as follows: â€œDRAFT: This document is intended to be a draft and should not be returned to the Division of Purchasing. Please return this document to the evaluation committee chairperson.â€
Our understanding is that we do not have to submit the score sheet with our proposal. But, could you clarify the instruction above? Do we have to score ourselves, and return (submit) the score sheet to the evaluation committee chairperson, or is that an instruction for the Division of Purchasing evaluators? If yes, could you please provide us with the contact information for submission? (Submitted: Jan 29, 2016 9:09:58 AM MST) Answer
- Correct. The score sheet is for your reference. The score sheet will be used by the evaluation committee. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 453
(RFP Section 3.13 CONFIDENTIAL OR PROPRIETARY INFORMATION) (2) commercial information or non-individual financial information obtained from a person if:
(c) the person submitting the information has provided the governmental entity with the information specified in UCA Â§ 63G-2-309;
* * * * *
(6) records
Is there something missing here or perhaps mislabeled? (Submitted: Jan 29, 2016 9:12:48 AM MST) Answer
- Subsection (3) through (5) have been removed as they are not relevant. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 454
RFP Section 5.5.11. Please specify what technical support is required at no additional cost. (Submitted: Jan 29, 2016 9:15:16 AM MST)
Answer
- General technical support. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 455
Please clarify that both the CAIQ and the CCM need to be completed with the submission? (Submitted: Jan 29, 2016 9:17:24 AM MST)
Answer
- Yes both forms should be completed. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 456
How is pricing graded? Is it compared within a vertical or a pricing structure (a platform price compared to priced solely by users)?
Can you better explain the risk levels for the data? What is defined as low risk data, medium risk data and high risk data? Is any data that is covered by each stateâ€™s Freedom of Information Act considered low risk? Can we add and subtract sub-contractors throughout the length of the contract or are we bound by the list we submit with the proposal?
How does the scale pricing work? Obviouslyeach respondent provides a different product and therefore will have State of Utah Bid CH16012
3/22/2016 4:23 PM p. 392
#15..
- 723 -
Question 456
How is pricing graded? Is it compared within a vertical or a pricing structure (a platform price compared to priced solely by users)?
Can you better explain the risk levels for the data? What is defined as low risk data, medium risk data and high risk data? Is any data that is covered by each stateâ€™s Freedom of Information Act considered low risk? Can we add and subtract sub-contractors throughout the length of the contract or are we bound by the list we submit with the proposal?
How does the scale pricing work? Obviously, each respondent provides a different product and therefore will have completely different pricing. (Submitted: Jan 29, 2016 9:28:37 AM MST) Answer
- 1. Price is evaluated by an offeror providing a minimum discount for each category listed.

2. The levels of risk have been defined by FIPS PUB 199. And each state will decide that during the participating addendum stage.

3. Yes. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 457
In regards to item 5.5.8 Does the RFP require us to submit the CAIQ to the CSA and maintain a STAR registry entry with that program or only complete the assessment and provide it as part of the RFP and upon request? (Submitted: Jan 29, 2016 9:39:06 AM MST)
Answer
- The RFP only requires that Offerors complete the assessment. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 458

Page 31 ends

agreed to in the Master Agreement Terms and Conditions or in a Participating Addendum. Some cloud manufacturers will require end users to complete a document to enroll in cloud services. It is our understanding that this step (as applicable) would be permissible to properly establish the cloud solution for the end user, can you confirm? (Submitted: Jan 29, 2016 9:59:05 AM MST)
Answer
- All terms and conditions that will be applicable to purchasing entities must be discussed in the Master Agreement or participating addendum. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 459
If a vendor is awarded a Master Contract, can the vendor subsequently determine the frequency/schedule for submitting amendments to their rate card(s) for both cloud services and value add consulting/advisory services, and include that information in the price submission? Are there limitations to the frequency or timing of rate card amendments? (Submitted: Jan 29, 2016 10:26:18 AM MST)
Answer
- An offeror only needs to submit as part of its proposal a minimum discount off of its price schedule/rate. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 460
Value add services such as consulting or advisory services may have a scaled price structure determined by experience/seniority or specific skill set requested by the purchasing entity â€“ may we assume the rate card can contain a price scale for such services rather than a single blended price? Prices for such services are predicated by prevailing cost of living/salary changes, usually updated annually â€“ does the state have an expectation as to the length of time consulting/advisory service pricing should be valid? (Submitted: Jan 29, 2016 10:27:20 AM MST) Answer
- Offerors shoudl provide a minimum discount for the value added services. SO that purchasing entities know that they are getting a discount from the scaled price structure. (Answered: Feb 1, 2016 3:40:06 PM MST) Question 461
Does the state require all consulting/advisory services to be delivered by US based personnel, or may offshore resources be offered as well? (Submitted: Jan 29, 2016 10:27:51 AM MST) Answer
- This requirement will be specified with each purchasing entity and will be dependent on the type of data that the purchasing entity is providing to the awarded contractor. (Answered: Feb 1, 2016 3:40:06 PM MST) Question 462
In regards to 5.6.6 and attachment A data location: We current have revenue coming form 41 States for a product that does not have data location. We also have a number of free products that do not have data location where the only limitation is a contract vehicle. May we ask that this requirement be changed to "Please fully disclose the Data Location methods and model for your product?" That would allow various State to have the proper information when making a decision and in most States seek approval from their State Security Risk and Compliance team on weather or not this is an appropriate purchase and use. Nearly every State we have encountered has a process for reviewing and approving Non-Data Located products. (Submitted: Jan 29, 2016 10:32:01 AM MST)
Answer
- 5.6.6 has been modified to the following: Offerors must fully disclose the Data Location methods and model for its solutions. Offeror must also describe whether it can isolate data, if required, to servers and data centers residing entirely in the United States of America or its territories. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 463
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 393
#15..
- 724 -
encountered has a process for reviewing and approving NonData Located products. ( ,
10:32:01 AM MST)
Answer
- 5.6.6 has been modified to the following: Offerors must fully disclose the Data Location methods and model for its solutions. Offeror must also describe whether it can isolate data, if required, to servers and data centers residing entirely in the United States of America or its territories. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 463
General: Is the State willing to extend the Q&A period so that we may follow up on any answers that we receive in response to our questions? (Submitted: Jan 29, 2016 10:32:15 AM MST) Answer
- No. The question and answer period cannot be for an indefinite period of time. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 464
Page (1), Bid Comments; Section 2.1, Purpose: Annual Certification Process; Section 2.8, Contract Award: The mandatory minimum requirements and technical specifications in the RFP are broad. Ongoing requirements should be memorialized in the agreement between the parties. If a vendor is not in compliance with the requirements of the agreement, the vendor is in breach and the customer may terminate the agreement. Would the State consider an alternative requirement that the agreed minimum requirements must be met for the duration of the agreement, rather than the self-certification process? (Submitted: Jan 29, 2016 10:32:54 AM MST) Answer
- The self assessment form will be a one page document that awarded contractors still can perform under the contract. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 465
State of Utah Request for Proposal Page; General Provisions Section 2, Submitting A Proposal; Section 3.1, Question and Answer Period; Section 3.4, Exceptions to RFP and NASPO ValuePoint Master Agreement Terms and Conditions; Section 3.12, Submission of a Proposal; Section 5.8, Recertification of Mandatory Minimums and Technical Specifications: If a vendor believes that certain requirements or terms of the RFP are unduly restrictive but would rather submit a response than a protest, may the vendor submit exceptions where applicable to the RFP requirements and decline to make certifications required in the request for proposal page, in the acknowledgements in section 2 of the General Provisions, in section 3.12, and in section 5.8? This vendor does not wish to be considered non-responsive, but would like the opportunity to respond even if it must take exception to certain requirements or terms in the RFP that were not raised in the Q&A. Please note that section 3.4 indicates or implies that exceptions and/or additions to RFP provisions may be made in the proposal. (Submitted: Jan 29, 2016 10:33:22 AM MST)
Answer
- Section 3.4 refers to the Master Terms and Conditions.

If an Offeror does not believe a mandatory minimum requirement or technical criteria is applicable to its solution/service then it needs to describe in detail why the requirement or criteria is not applicable. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 466
General Provisions Section 1, Governing Laws: The compliance warranty required in this section is very broad.

This vendor is not prepared to provide such a broad warranty but is willing to consider an alternative compliance with laws provision in the negotiated agreement. May the vendor propose alternative language for the Stateâ€™s consideration in the proposal response? (Submitted: Jan 29, 2016 10:33:50 AM MST) Answer
- Please refer to Section 3.4 in taking exceptions and/or additions to the Master Agreement Terms and Conditions. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 467
General Provisions, Sections 12, Audit and 13, Inspection : The provisions in these sections are broad and appear more appropriate for manufacturing or production rather than performance of cloud services. May the vendor propose alternative language for the Stateâ€™s consideration in the proposal response? (Submitted: Jan 29, 2016 10:35:28 AM MST)
Answer
- Please refer to Section 3.4 in taking exceptions and/or additions to the Master Agreement Terms and Conditions. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 468
General Provisions, Section 15, Rejecting a Proposal: This provision indicates that the State â€œmayâ€ reject a proposal if the State determines that the proposal does not meet the mandatory minimum requirements in the RFP. However, in Section 4.3.1, the RFP provides that the State â€œwillâ€ reject the proposal. If the vendor is not able to meet every aspect of every mandatory minimum requirements, may the vendor submit a response that addresses the requirement and explains the extent to which, or the circumstances in which, the vendor can comply? (Submitted: Jan 29, 2016 10:36:17 AM MST)
Answer
- Yes. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 469
General ProvisionsSection 16Technology Modifications; Section 28Contract Award : What does the State State of Utah Bid CH16012
3/22/2016 4:23 PM p. 394
#15..
- 725 -
is not able to meet every aspect of every mandatory minimum requirements, may the vendor submit a response that addresses the requirement and explains the extent to which, or the circumstances in which, the vendor can comply? (Submitted: Jan 29, 2016 10:36:17 AM MST)
Answer
- Yes. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 469
General Provisions, Section 16, Technology Modifications; Section 2.8, Contract Award : What does the State consider to be a modification in the technology? Is the State willing or able to work with a vendor who may automatically upgrade its cloud offerings? This vendor would not want to be in breach of contract if its commercial cloud offering were upgraded without approval of the State. The vendor may not be able to continue to provide an outdated offering if the service as a whole will be improved. (Submitted: Jan 29, 2016 10:36:53 AM MST) Answer
- Vendors are encouraged to upgrade their offerings through the term of the contract. (Answered: Feb 1, 2016 3:40:06

PM MST)
Question 470
General Provisions, Section 17, Publicizing Awards: Is the State able to provide notice and an opportunity to respond to the vendor in the event that its confidential business information is requested to be disclosed? (Submitted: Jan 29, 2016 10:37:29 AM MST)
Answer
- If an Offeror provides a Claim of Business Confidentiality claim is provided in the RFP then the State will not release confidential information in the event of a public records request. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 471
General Provisions, Section 19, Awarded Contract(s): Please clarify what the scope of work will entail or if it is already included in this RFP. Is this the same of the Scope of Services in Attachment D? (Submitted: Jan 29, 2016 10:38:18 AM MST)
Answer
- The scope of services will be similar to Attachment D, but will be modified to reflect an Offeror's proposal. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 472
General Provisions, Section 19, Awarded Contract(s): Will the State consider negotiating the RFP during contract negotiations so that the final agreement does not have any conflicting provisions and forms one complete, coherent document or set of documents? (Submitted: Jan 29, 2016 10:39:03 AM MST) Answer
- Yes. The State intends to negotiate the contracts so that no conflicts are present in the final agreement. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 473
General Provisions, Section 19, Awarded Contract(s): Are the State of Utah Standard Terms and Conditions included in the RFP? If not, could the State provide a copy? (Submitted: Jan 29, 2016 10:39:35 AM MST) Answer
- The State of Utah's Terms and Conditions are included in Attachment E. But will be negotiated during the participating addendum stage. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 474
Section 2.3, Definitions, Participating Addendum; Section 2.7.3, Participating Addenda: Other than changing the scope of the Master Agreement, may the parties to the Participating Addendum negotiate legal terms and conditions that are different from the terms in the Master Agreement but not necessarily required by the law of the applicable state? (Submitted: Jan 29, 2016 10:40:23 AM MST) Answer
- Yes. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 475
Section 2.3, Definitions, Participating Addendum: Will participants be required to use a particular template for negotiation of the Participating Addendum? (Submitted: Jan 29, 2016 10:41:02 AM MST) Answer
- Yes. After contract have been awarded NASPO ValuePoint will create a participating addendum template which can be negotiated during the participating addendum stage. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 476
Section 2.7.2, Master Agreement: Why does the State need the RFP and the Exhibits, Attachments, and the winning proposal to be part of the final master agreement? The relevant and binding terms of the agreement should consist of the final negotiated agreement and should not need to include terms that have been superseded by final negotiations. Further, very rarely are proposals submitted in a contractual format as they are usually materials intended to showcase the features of the products and services and provide information to the buyer. (Submitted: Jan 29, 2016 10:41:25 AM MST)
Answer
- 2.7.2 has been modified as follows: The Master Agreement(s) awarded from this RFP will consist of the negotiated Master Agreement Terms and Conditions, the relevant Scope of Services, the Offerorâ€™s Cost Proposal form, and the winning Offerorâ€™s Proposal as revised (if permitted) and accepted by the Lead State.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 395
#15..
- 726 -
should consist of the final negotiated agreement and should not need to include terms that have been superseded by final negotiations. Further, very rarely are proposals submitted in a contractual format as they are usually materials intended to showcase the features of the products and services and provide information to the buyer. (Submitted: Jan 29, 2016 10:41:25 AM MST)
Answer
- 2.7.2 has been modified as follows: The Master Agreement(s) awarded from this RFP will consist of the negotiated Master Agreement Terms and Conditions, the relevant Scope of Services, the Offerorâ€™s Cost Proposal form, and the winning Offerorâ€™s Proposal as revised (if permitted) and accepted by the Lead State. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 477
Section 2.7.2, Master Agreement: Is the State willing to consider a proposal that takes exception to the requirement to include the RFP and proposal in the agreement? (Submitted: Jan 29, 2016 10:41:47 AM MST) Answer
- Yes, it will consider it, but the evaluation committee will score it as well. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 478
Section 2.7.2, Master Agreement: Is the State willing to consider a proposal that takes exception to the proposal being last in the order of precedence? (Submitted: Jan 29, 2016 10:42:37 AM MST) Answer
- Exceptions must be in accordance with Section 3.4. (Answered: Feb 1, 2016 3:40:06 PM MST) Question 479
Section 2.14.1, NASPO ValuePoint eMarket Center; Section 5.5.3: Will SciQuest require the successful vendor to sign or agree to any terms applicable to the online website? (Submitted: Jan 29, 2016 10:43:21 AM MST) Answer
- No. (Answered: Feb 1, 2016 4:29:33 PM MST)
Question 480
Section 3.8, Firm Offers and Section 5.2.8: This vendor is willing to hold pricing firm for 180 days, but does not intend to submit a contract that may be accepted without further negotiation. Is the State willing to consider such a proposal? (Submitted: Jan 29, 2016 10:47:17 AM MST)
Answer
- 3.8 has been removed from the RFP document, since Offerors will be providing minimum discounts. (Answered:

Feb 1, 2016 2:43:08 PM MST)
Question 481
Section 3.12.7, Section Title: Confidential, Protected or Proprietary Information: With regard to the release from obligation or liability in the last sentence of this section, is the State willing to provide notice to the vendor of any observed noncompliance as well as of any request for release of the vendorâ€™s confidential business information? (Submitted: Jan 29, 2016 10:48:09 AM MST)
Answer
- If a request comes to the state of utah for any information that the offeror has labeled as confidential then the state will deny the request. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 482
Section 3.14, References and Experience: Please provide a copy of the type of release that the Offeror could be required to sign. (Submitted: Jan 29, 2016 10:48:46 AM MST) Answer
- 3.14 has been deleted from the RFP. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 483
Section 3.14, References and Experience: Please confirm also that by submitting a proposal, the Offeror is not required to waive any rights of confidentiality, contractually or otherwise. (Submitted: Jan 29, 2016 10:49:28 AM MST) Answer
- 3.14 has been deleted from the RFP. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 484
Section 4.1.1, Initial Review of Proposals; Section 4.3.1, Evaluation Process: Section 4.1.1 indicates that proposals not meeting the Mandatory Submission Requirements may be found non-responsive, but implies that discretion is given to the State to make such decision. Further, Section 4.3.1 indicates that it is the failure to provide a response to the mandatory requirement where indicated that will result in disqualification. Therefore, if the Offeror provides a response to the requirement, but does not indicate 100% compliance with the requirement in such response, how will the State determine whether the Offeror will pass or fail on that requirement? (Submitted:

Jan 29, 2016 10:56:19 AM MST)
Answer
- By providing a response the Offeror will pass, but an Offeror's response may determine what, if any, contract award it may get if it meets the technical minimum point threshold. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 485
Section 5, Mandatory Minimum Requirements: Please explain further the statement that the items described in section 5 are non-negotiable. (Submitted: Jan 29, 2016 10:56:52 AM MST) Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 396
#15..
- 727 -
Answer
- By providing a response the Offeror will pass, but an Offeror's response may determine what, if any, contract award it may get if it meets the technical minimum point threshold. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 485
Section 5, Mandatory Minimum Requirements: Please explain further the statement that the items described in section 5 are non-negotiable. (Submitted: Jan 29, 2016 10:56:52 AM MST) Answer
- An Offeror must provide a response to each requirement. If an Offeror believes that a requirement is not applicable to its offering then it must describe that in its response to each subsection in Section 5. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 486
How does the scale pricing work? Obviously, each respondent provides a different product and therefore will have completely different pricing. Some software offerings are based on a per seat; some on a "pay as you go" metered, some on a volume unit--could be a government budget, geography, etc.--How is the evaluation measured equally when different metrics can be used for cost? Something like that. Just for consideration. (Submitted: Jan 29, 2016 10:57:20 AM MST)
Answer
- Offerors are required to provide a minimum discount for each of its offerings regardless of its pricing structure.

This will help participating/purchasing entities make a best value determination in selecting an awarded contractor. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 487
Section 5, Mandatory Minimum Requirements: Will the State consider proposals that describe the extent to which they can comply with each requirement and then take exception to the extent they cannot comply? (Submitted:

Jan 29, 2016 10:57:20 AM MST)
Answer
- Yes. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 488
Section 5.2.2: Is the State willing to consider a vendor who is not able to indicate acceptance of and willingness to comply with all the requirements of the RFP and exhibits if the vendor addresses and explains the extent to which the vendor can comply? This is implied in section 5.2, Executive Summary, which instructs Offerors to include any requirements that cannot be met. (Submitted: Jan 29, 2016 10:58:21 AM MST) Answer
- Yes. The State is willing to consider a response, but this does not guarantee a contract award. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 489
Sections 5.5.6 and 5.6.8: Is the State willing to consider allowing the vendor to use/access its data for purposes of services analysis and audit purposes? (Submitted: Jan 29, 2016 10:59:07 AM MST) Answer
- Each participating addendum will address specific regarding this requirements. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 490
Section 5.6.11: Is the State willing to consider a proposal in which the Offeror agrees to perform services as described in the final negotiated agreement between the parties? (Submitted: Jan 29, 2016 10:59:41 AM MST) Answer
- Yes. The state will accept this proposal, but it is subject to evaluation by the evaluation committee and still must meet the minimum point thresholds established in the RFP. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 491
Based off the categories in Attachment G, where/how should we provide pricing for Managed Services offerings? (Submitted: Jan 29, 2016 11:01:00 AM MST)
Answer
- All offering must meet the requirements and technical criteria of this RFP. It must meet NIST standards, so offerings must be SaaS, Paas, or IaaS. (Answered: Feb 1, 2016 3:40:06 PM MST) Question 492
Section 8.2.2: What does the State consider to be a subcontractor? Are subcontractors hired specifically for purposes of performing this agreement? (Submitted: Jan 29, 2016 11:06:58 AM MST) Answer
- Subcontractor means any organization, whether designated as a subcontractor , fulfillment partner, reseller, etc., that will assist an Offeror to provide an Offering if awarded a Master Agreement. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 493
Section 8.2.2: Does the Offeror need to describe (as subcontractors) third parties involved generally in assisting the Offeror with its cloud services operations? (Submitted: Jan 29, 2016 11:07:33 AM MST) Answer
- Yes. It would be helpful for the evaluation committee to know this informaiton. (Answered: Feb 1, 2016 2:43:08 PM State of Utah Bid CH16012
3/22/2016 4:23 PM p. 397
#15..
- 728 -
that will assist an Offeror to provide an Offering if awarded a Master Agreement. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 493
Section 8.2.2: Does the Offeror need to describe (as subcontractors) third parties involved generally in assisting the Offeror with its cloud services operations? (Submitted: Jan 29, 2016 11:07:33 AM MST) Answer
- Yes. It would be helpful for the evaluation committee to know this informaiton. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 494
If an Offeror wishes to proposes its commercial terms as an exception to an RFP requirement which is not specifically in the Master Ts and Cs, should it submit those commercial terms as an exception in its proposal, and not as a question via BidSync? If an Offeror only proposes and submits its commercial terms as an exception to the Master Ts and Cs when it submits its final proposal will that Offerorâ€™s exceptions be allowed or considered responsive since it was not addressed in the Q&A period per section 3.1 of the RFP? (Submitted: Jan 29, 2016 11:23:52 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 495
Is the State willing to extend the due date of the RFP to accommodate for detailed response? Our company has an extensive offering for services listed in the NIST model and value add services. We'd like to ensure we capture the proper response from all our resources that need to be engaged. We can ensure this with a 2 week extension to the close date of the RFP. Thank you. (Submitted: Jan 29, 2016 11:24:46 AM MST) Answer
- No. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 496
Unduly restrictive -

1. RFP Section 5.2.5 prohibits employment of â€œany company or person other than a bona fide employee working solely for the Offeror or a company regularly employed as its marketing agent, to respond to the RFP.â€ What about cases where authorized resellers or value added resellers of a service provider wish to submit proposals as prime contractors, for the purpose of providing cloud services for which the cloud service provider sells via an â€œindirect through resellerâ€ sales model â€“ is this allowed? (Submitted: Jan 29, 2016 11:26:14 AM MST)
Answer
- 5.2.5 has now been removed from the final version of the RFP. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 497
Unduly restrictive -

2. RFP Section 5.5.12 refers to SLA requirements in RFP Section 8.13. But Section 8.13 appears to apply to the STAR Registry Self-Assessment, not SLA. Is this a typo, and if so then what section was intended? If not, please explain the relationship to SLA. (Submitted: Jan 29, 2016 11:26:30 AM MST) Answer
- The reference should be to 8.12. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 498
Unduly restrictive -

3. RFP Section 9.1 requires that Offerors bid a minimum discount off of their published government price catalog.

4. Attachment A contains the defined terms â€œDisabling Code,â€ â€œFulfilment Partner,â€ and that do not appear to be used anywhere in that Attachment or the other RFP documents. Please advise if, and how, NASPO intends to use these terms in the Master Agreement. (Submitted: Jan 29, 2016 11:27:02 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal.

Fullfillment partner has been added to the definition of a subcontractor. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 500
Unduly restrictive -

5. Section 9 of Attachment A (â€œRight to Publishâ€ ) appears to prohibit any sort of mention of the Agreement without advance permission. Will a Contractor need to seek permission in each case where it wants to alert a prospective Purchasing Entity in a Participating State of the existence of the Master Agreement, in order that the Contractor may encourage the prospective Purchasing Entity to utilize the Master Agreement for its needs? (Submitted: Jan 29, 2016 11:27:15 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 501
Unduly restrictive -

6. RFP Section 7.2 requires incorporation of all Attachments. If an exception is not taken to Attachment E would an offeror be bound by those state specific terms and conditions when they attempt to negotiate a Participating Addendum with that respective State? Must exceptions to Attachment Eâ€™s state specific terms and conditions be taken at this phase? Or will additional time be granted for Offerors to prepare exceptions to the Participating Addenda in Attachment E? (Submitted: Jan 29, 2016 11:27:29 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 502
Unduly restrictive -

7. In each of the Exhibits 1 and 2 to Attachment A, please explain what is meant by the section titled â€œWeb Servicesâ€ which says â€œthe Contractor shall use Web services exclusively to interface with the Purchasing Entityâ€™s data in near real time.â€ (Submitted: Jan 29, 2016 11:27:46 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Feb 1, 2016 2:43:08 PM MST) Question 503
General Provisions, Section 18, Performance and Cost Analysis : Please clarify how the price and service elements may be negotiated during the term of the contract. Will there be an amendment process? (Submitted: Jan 29, 2016 11:30:37 AM MST)
Answer
- There is an amendment process in which both parties must agree to changes by mutual written agreement. (Answered: Feb 1, 2016 3:40:06 PM MST)
Question 504
Section 2.3, Definitions, Eligible Users: How will the vendor know which users the Participating Entity/State has determined to be eligible so that orders are not taken from ineligible entities in that Entity/State? May we ask the Participating Entity/State for a list or for clarification on who is eligible? (Submitted: Jan 29, 2016 11:31:20 AM MST) Answer
- The participating addendum will address which the eligible users for each state. (Answered: Feb 1, 2016 2:43:08 PM MST)
Question 505
Section 2.5, Participating States: Will the state terms in Attachment E be excluded from the final master agreement (from the RFP if it is required to be included), since they are not part of the terms of the master? (Submitted: Jan 29, 2016 11:32:38 AM MST)
Answer
- Yes. Attachment E is for reference purposes only. (Answered: Feb 1, 2016 1:27:53 PM MST) Question 506
Section 2.7.2, Master Agreement: Would the State be willing to consider attaching the RFP and proposal as information exhibits to the final agreement for historical purposes but capture all final binding terms and requirements in the master agreement itself? (Submitted: Jan 29, 2016 11:33:19 AM MST) Answer
- That is the intent. The final agreement will consist of the final negotiated terms. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 507
Section 3.4, Exceptions to RFP and NASPO ValuePoint Master Agreement Terms and Conditions: This vendor does refer to URLs in its agreement terms and will likely need to provide them in the exceptions to the RFP, although the vendor does not wish its proposal to be rejected as nonresponsive. May we reference a URL so long as we include the text of the referenced page(s) for information purposes? (Submitted: Jan 29, 2016 11:34:14 AM MST) Answer
- Yes. (Answered: Feb 1, 2016 1:27:53 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 399
#15..
- 730 -
6 Question 507
Section 3.4, Exceptions to RFP and NASPO ValuePoint Master Agreement Terms and Conditions: This vendor does refer to URLs in its agreement terms and will likely need to provide them in the exceptions to the RFP, although the vendor does not wish its proposal to be rejected as nonresponsive. May we reference a URL so long as we include the text of the referenced page(s) for information purposes? (Submitted: Jan 29, 2016 11:34:14 AM MST) Answer
- Yes. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 508
Can service resources be in foreign contries as long as they are accessing data in domestic (US) data centers? (Submitted: Jan 29, 2016 11:35:01 AM MST)
Answer
5 centers? (Submitted: Jan 29, 2016 11:35:01 AM MST)
Answer
- In some cases yes. However, some states may have requirements that prohibit this practice. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 509
Section 5.5.15: Is the State willing to consider having the Purchasing Entity sign the Offerorâ€™s Business Associate Agreement? (Submitted: Jan 29, 2016 11:35:08 AM MST) Answer
- This issue would need to be discussed in the participating addendum stage and the SOW stage. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 510
Section 5, Mandatory Minimum Requirements: This vendor would be pleased to explain how its service compares to the minimum requirements set forth in Section 5, Mandatory Minimum Requirements; however, given that this vendor intends to propose already-existing, commercially available services, it is not possible to certify conformance with all of these requirements in the manner required in the RFP. For example, in many solicitations for commercial software products, the customer provides a table of requirements for the vendor to indicate where their product meets the requirement, could meet the requirement with customization, or is not able to meet the requirement. The vendor is then given an opportunity to explain briefly for evaluation purposes. Would the State consider allowing vendors to take a similar approach to the minimum requirements for the cloud services, by allowing them to indicate if the service meets the requirement with no conditions; could meet under certain conditions; or would not meet? (Submitted: Jan 29, 2016 11:35:58 AM MST) Answer
- Yes. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 511
Section 5.5.4: This vendor does not certify with regard to accessibility. Would the State consider a response that identifies how the vendor makes the service available for people with disabilities? (Submitted: Jan 29, 2016 11:36:40

AM MST)
Answer
- Yes. The term "certify" has been removed from the RFP. Offerors are now required to describe how its offerings meet the requirements. (Answered: Feb 1, 2016 3:40:06 PM MST) Question 512
Can the cloud provider provide options for guaranteed domestic (US) only data residency as well as services that may replicate the data to foreign countries under this contract? If the service provide is restricted to domestic only services, then there is often a cost premium associated with those services and may limit the complimentary on-and off platfor applications and ecosystem that can be utilized. (Submitted: Jan 29, 2016 11:39:29 AM MST) Answer
- Offerors should discuss this in their proposals, but should not that certain data needs to reside in the US. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 513
Can a respondent be included as a subcontractor for another respondent and a direct respondent ? (Submitted:

Jan 29, 2016 11:41:07 AM MST)
Answer
- Yes. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 514
Is there a standard set of payment terms associated with this NASPO agreement, or will specific terms be negotiated between the vendor and each participating state? (Submitted: Jan 29, 2016 11:43:04 AM MST) Answer
- Payment terms can be discussed in the Master Agreement Terms and Conditions, as an exception/addition. But they may be negotiated in the participating addendum stage. (Answered: Feb 1, 2016 1:27:53 PM MST) Question 515
Can you please advise where in the response vendors should include our payment terms? (Submitted: Jan 29, 2016 11:44:07 AM MST)
Answer
- Payment terms can be discussed in the Master Agreement Terms and Conditions, as an exception/addition. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 516
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 400
#15..
- 731 -
Question 515
Can you please advise where in the response vendors should include our payment terms? (Submitted: Jan 29, 2016 11:44:07 AM MST)
Answer
- Payment terms can be discussed in the Master Agreement Terms and Conditions, as an exception/addition. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 516
Per RFP page 53, Clause 16. Insurance. (1) Commercial General Liability. We will meet these requirements with a combination of primary and umbrella liability limits. Please advise if this is acceptable. (2) Cloud Minimum Insurance Coverage. Insurance with limits associated with Low, Moderate or High risk. Our company has limits of $3,000,000 Each Claim / Policy Aggregate for Tech E&O/Cyber. Please clarify what we are required to provide. (2) (d) (1) Our General Liability policy has a blanket Additional Insured endorsement that would automatically include those entities requiring to be additional insureds when required by written contract. The endorsement will not specifically name any Additional Insureds. Please clarify if this is acceptable. (2) (d) (2) We are not able to commit to terms obligating our insurer in reference to their non-renewal, cancellation, revocation terms, to include prior notice(s). Please clarify as this language appears overly restrictive. (Submitted: Jan 29, 2016 11:45:27 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Feb 1, 2016 1:27:53 PM MST) Question 517

1. What are there definite projects or milestones that you are looking to achieve? Examples:
1) Cloud single sign on
2) Disaster Recovery
3) Big data and analytics
4) Cloud migration
5) 365 mailbox migration (Submitted: Jan 29, 2016 11:48:18 AM MST) Answer
- Offerors' proposals should address each of this issues. (Answered: Feb 1, 2016 1:27:53 PM MST) Question 518
Do any of the participating states already have a cloud environment either test or production? (Submitted: Jan 29, 2016 11:48:33 AM MST)
Answer
- Yes some states have cloud environments, but this information was not gathered as part of this RFP. (Answered:

Feb 1, 2016 1:27:53 PM MST)
Question 519
Is continuous development and Dev Ops apart of this initiative? (Submitted: Jan 29, 2016 11:48:53 AM MST) Answer
- Please refer to the RFP. (Answered: Feb 1, 2016 1:27:53 PM MST) Question 520
How are you looking to handle the multiple tenancy environment? a) Are they looking to give each state their own tenancy? (Submitted: Jan 29, 2016 11:49:11 AM MST) Answer
- Each purchasing entity will be its own user. (Answered: Feb 1, 2016 1:27:53 PM MST) Question 521
Is there any reason that one state would ever need access to another states subscriptions? (Submitted: Jan 29, 2016 11:49:24 AM MST)
Answer
- No, unless the State's have come to some agreement. (Answered: Feb 1, 2016 1:27:53 PM MST) Question 522
What kind of presales cloud assessment is required per state? IE: planning, data collection, workshops? Is there going to be a standardized process per location? (Submitted: Jan 29, 2016 11:49:43 AM MST) Answer
- This will be determined by the participating entities and purchasing entities. (Answered: Feb 1, 2016 3:40:06 PM MST) Question 523
What level of involvement would you prefer the solution provider to have, if they are a reseller? (Submitted: Jan 29, 2016 11:50:10 AM MST)
Answer
- Any offeror must be involved with the purchase and implementation of any solution provided under this RFP. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 524
Section 1, Administrative Information: Will the price to be paid by each Participating Entity for products be the same regardless of whether the entityâ€™s fees are? (Submitted: Jan 29, 2016 11:50:48 AM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 401
#15..
- 732 -
Answer
- Any offeror must be involved with the purchase and implementation of any solution provided under this RFP. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 524
Section 1, Administrative Information: Will the price to be paid by each Participating Entity for products be the same regardless of whether the entityâ€™s fees are? (Submitted: Jan 29, 2016 11:50:48 AM MST) Answer
- Yes. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 525
Attachment F: Is the State willing to allow reporting based on invoicing total rather than the purchase total? We do not bill in advance for government customers generally. (Submitted: Jan 29, 2016 11:51:16 AM MST) Answer
- Reference to Attachment F has been removed from the final RFP document. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 526
Attachment F: What is the estimated net revenue on the usage report defined as? (Submitted: Jan 29, 2016 11:51:42 AM MST)
Answer
- Reference to Attachment F has been removed from the final RFP document. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 527
What does the term Web Services mean as referenced in Attachment A -Exhibit 1 - 21? (Submitted: Jan 29, 2016 11:52:04 AM MST)
Answer
- This question has been answered up above. (Answered: Feb 1, 2016 3:40:06 PM MST) Question 528
Attachment F: What do the â€œfromâ€ and â€œtoâ€ dates represent â€“ reporting period dates? (Submitted:

Jan 29, 2016 11:52:09 AM MST)
Answer
- Reference to Attachment F has been removed from the final RFP document. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 529
As part of this solution are you looking to use cloud identity services? If so is there a single sign on component? How many users? How many applications? (Submitted: Jan 29, 2016 11:52:10 AM MST) Answer
- Each purchasing entity's preference are different. As such, the evaluation committee will review all responsive proposals to determine if they meet the minimum point threshold. (Answered: Feb 1, 2016 3:40:06 PM MST) Question 530
Is there preference to use a combination of commoditized services like email and instant messaging? As well as infrastructure as a service for the remaining workloads? Or do you have preference towards platform with high developer involvement? (Submitted: Jan 29, 2016 11:52:30 AM MST) Answer
- Each purchasing entity's preference are different. As such, the evaluation committee will review all responsive proposals to determine if they meet the minimum point threshold. (Answered: Feb 1, 2016 3:40:06 PM MST) Question 531
Attachment F: We may not always know the â€œshipâ€ date for this type of product â€“ may we be allowed to provide this â€œif available?â€ (Submitted: Jan 29, 2016 11:52:41 AM MST) Answer
- Reference to Attachment F has been removed from the final RFP document. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 532
Are you currently leveraging Hadoop or any big data platforms? If not are you looking at making this is scope for part of the project? (Submitted: Jan 29, 2016 11:53:05 AM MST) Answer
- The awarded contracts will allow Participating Entities to choose cloud solutions that meet the following descriptions:
â€¢ Commercially available cloud computing services
â€¢ Meets the National Institute for Standards and Technology (NIST) definition of Cloud Computing â€¢ Open to all deployment models (private, public, community or hybrid), vendors specify deployment models (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 533
Attachment F: Is â€œEnd User Accountâ€ the customer name? (Submitted: Jan 29, 2016 11:53:08 AM MST) Answer
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 402
#15..
- 733 -
â€¢ Meets the National Institute for Standards and Technology (NIST) definition of Cloud Computing â€¢ Open to all deployment models (private, public, community or hybrid), vendors specify deployment models (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 533
Attachment F: Is â€œEnd User Accountâ€ the customer name? (Submitted: Jan 29, 2016 11:53:08 AM MST) Answer
- Reference to Attachment F has been removed from the final RFP document. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 534
Are the FedRAMP and NIST compliance requirements extended to both the solution provider as well as the cloud platform?
a)Is the solution provider required to meet the same level of encryption and data protection standards as the cloud platform its self? (Submitted: Jan 29, 2016 11:53:23 AM MST) Answer
- The solution provider should provide how its cloud platform meets these requirements. (Answered: Feb 1, 2016 3:40:06 PM MST)
Question 535
Participating Entity Data is used in the Master Terms but it is not defined. Can this be defined in the Master Terms? To be specific to the various types of data, we would like to recommend the following data definitions be included in the Master Terms
Customer Data Customer Data is all data (including text, audio, video or image files) that is provided to Cisco in connection with your use of our products or services. Customer Data does not include Administrative Data, Payment Data, Support Data or Telemetry Data, as defined below.

Administrative Data Administrative Data is information about customer representatives provided during sign-up, purchase or contracting, or management of products or services. This may include name, address, phone number, IP address and email address, whether collected at the time of the initial agreement or later during management of the products or services.

Payment Data Payment Data is the information that you provide when making a purchase or entering into a licensing agreement for products or services. This may include name, billing address, payment instrument number, the security code associated with your payment instrument and other financial data. (Submitted: Jan 29, 2016 11:53:38 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Feb 1, 2016 1:27:53 PM MST) Question 536
Is each state going to have their own security requirements in addition to the FedRAM & NIST requirements? (Submitted: Jan 29, 2016 11:53:38 AM MST)
Answer
- Some State may have their own security requirements that will be discussed in each state's participating addendum. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 537
Do you need managed services to support this solution? If so Is that managed support required to meet FedRAMP and NIST compliance? (Submitted: Jan 29, 2016 11:53:59 AM MST) Answer
- If an Offeror does not believe that its services need to meet a requirement identified in the RFP then it needs to address that in its proposal, so that its proposal can be evaluated fairly. (Answered: Feb 1, 2016 1:27:53 PM MST) Question 538
Participating Entity Data is used in the Master Terms but it is not defined. Can this be defined in the Master Terms? To be specific to the various types of data, we would like to recommend the following data definitions be included in the Master Terms.

Support Data Support Data is the information we collect when you submit a request for support services or other troubleshooting, it may include information about hardware, software, and other details related to the support incident, Examples of details include authentication information, information about the condition of the product, system and registry data about software installations and hardware configurations, and error-tracking files.

Support Data does not include log, configuration or firmware files, or core dumps, taken from a product and provided to us to help us troubleshoot an issue in connection with a support request.

Telemetry Data Telemetry Data is samples of email, web and network traffic, including but not limited to data on email message and web request attributes and information on how different types of email messages and web requests were handled by or routed through Cisco products. Email message metadata and web requests included in Telemetry Data are anonymized or otherwise obfuscated to remove any personally identifiable information prior to disclosure to any unrelated third party. (Submitted: Jan 29, 2016 11:55:14 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Feb 1, 2016 1:27:53 PM MST) Question 539
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 403
#15..
- 734 -
requests were handled by or routed through Cisco products. Email message metadata and web requests included in Telemetry Data are anonymized or otherwise obfuscated to remove any personally identifiable information prior to disclosure to any unrelated third party. (Submitted: Jan 29, 2016 11:55:14 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Feb 1, 2016 1:27:53 PM MST) Question 539
In the Master Terms Exhibit 1, under Data Protection, a requirement that all Personal Data and Non-Public Data shall be encrypted at rest and in transit with controlled access. Since the type of data and its level of risk is not known until a Purchasing Entity decides on what they are looking to move to the cloud, we recommend that any requirement to encrypt data at rest be limited to the SOW, Task Order, and/or SLA that is negotiated at the time that End User Customer requirements are known. We feel that this requirement is not valid in a Master Agreement terms and as such should be applied at time of End User Agency requirements. Therefore, please change the requirement to only ask for encryption at rest and in transit, if applicable at the time of the SOW/SLA. (Submitted: Jan 29, 2016 11:55:38 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Feb 1, 2016 1:27:53 PM MST) Question 540
Can State and Contractor agree, in the SLA, what Non-Public Data shall be encrypted at rest, instead of an agreement that all Non-Public Data is encrypted at rest? (Submitted: Jan 29, 2016 11:55:56 AM MST) Answer
- Yes. This exception should take place during the participating addendum stage. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 541
May contractor use Data or processes of Purchasing Entity data for purposes of forensic analysis of data security and/or breach? (Submitted: Jan 29, 2016 11:56:18 AM MST) Answer
- Offeror must take this exception/addition in (Answered: Feb 1, 2016 1:27:53 PM MST) Question 542
Section 19 Business Continuity and Disaster Recovery: Can this apply on a product by product basis. Not all products have disaster recovery. (Submitted: Jan 29, 2016 11:56:26 AM MST) Answer
- Yes. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 543
May Data Destruction requirements be negotiated in the applicable SLA, depending on the applicable cloud service offering? (Submitted: Jan 29, 2016 11:56:35 AM MST) Answer
- Yes, the exact requirement may be negotiated in an SLA; however, an Offeror must list its data disposal procedures and policies and destruction confirmation process in response to Section 8.11.. (Answered: Jan 29, 2016 1:48:32 PM MST)
Question 544
May Contractor comply with a validated cryptography standard instead of compliance with FIPS 140-2? (Submitted: Jan 29, 2016 11:56:53 AM MST)
Answer
- If an Offeor is intending to do so then it must identify that in its proposal. And then the evaluation committee will evaluate the proposal accordingly. (Answered: Feb 1, 2016 1:27:53 PM MST) Question 545
Can State refine the Data Breach definition to exclude any breach that has not been validated as an actual breach? (Submitted: Jan 29, 2016 11:57:46 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Jan 29, 2016 1:48:32 PM MST) Question 546
Section 5.5.12: Is the state willing to accept an SLA of 99.5% instead of 99.9? (Submitted: Jan 29, 2016 11:58:09 AM MST)
Answer
- Yes. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 547
MAster Agreement, 20.h. Resale. Subject to any explicit permission in a Participating Addendum, Purchasing Entities may not resell goods, software, or Services obtained under this Master Agreement. This limitation does not prohibit: payments by employees of a Purchasing Entity as explicitly permitted under this agreement; sales of goods to the general public as surplus property; and fees associated with inventory transactions with other governmental or nonprofit entities under cooperative agreements and consistent with a Purchasing Entityâ€™s State of Utah Bid CH16012
3/22/2016 4:23 PM p. 404
#15..
- 735 -
6 - Yes. (Answered: Feb 1, 2016 1:27:53 PM MST)
Question 547
MAster Agreement, 20.h. Resale. Subject to any explicit permission in a Participating Addendum, Purchasing Entities may not resell goods, software, or Services obtained under this Master Agreement. This limitation does not prohibit: payments by employees of a Purchasing Entity as explicitly permitted under this agreement; sales of goods to the general public as surplus property; and fees associated with inventory transactions with other governmental or nonprofit entities under cooperative agreements and consistent with a Purchasing Entityâ€™s laws and regulations. Any sale or transfer permitted by this subsection must be consistent with license rights granted for use of intellectual property.

Question: will the state please clarify what the following language means: "...and fees associated with inventory transactions with other governmental or nonprofit entities under cooperative agreements and consistent with a Purchasing Entityâ€™s laws and regulations...."
For example, to what type of fees is the state referring? What inventory? What transactions? (Submitted: Jan 29, 2016 11:59:21 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. (Answered: Feb 1, 2016 3:40:06 PM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 405
#15..
- 736 -
carahsoft
CARAHSOFTげS RESPONSE TO THE
State of Utah
NASPO ValuePoint

REQUEST FOR PROPOSAL
NASPO ValuePoint Master Agreement for Cloud Solutions
SOLICITATION NO. CH16012
Technical Proposal
Thursday
March 10, 2015
CARAHSOFT TECHNOLOGY CORP.
1860 MICHAEL FARADAY DRIVE, SUITE 100
RESTON, VA 20190
888.66.CARAH | WWW.CARAHSOFT.COM
#15..
- 737 -
1860 MICHAEL FARADAY DRIVE | SUITE 100 | RESTON, VA 20190 | TEL 703 871 8500 | FAX 703 871 8505 | WWW.CARAHSOFT.COM March 10, 2015
State of Utah Division of Purchasing
3150 State Office Building
Capitol Hill
Salt Lake City, Utah 84114
Re: Carahsoft’s Response to the State of Utah’s Request for Proposal for NASPO ValuePoint Master Agreement for Cloud Solutions, Solicitation # CH16012.

Dear Mr. Hughes,
Carahsoft Technology Corp. appreciates the opportunity to respond to the State of Utah’s Request for Proposals/Q/Information for Project Description.

5.2.1 Carahsoft Technology Corporation understands that they may be required to negotiate additional terms and conditions, including additional administrative fees, with Participating Entities when executing a Participating Addendum.

5.2.2 When writing this response Carahsoft utilized the OEMs being proposed as a part of this response to assist in preparing this response. Staff responsible for creating this proposal include Robert R. Moore – Vice President, Jack Dixon – Contract Specialist, & David Holl – Proposal Coordinator.

5.2.3 Carahsoft Technology Corporation is not currently suspended, debarred or otherwise excluded from federal or state procurement and non-procurement programs.

5.2.4 Carahsoft Technology Corporation acknowledges that a 0.25% NASPO ValuePoint Administrative Fee and any Participating Entity Administrative fee will apply to total sales for the Master Agreement(s) awarded from the RFP.

5.2.5 Carahsoft Technology Corporation is including an all-encompassing list of solutions in this response which covers the SaaS, PaaS, & IaaS categories. Services completion/deployment will vary based on manufacturer but will utilize either the manufacturers own integration policies and procedures or a third party subcontractor specializing in servicing the manufacturers’ specific solution.

5.2.6 Carahsoft can provide varying levels of data risk support based on customer requirements, manufacturer, and solution type. Please see our response to Attachment H for further detail.

Please feel free to contact me directly at 703.871.8504/[email protected] or Jack Dixon at 703.230.7545/[email protected] with any questions or communications that will assist the Agency in the evaluation of our response. This proposal is valid for 90 days from the date of submission.

Thank you for your time and consideration.

Sincerely,
Robert R. Moore
Vice President
#15..
- 738 -
SOLICITATION # CH16012
i

TABLE OF CONTENTS
RFP Signature Page ........................................................................................................... 1 Acknowledgement of Amendments .................................................................................. 4 Executive Summary ............................................................................................................ 6 Prime Contractor: Carahsoft Technology Corp.................................................................................... 6 Mandatory Minimums ......................................................................................................... 8 Business Profile................................................................................................................ 12 Organizations Profile ........................................................................................................ 21 Technical Response ......................................................................................................... 23 Confidential, Protected, or Proprietary Information ..................................................... 183 Exceptions and/or Additions to the Standard Terms and Conditions ........................ 185 In Summary ..................................................................................................................... 186 Supplemental Information .............................................................................................. 187 #15..
- 739 -
SOLICITATION # CH16012
1 RFP SIGNATURE PAGE
The Lead State’s Request for Proposal Signature Page completed and signed. See Section 5.1 of the RFP.

Please find below Carahsoft’s RFP Signature Page below. #15..
- 740 -
#15..
- 741 -
#15..
- 742 -
SOLICITATION # CH16012
4 ACKNOWLEDGEMENT OF AMENDMENTS
Please find below Carahsoft’s Acknowledgement of Amendments. #15..
- 743 -
#15..
- 744 -
SOLICITATION # CH16012
6 EXECUTIVE SUMMARY
The one or two page executive summary is to briefly describe the Offeror's Proposal. This summary should highlight the major features of the Proposal. It must indicate any requirements that cannot be met by the Offeror. The Lead State should be able to determine the essence of the Proposal by reading the executive summary. See Section 5.4 of the RFP.

Prime Contractor: Carahsoft Technology Corp.

Carahsoft Technology Corporation understands that the State of Utah & NASPO ValuePoint is seeking a Master Agreement for Cloud Solutions.

Carahsoft has assembled a team from our vast portfolio of over 200 hundred vendors that includes our premiere network of cloud solutions, resellers, and subcontractors as the best solution to meet the State of Utah’s requirements. The intent of our proposal is to deliver the highest value proposition at the lowest possible cost to the State of Utah, NASPO ValuePoint, & all participating entities for the acquisition of cloud solutions. Carahsoft understands the need for high quality cloud based service providers that have the ability to provide a menu of cloud solution offerings. Carahsoft’s superior contract management and network of Cloud Solution Providers will ultimately increase the State & Participating Entities overall efficiency, reduce costs, improve operational scalability, provide business continuity, increase collaboration efficiencies, and all for expanded flexibility.

Carahsoft Technology Corp. is an IT solutions provider delivering best-of-breed hardware, software, and support solutions to federal, state and local government agencies since 2004. Carahsoft has built a reputation as a customer-centric real-time organization with unparalleled experience and depth in government sales, marketing, and contract program management. This experience has enabled Carahsoft to achieve the top spot in leading software license GSA resellers.

VENDOR RELATIONSHIPS – Just as each state, territory, and participating entity is unique in how they employ cloud solutions, Carahsoft’s cloud offering follows a unique business model focusing on providing superior sales and marketing execution, a track record of success, high integrity, and a focus on strategic vendor relationships.

PROVEN EXECUTION (Growth and Experience of Sales) – Carahsoft has been supporting the IT needs of Government and Education Customers for more than 12 years. Our Public Sector Sales Team supports the Government, Education, and Healthcare vertical markets and is an enormous component of Carahsoft’s ongoing and continued growth. In 2014, Carahsoft had revenues of over $2B in the public sector market.

Our State & Local Government Sales Force is solely dedicated to supporting the unique needs of Higher Education, K┽ 12 Schools, State Government, and Local Government customers.

CONTRACT VEHICLES – Over the past ten years Carahsoft has acquired and maintained a wide variety of purchasing contract vehicles for agencies at the state, local, and federal levels. Carahsoft holds statewide contracts in many states across the country, and we have a great deal of experience with contract transitions. Associated with all contracts are dedicated and experienced contract management resources.
#15..
- 745 -
SOLICITATION # CH16012
7 Carahsoft has leveraged its vast contracting experience and extended it to quoting and order management.

Carahsoft seamlessly generates quotes within 30 minutes or less and processed over 56,000 orders in 2014 that were each completed the same day received.

GROWTH & STABILITY – Carahsoft has continued to show impressive growth year after year, turning annual revenue from $3.4 million in our first year in 2004 to $1.065 billion in 2011, $1.465 billion in 2012, $1.8 billion in 2013, and $2.45 billion in 2014. In September of 2014, 7,501 orders were processed worth over $626 million. We are a stable, conservative, and profitable company and have received numerous accolades including the 2013 GovCon Government Contractor of the Year Award in the greater than $300M revenue category. Carahsoft was also recognized in the following areas:
 Largest GSA Schedule 70 Contract holder for software
 7
th of the Washington Business Journal’s 100 Largest Private Companies List for 2014
 2012 Federal 100 Winner, Craig P. Abod, President and CEO  2013 Federal 100 Winner, John Lee, Vice President of Cloud Services As a part of this response Carahsoft has utilized multiple Cloud Solution Vendors, covering all of the Cloud Solution Categories; SaaS, IaaS, PaaS. Carahsoft’s strong vendor relationships and partner ecosystem have created an efficient and cost effective response which encompasses all vendor solutions into a single, easy to utilize vehicle. While the technical requirements of each solution vary, Carahsoft strives to consolidate these specifications and responses into a cohesive unit. #15..
- 746 -
SOLICITATION # CH16012
8 MANDATORY MINIMUMS
This section should constitute the Offeror’s point-by-point response to each item described in Section 5 of the RFP, except 5.1 (Signature Page) and 5.4 (Executive Summary). An Offeror’s response must be a specific point-by-point response, in the order listed, to each requirement in the Section 5 of the RFP.

5.1 – Signature Page
Proposals must be submitted with a vendor information form, located on Bidsync as an attachment to the RFP, which must contain an ORIGINAL HANDWRITTEN signature executed in INK OR AN ELECTRONIC SIGNATURE, and be returned with the Offeror’s proposal.

Please find Carahsoft’s Signature Page completed above.

5.2 – Cover Letter
Proposals must include a cover letter on official letterhead of the Offeror. The cover letter must identify the RFP Title and number, and must be signed by an individual authorized to commit the Offeror to the work proposed. In addition, the cover letter must include:

5.2.1 A statement indicating the Offeror’s understanding that they may be required to negotiate additional terms and conditions, including additional administrative fees, with Participating Entities when executing a Participating Addendum.

5.2.2 A statement naming the firms and/or staff responsible for writing the proposal.

5.2.3 A statement that Offeror is not currently suspended, debarred or otherwise excluded from federal or state procurement and non-procurement programs.

5.2.4 A statement acknowledging that a 0.25% NASPO ValuePoint Administrative Fee and any Participating Entity Administrative fee will apply to total sales for the Master Agreement(s) awarded from the RFP.

5.2.5 A statement identifying the service model(s) (SaaS, IaaS, and/or PaaS) and deployment model(s) that it is capable of providing under the terms of the RFP. See Attachment C for a determination of each service model subcategory. The services models, deployment models and risk categories can be found in the Scope of Services, Attachment D. Note: Multiple service and/or deployment model selection is permitted, and at least one service model must be identified. See Attachment H.

5.2.6 A statement identifying the data risk categories that the Offeror is capable of storing and securing.

See Attachment D and Attachment H.

Please find above Carahsoft’s Cover Letter addressing these requirements. #15..
- 747 -
SOLICITATION # CH16012
9 5.3 – Acknowledgement of Amendments
If the RFP is amended, the Offeror must acknowledge each amendment with a signature on the acknowledgement form provided with each amendment. Failure to return a signed copy of each amendment acknowledgement form with the proposal may result in the proposal being found nonresponsive.

Carahsoft acknowledges all amendments. Also please find below Carahsoft’s Acknowledgement of Amendments form completed.

5.4 – Executive Summary
Offerors must provide an Executive Summary of its proposal. An Executive Summary should highlight the major features of an Offeror’s proposal. Briefly describe the proposal in no more than three (3) pages. The evaluation committee should be able to determine the essence of the proposal by reading the Executive Summary. Any requirements that cannot be met by the Offeror must be included.

Please find above Carahsoft’s Executive Summary addressing these requirements.

5.5 – General Requirements

5.5.1 Offeror must agree that if awarded a contract it will provide a Usage Report Administrator responsible for the quarterly sales reporting described the Master Agreement Terms and Conditions, and if applicable Participating Addendums.

Carahsoft agrees that if awarded a contract they will provide a Usage Report Administrator responsible for quarterly sales reporting described in the Master Agreement Terms and Conditions, and if applicable Participating Addendums.

5.5.2 Offeror must provide a statement that it agrees to cooperate with NASPO ValuePoint and SciQuest (and any authorized agent or successor entity to SciQuest) with uploading an Offeror’s ordering instructions, if awarded a contract.

Carahsoft agrees to cooperate with NASPO ValuePoint and SciQuest (and any authorized agent or successor entity to SciQuest) with uploading Carahsoft’s ordering instructions, if awarded a contract.

5.5.3 Offeror must at a minimum complete, provide, and maintain a completed CSA STAR Registry SelfAssessment. Offeror must either submit a completed The Consensus Assessments Initiative Questionnaire (CAIQ), Exhibit 1 to Attachment B, or submit a report documenting compliance with Cloud Controls Matrix (CCM), Exhibit 2 to Attachment B. Offeror must also represent and warrant the accuracy and currency of the information on the completed. Offerors are encouraged to complete and submit both exhibits to Attachment B.

For ease of access and evaluation, Carahsoft has provided these Assessment documents under separate cover. All copies have been submitted electronically per the instructions of the RFP. Please note that specific assessments have been labeled as confidential- additional information is provided in the Confidential, Protected, or Proprietary Information section. #15..
- 748 -
SOLICITATION # CH16012
10 5.5.4 Offeror, as part of its proposal, must provide a sample of its Service Level Agreement, which should define the performance and other operating parameters within which the infrastructure must operate to meet IT System and Purchasing Entity’s requirements.

SERVICE LEVEL FRAMEWORK
The service levels (“Service Levels”) applicable to the Services specified in Sections 1 and 2 are set forth in Schedule B to this SD (“Service Levels for Cloud Platform Services”). The framework that governs all Service Levels is set forth in this Section.

Commencement of Service Levels
Commencing thirty (30) days from the Service Start Date (as set forth in the applicable Order Form), Virtustream’s performance of the Services will meet each applicable Service Level. If Virtustream’s performance of the Services does not meet the applicable Service Level, then Virtustream will use commercially reasonable efforts to restore its performance to meet such Service Level.

Service Level Reports
Service Levels will be calculated and measured monthly by Virtustream on a calendar month basis and reported each month for the previous month. The reports will be provided to Customer by the tenth (10th) working day of the month following that to which such report relates, commencing on the second (2nd) month following the Service Start Date and each month thereafter. The monthly service level report will contain at least the following items: (i) Uptime statistics for the month concerned; (ii) an analysis of reported incidents over the previous month, broken down by type for discussion; (iii) action plans for items giving rise to concern; (iv) comments and observations on any issues arising from Virtustream’s performance monitoring activities; (v) recommendations on service delivery strategies to maintain or enhance the service level; and (vi) review of general business requirements (“Service Level Report”).

Cloud Platform Services (CPS) has its own specific service levels as described in this document. Cloud Cover Services (CCS) has service levels that pertain to the CCS offerings and are reported separately. Not all Virtustream customers have CCS but all Virtustream customers use CPS.

Service Level Review Meetings
Monthly Service Level review meetings will be conducted by Virtustream with Customer where the monthly Service Level report specified above will be discussed. If any of the Service Levels measured over the previous calendar month period is not achieved in that month, then Virtustream will include the steps taken to rectify the problem in the next monthly Service Level Report. In addition, the issue shall be an agenda topic for discussion at the next monthly service review meeting. Additionally, after restoring service or otherwise resolving any immediate problem as specified in this SD, if Virtustream fails to provide Services in accordance with the Service Levels, Virtustream shall:
a. Promptly investigate and report on the causes of such problem; b. Provide a Root Cause Analysis of such failure as soon as practical after such failure or at Customer’s request; c. Correct such problem that is Virtustream’s fault or responsibility, as soon as reasonably practicable and coordinate the correction of such problem if Virtustream does not have responsibility for the cause of such problem. d. Advise Customer of the status of remedial efforts being undertaken with respect to such problem; e. Demonstrate to Customer’s reasonable satisfaction that the causes of such problem (that is Virtustream’s fault or responsibility) have been or shall be corrected on a permanent basis; and f. Take corrective actions to prevent any recurrence of such problem (that is Virtustream’s fault or responsibility).

Root Cause Analysis
Promptly following Virtustream’s failure to meet a Service Level, Virtustream will perform a root cause analysis to determine the reason for that failure. Upon Virtustream’s determination of the cause of such failure, it will provide to Customer a preliminary report citing the cause of such failure. If Virtustream determines that the failure was due to Virtustream, an additional report will be provided that details the root causes of the failure, and which details any measures that should be taken to minimize the possibility that such failures will re-occur. Virtustream will correct the problem and use reasonable commercial efforts to minimize the re-occurrence of such failures.

Service Level Exceptions
Virtustream shall not be liable for any failure to meet the Service Levels, to the extent such failure was caused by one or more of the following:
a. A failure of Customer or any of its employees, agents or contractors (including any of Customer’s third party service providers) to perform any of its responsibilities under this SD; #15..
- 749 -
SOLICITATION # CH16012
11 b. Any act or omission of Customer or any of its employees, agents or contractors (including Customer’s third party service providers or other third parties acting on behalf of Customer); c. Any hardware, software or other product of a third-party or Customer equipment; d. Any failure of Customer to secure the proper access rights or maintenance and support services with respect to any component of the Services (e.g., hardware, software, network, maintenance) for which Virtustream does not bear operational responsibility;
e. Downtimes resulting from a Virtustream’s scheduled maintenance windows; f. Customer’s reprioritization of the tasks to be performed by Virtustream where such reprioritization causes Virtustream to miss a Service Level;
g. Viruses; provided that the infected Virtustream-provided system had virus protection for which the virus protection software updates were up to date;
h. An election by Customer to purchase a base commitment that is not sufficient to run Customer’s system (e.g., If a customer elects to size a µVM pool that is insufficient to run the designated workload); i. Issues occurring outside of standard working hours (as defined for business level customers) — for which the Service Level Objectives (SLOs) do not apply;
j. Cloud Cover Services (CCS) offerings — for which the Service Level Objectives (SLOs) do not apply; k. Resolution delays due to lack of client response and/or Customer provided credential based information; l. Priority levels not agreed upon by both customer and supplier; m. Claims of performance degradation not substantiated through Customer provided diagnostic testing results.

5.7 Recertification of Mandatory Minimums and Technical Specifications Offeror must acknowledge that if it is awarded a contract under the RFP that it will annually certify to the Lead State that it still meets or exceeds the technical capabilities discussed in its proposal.

Carahsoft acknowledges that if awarded a contract under the RFP that it will annually certify to the Lead State that it still meets or exceeds the technical capabilities discussed in this proposal. #15..
- 750 -
SOLICITATION # CH16012
12 BUSINESS PROFILE
This section should constitute the Offeror’s response to the items described in Section 6 of the RFP. An Offeror’s response must be a specific point-by-point response, in the order listed, to each requirement in the Section 6 of the RFP.

6.1 – Business Profile Provide a profile of your business including: year started, organizational structure, client base (including any focus by region, market sector, etc.), growth over the last three (3) years, number of employees, employee retention rates (specific for employees that may be associated with the services related to the RFP) over the last two (2) years, etc. Businesses must demonstrate a minimum of three (3) years of experience providing cloud solutions for large scale projects, including government experience, to be eligible for award.

Carahsoft Technology Corp. was started in Reston, Virginia in 2004. Carahsoft remains headquartered in Reston Virginia employing over 500 people that specifically support the Public Sector (Federal, State, Local, and Public Funded Educational Entities Nationwide within the United States.) Carahsoft has built a reputation as a customer focused organization with depth of experience in government sales, marketing, and contract program management.

Carahsoft is one of the largest sellers of Cloud (including SaaS, PaaS, and IaaS) to U.S. the Public Sector.

Carahsoft’s organizational structure allows for very focused and individualized support of any customer. The Executive Management team at Carahsoft is responsible for all aspects of day to day running of the organization.

Reporting to the Executive Management Team are Directors. It is the Director’s primary responsibility to oversee a particular technology area(s) and to monitor and manage all aspects of the staff, customers, and business within that area. An example of a Technology Area at Carahsoft is the VMware Virtualization practice. A host of technology offerings that use VMware at their core are supported by a single business unit overseen by a single Director that has reach back and access to the Executive Management staff. The Director’s are then supported by a group of Team Leads. Each Team Lead Oversees a business area (typically defined by customer type (i.e. State Customers) or technology type (i.e. Virtual Desktop). Each team lead oversees a staff that is responsible for executing and managing the activities within that business unit.

At its’ core, this organizational structure is lean and efficient, lacking layers of middle management, and empowering individuals with decision making capability in order to support all customers quickly an efficiently.

Carahsoft boasts an excellent employee retention rate. Specific benchmarks that we track include employee retention at 2 years of employment and 4 years of employment with rates of 65% and 90% respectively.

Carahsoft has been providing cloud solutions since opening its doors in 2004. US Public Sector entities have relied on Carahsoft to provide a wide variety of cloud technologies. Carahsoft serves as the cloud distributor and provides access to the core cloud technology with the core technology being supported by companies such as SalesForce, Google, ServiceNow, etc. Carahsoft currently support a state-wide implementation of Service Now’s cloud technology within the Commonwealth of Pennsylvania. This implementation is known as the Enterprise Information Help Desk and manages all incident requests. Additionally, in 2013, Carahsoft has contracted with the State of Ohio to provide a cloud solution built around the technology from Salesforce. Ohios’ Department of Administrative Services has contracted for Carahsoft to provide a variety of services including Service Cloud, Radian6 and Marketing Cloud as well as others. Both the Ohio and Pennsylvania cloud solutions are still being provided to these organizations.

Contracts similar in scope and size of this NASPO Cloud RFP:
#15..
- 751 -
SOLICITATION # CH16012
13 California Multiple Award Schedule California CMAS 3-12-70-2247E Delaware Salesforce Contract Delaware SE-CLD-001
Florida Commercial-off-the-shelf Software Contract Florida COTS 43230000-14-01 Iowa Salesforce Contract Iowa 2015-BUS-004
Ohio Master Cloud Services Agreement Ohio MCSA-0016
Ohio State Term Schedule Ohio STS 534354
Texas DIR Salesforce Contract DIR-SDD-1793
Texas DIR Emergency Preparedness Contract DIR-SDD-2035
Texas DIR Software/SaaS Contract DIR-TSO-3149
VITA Desktop Productivity Software Contract VITA VA-140401-CARA

6.2 – Scope of Experience Describe in detail the business’ experience with government or large consortium contracts similar to the Master Agreements sought through this RFP. Provide the approximate dollar value of the business’ five (5) largest contracts in the last two (2) years, under which the Offeror provided Solutions identical or very similar to those required by this RFP. Government experience is preferred.

CONTRACT VEHICLES – Over the past ten years Carahsoft has acquired and maintained a wide variety of purchasing contract vehicles for agencies at the state, local, and federal levels. Carahsoft holds statewide contracts in many states across the country, and we have a great deal of experience with IT Master contracts accessible to numerous public agencies. Carahsoft has extensive experience in successfully launching, maintaining, and managing these contracts and projects over a wide range of government customers. The range of government projects include agency/ county/ city wide project, state-wide efforts, and multi-state contracts, as well as supporting projects that cross a wide range of Federal government customers. Examples of some of these projects include:

TEXServe Multi-jurisdictional Purchasing Program: Carahsoft promoted and managed the Texserve Contract-allowing the full VMware Products & Services portfolio to be procured by Texas K-12 Users at a discounted price.

TEXserve services including: VMware Technical Support, Pre-sales licensing configuration & design, contract promotion, ad hoc revenue reporting, and customer nurturing/ upsell campaigns. Carahsoft worked with Texserve, K-12 customers, to partner with a select number of VMware Premier and Enterprise Authorized Resellers utilizing their expertise under the Texserve contract.

ONENET Purchasing Consolidation: Carahsoft serves as the prime contractor and program manager for the ONENET contract serving the entire ONENET community providing the ability to procure VMware software (licensing/support) through a trusted network of strategic partners at a discounted rate. Carahsoft has a proven track record of providing the highest level of technical support while ensuring that members receive the proper software products and services conveniently under the ONENET Contract.

TX DIR Contract Sales: Carahsoft maintains a number of purchasing vehicles with the State of Texas Department of Information Resources (DIR.) 2014 DIR sales accounted for greater than $50M in revenues.

Carahsoft actively markets these contracts and has grown revenues at greater than 10% annually for the past 5 years.

Total GSA State & Local Sales: Carahsoft holds a US General Services Administration (GSA) Schedule 70 Technology Contract. This contract is open to State and Local agencies to purchase as a form of Cooperative #15..
- 752 -
SOLICITATION # CH16012
14 Purchasing. Carahsoft markets the availability of this contract to eligible users and maintains sales revenues to eligible State and Local entities at greater than $50M annually.

As a whole, Carahsoft’s five largest public sector contracts have totaled approximately $211,571,007 in sales in the past 2 years.

Carahsoft GSA Schedule GS-35F-0119Y $127,242,948.95
Texas DIR Emergency Preparedness Contract TX-DIR-SDD-2035 $ 39,007,058.19 Texas DIR BMC Contract TXDIR-SDD-1727 $ 15,734,306.68
Texas DIR Salesforce Contract TXDIR-SDD-1793 $ 14,876,679.26 Texas DIR Adobe Contract TX-DIR-SDD-2504 $ 14,710,013.43 Total Sales: $211,571,006.51
These contracts make up close to 2/3 of the total sales on contract that Carahsoft completed in that span. All of these contracts are currently in place with government entities.

6.3 – Financials Offeror must provide audited financial statements, of the last two years, to the State that demonstrate that an Offeror meets at a minimum Dun and Bradstreet (D&B) credit rating of 3A2 or better, or a recognized equivalent rating. Please provide the Respondent’s D&B Number and the composite credit rating. The State reserves the right to verify this information. If a branch or wholly owned subsidiary is bidding on this RFP, please provide the D&B Number and score for the parent company that will be financially responsible for performance of the agreement.

Carahsoft has deemed its audited financials to be considered confidential. Additional information is provided in the Confidential, Protected, or Proprietary Information section. For D&B report along with additional clarification, please see page 360 in the Supplemental Information Section.

6.4 – General Information

6.4.1 Provide any pertinent general information about the depth and breadth of your Solutions and their overall use and acceptance in the cloud marketplace.

Carahsoft has assembled a team from our vast portfolio of vendors that includes our leading premiere network of cloud solutions, resellers, and subcontractors as the best solution to meet the State of Utah’s requirements. They include:

AODocs, CA, DocuSign, FireEye, Google, QTS, Salesforce, SAP, ServiceNow, Virtru, Virtustream, VMware Carahsoft is submitting as the exclusive offeror for all Google, Salesforce, and ServiceNow solutions and services for the NASPO Cloud solicitation. These manufacturers have deemed Carahsoft as the prime contractor who can effectively and efficiently manage the NASPO cloud contract on their behalf.

As a part of this response Carahsoft has utilized multiple Cloud Solution Vendors, covering all of the Cloud delivery models; SaaS, IaaS, PaaS. Carahsoft’s strong vendor relationships and partner ecosystem have created an efficient and cost effective response which encompasses all vendor solutions into a single, easy #15..
- 753 -
SOLICITATION # CH16012
15 to utilize vehicle. While the technical requirements of each solution vary, Carahsoft strives to consolidate these specifications and responses into a cohesive unit. For example:

CA Technologies is a leader in IT Management Solutions in the industry. CA has be steadily moving its premier on premise management solutions to the cloud. CA Clarity Project and Portfolio Management (PPM) is one of the leading solutions used by state governments today.

Google’s SaaS offering, Google Apps, has been commercially available since 2006 and presently has ~5.3 million paying customers covering 26m+ end user licenses. Google Apps represents a combination of the most popular consumer products that have been prepared for Enterprise use through the means of adding Administrative and Compliance Controls to the suite.

Gmail is the anchor product in the SaaS offering. Google has over 1B consumer users of Gmail and from that success designed a means by which customers could bring their own email-enabled domain name(s) into this managed service to replace legacy on-premises systems at a significantly reduced price. The straightforward means of migrating data as well as configuring the service and the knowledge that a majority of these business users may already be familiar with Gmail via personal use has made the adoption of Google Apps a logical choice.

Examples of the evolution of this SaaS offering include:
ズ Acquisition in 2007 of one of the leading email security and compliance vendors and the integration of those services to the Gmail Advanced Settings options. These features include the ability for customer System Administrators to set Spam, Content, Attachment and TLS policies to meet their specific requirements.
ズ In 2011 Google launches the Google Apps Status Dashboard, a publicly accessible website with RSS feeds to keep the world apprise of current system status. ズ In 2012 Google increases the Gmail storage allocation from 10gb to 25gb, no change in price ズ In 2013 Google modifies the storage space to unify email and Drive storage and increase the allocation to 30Gb, no change in price
ズ In 2014 Google offers a new premium SKU that offers unlimited unified Storage ズ In 2015 Google enhances the Gmail Advanced Settings features to include pre-defined lexicons to support Data Loss Prevention scanning in email.

The above list is a short list of the variety of services, support offerings, features and best practices that Google has adopted into the service delivery of the SaaS offering. In addition to the wide use of GMail, Google has six other products with over a Billion active users. Those are Google Search, Chrome, Android, Google Maps, YouTube and Google Play.

Chrome as a browser and an operating system are further evidence of strong usage and market acceptance. In a report released by Net Applications in April of 2015, Chrome browser held 25.68% market share while IE11 had 25.04, followed by IE8 at 16.0. The increase in adoption by Enterprise customers is attributed to the real time updates against emerging threats and the Chrome for Enterprise browser controls.

Chromebooks, the laptops that run Google Chrome as the OS, are seeing a rapid increase in sales in the K-12 market worldwide. This is attributed to the low-cost and the easy-to-manage machines. #15..
- 754 -
SOLICITATION # CH16012
16 Google’s PaaS/IaaS offerings entitled Google Cloud Platform was first announces in 2008 with Google App Engine, a platform to develop and host web applications. Early success on this platform included The Royal Wedding Website and BestBuy moving their online Gift Card/Registry service to the platform. Over the years, and based on market demand, Google began to externalize off PaaS/IaaS service offerings that Google developed originally for their own infrastructure and platform utilization.

Google continues to expose the benefits of Google’s infrastructure to outside entities.

Or, put differently, Google lets customers use the same infrastructure that allows Google to return billions of search results in milliseconds, serve 6 billion hours of YouTube video per month and provide storage for 1Billion Gmail users.

Salesforce is the enterprise cloud computing leader dedicated to helping companies and government agencies transform into connected organizations through social and mobile technologies. Since launching its first service in 2000, Salesforce’s list of over 150,000 customers span nearly every industry worldwide.

The company’s trusted cloud platform is creating a connected government experience for over 1000 government agencies including all federal cabinet government agencies and the majority of US States.

With the world’s leading cloud platform, Salesforce is freeing government data from legacy systems, empowering citizens and connecting agencies to administer government in powerful new ways.

Government agencies are using Salesforce solutions for a multitude of government functions including grants management, constituent communications and correspondence management, incident and case management, call/contact center management, outreach programs, learning management, volunteer management, project management, and even donor management, among numerous others.

SAP is the fastest growing company at scale in the cloud with a user base of over 95 million subscribers.

We also have the largest cloud portfolio of over 30 solutions for all lines of business as well as business suites. We also have 41 data centers in 21 locations in 11 countries.

6.4.2 Offeror must describe whether or not its auditing capabilities and reports are consistent with SAS 70 or later versions including, SSAE 16 6/2011, or greater.

Security is a multidimensional business imperative that demands consideration at multiple levels, from security for applications to physical facilities and network security. In addition to the latest technologies, world-class security requires ongoing adherence to best-practice policies. To ensure this adherence, our various cloud providers continually seek relevant third-party certification, including ISO 27001, the SysTrust audit (the recognized standard for system security), and SSAE 16 SOC 1 audit (an examination and assessment of internal corporate controls, previously known as SAS 70 Type II). SOC1, SOC2 and SOC3 audits are performed by third party auditor annually at a minimum. Additional audits and certifications include: CSA ‘Consensus Assessments Initiative’, JIPDC (Japan Privacy Seal), Tuv (Germany Privacy Mark), and TRUSTe.

Some examples include:

ServiceNow’s security framework is based on ISO/IEC 27002 and has been ISO 27001 certified since 2012. Annually, ServiceNow undergoes ISO 27001 Surveillance audits and well as SSAE 16 attestations for both SOC 1 Type 2 and SOC 2 Type 2. Customers under an NDA can request these reports annually in assisting with both their vendor management and regulatory or compliance programs. ServiceNow provides Security Event Logs using Application Level Audit Logs and Infrastructure Monitoring, #15..
- 755 -
SOLICITATION # CH16012
17 Application Level Audit Logs. The ServiceNow application writes detailed audit log information that is stored in tables within a customer’s instance. Since this is considered customer data and is stored within a customer’s instance, ServiceNow does not attempt to monitor or view this data unless specifically requested by a customer. As a result the customer is responsible for monitoring the contents of these logs files and, at the customer’s choosing, exporting the logs through the capabilities provided within the platform.

Infrastructure Monitoring. All components of the infrastructure supporting the private cloud feed alerts and logs into the SIEM. In addition, ServiceNow has deployed an Intrusion Detection System (IDS), positioned to listen to all inbound network traffic, with all events going to the SIEM as well. The SIEM is configured to automatically send alerts for common attacks. ServiceNow is responsible for managing the SIEM environment and securing the logs. ServiceNow retains all infrastructure logs for at least 90 days. The Security Operations Center (SOC) is also responsible for completing a daily checklist across a range of security domains, including privilege account usage, IDS alerts, file integrity monitoring (FIM), and database access. The daily checklists and captured events are managed through an instance of ServiceNow. Any variances that are discovered are raised as incidents for tracking, notifications, and investigation.

CA SaaS environment is compliant with SSAE16 for services where infrastructure and application are managed and maintained by CA. CA Agile Management currently does not hold SSAE16 certification. For SaaS offerings where infrastructure is managed by a third party, provider’s SSAE16 reports are available upon request.

6.5 – Billing and Pricing Practices

6.5.1 Describe your billing and pricing practices, including how your billing practices are transparent and easy to understand for Purchasing Entity’s.

Carahsoft’s Order Management team works to ensure that billing and payment are completed in an efficient and simple manner. Purchase Orders and Invoices are provided to the customer early to ensure that payment can be completed whenever the customer is ready and within the confines of the agreed upon deal. Our OM team is available to answer any questions a Purchasing Entity has in order to assist with the process and confirm that they have everything needed for payment.

Carahsoft’s pricing is dictated by the manufacturers- Carahsoft ensures that the Purchasing Entity’s receive the best possible price by working directly with the manufacturer and ensuring that pricing meets or exceeds the contract being used. In addition, Carahsoft works with the manufacturer to ensure that all pricing changes are accounted for within the contract, as applicable.

6.5.2 Identify any typical cost impacts that a Purchasing Entity might need to consider, if any, to implement your cloud solutions.

When a purchasing entity determines they need implementation services to their cloud solutions, the Carahsoft offering provides these additional services. For Example:

ServiceNow Response: Customers typically engage ServiceNow for the initial implementation and training services and then for any major new future application implementations to get the best-of-breed expertise #15..
- 756 -
SOLICITATION # CH16012
18 for good standard solution support. ServiceNow developed the platform and applications so anyone could support changes to the configuration without having to hire outside consultants. The customer is empowered as they gain experience either by shadowing ServiceNow consultants during initial implementations, as they talking to other customers through the Community website, or by asking for technical support through the portal. So initial costs typically occur for ServiceNow when it is first implemented and there might be requested services as customers add new application support but there are no ongoing costs typically.

CA Cloud SaaS solutions are fully operational multi-tenant solution that are fully ready to use at outset.

These Solutions are typically complex management solutions that do require setup and training. For example many customer will purchase a limited time block of consulting to help with loading data, and configuring reports. Training is also available for all applications to either augment start-up packs or walk customers through basic tasks.

In addition to the licensing fees there are optional Google services that a Purchasing Entity may find meet additional mandatory requirements. Examples would include adding on other SaaS solutions like Virtru for end to end encryption or AODocs for Document Management. The key benefit to moving to Cloud based vendors is a new set of transformative tools that are more productive and most cost effective than traditional client server solutions. Other additional costs may come into play of the Purchasing Entity wants to outsource all of the configuration and migration work to the selected reseller leading to additional time and materials expenses.

The Salesforce solution is available immediately for use via the internet after a Purchasing Entity makes a purchase of the solution. Other additional costs would include any implementation fees to be performed by a certified Salesforce implementation partner. These fees vary based on the type of project and length and complexity of implementation.

6.5.3 Offeror must describe how its Solutions are NIST compliant, as defined in NIST Special Publication 800-145, with the service models it offers.

Carahsoft’s cloud solution offerings all fit within the guidelines listed in NIST publication 800-145 and repeated in Attachment D of this response. Please see response 8.1.5 for a more detailed explanation.

6.6 – Scope and Variety of Cloud Solutions

6.6 Specify the scope and variety of the service models you offer under this solicitation. You may provide a list of the different SaaS, IaaS, and/or PaaS services that you offer.

Carahsoft proudly offers a number of SaaS, PaaS, and IaaS supported by the cloud technologies as listed below. Many of our top tier cloud vendors also provide subscription and utility based pricing models which would be available to the State. Below is a list of each manufacturer being proposed in this response, along with the specific type of solution (SaaS, IaaS, and PaaS) they fit into:

SaaS – AODocs, CA Technologies, DocuSign, FireEye, Google, QTS, Salesforce, SAP, ServiceNow, Virtru, VMware
PaaS – Google, QTS, Salesforce, SAP, ServiceNow, Virtustream IaaS – FireEye, Google, QTS, Virtustream, VMware
#15..
- 757 -
SOLICITATION # CH16012
19 6.7 – Best Practices

6.7 Specify your policies and procedures in ensuring visibility, compliance, data security and threat protection for cloud-delivered services; include any implementations of encryption or tokenization to control access to sensitive data.

Carahsoft utilizes varying procedures for ensuring visibility, compliance, data security and threat protection for cloud-delivered services. Please see the below examples of potential options for meeting the State’s expectations:

ServiceNow Response: ServiceNow applications have the advantage of being built on a single cloud platform that consists of one user interface, one code base and one data model; delivering holistic visibility into processes, creating a single source of truth, irrespective of whether the processes and systems are within the customer’s environment or hosted in the cloud. ServiceNow invests significant resources in providing its services in a secure manner. This includes global teams delivering 24x7 operations and technical support from ServiceNow staff. ServiceNow currently has offices with staff focused on the management of the private cloud in Australia, the Netherlands, the U.K, North America, and Asia. The ServiceNow environment is a private cloud, fully owned and operated by ServiceNow, which supports a logically single tenant architecture. Customer data is isolated from other customer data by leveraging an enterprise-grade cloud architecture and a dedicated database and application set per instance. This gives ServiceNow customers cost reduction through shared infrastructure, while having the security benefits of customer-specific isolation at the application and data layers. In addition to the security features that come standard within the platform and each customer instance, customers can leverage the additional security features within ServiceNow to augment the security configuration of their instances based on their own needs and risk profile.

CA Response: This is addressed throughout all of our policies and procedures. CA SaaS Operations and Delivery runs an Information Security Management Framework (ISMS), which includes security organization, documentation, monitoring, and continuous improvement cycle. The security documentation comprises of CA SaaS Operations information security policies, procedures, guidelines and checklists.

ISMS documentation is reviewed along with applicable controls annually. CA offers a variety of SaaS solutions, details for each offering has been provided in Exhibit 1 and 2 of this proposal.

Salesforce Response: Salesforce has many customers that are subject to laws pertaining to the processing of personally identifiable information (PII) or personal data. Salesforce offers its customers a broad spectrum of functionalities and customer-controlled security features that its customers may implement in their respective uses of the Salesforce services. Salesforce believes that these provide its customers the flexibility to comply with laws with stringent privacy and security requirements. Encryption options vary based on Salesforce Commercial Cloud or Salesforce Government Cloud offering.

Government Cloud Encryption:

As part of the Salesforce Government Cloud, Salesforce is capable of responding to FIPS 140-2 cryptographic implementations for data being transferred between the State’s web browser and Salesforce.

Data that resides within Salesforce’s protected boundary does not use FIPS 140-2 validated encryption as compensating/mitigating controls are in place to protect data. Additional information is provided below.

Data In Motion:
#15..
- 758 -
SOLICITATION # CH16012
20 Salesforce employs cryptographic mechanisms to protect information during transmission. All transmissions between the user and Salesforce are encrypted by default with a 2048- bit Public Key. Our service uses International/Global Step Up certificates. We support one- way TLS, in which customers create secure connections before sharing private data.

Secure routing and traffic flow policies ensure that customer traffic is encrypted entering Salesforce until the load balancer decrypts the traffic. The load balancers decrypting the traffic are FIPS 140-2 compliant and are located inside of the Salesforce Government Cloud isolation boundary.

Data At Rest:

NIST SP 800-53 Rev. 4 states in SC-28, “Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system.” SC-28 also states, “Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate.” All secondary storage media (hard drives, disk drives, and tapes) containing customer data are maintained within Salesforce’s secure production data centers until the media has been sanitized and destroyed. Salesforce relies on physical access controls as a compensating control to protect the data.
#15..
- 759 -
SOLICITATION # CH16012
21 ORGANIZATIONS PROFILE
This section should constitute the Offeror’s response to the items described in Section 7 of the RFP. An Offeror’s response must be a specific point-by-point response, in the order listed, to each requirement in the Section 7 of the RFP.

7.1 – Contract Manager
The Offeror must provide a Contract Manager as the single point of contact for management of the NASPO ValuePoint Master Agreement, administered by the State of Utah. The Contract Manager must have a minimum of three (3) years’ experience managing contracts for cloud solutions.

7.1.1 Provide the name, phone number, email address, and work hours of the person who will act as Contract Manager if you are awarded a Master Agreement.

Bethany Blackwell
Senior Manager
703-230-7435 (office)
703-501-1134 (cell)
[email protected]
Working hours: 7am-7pm EST M-F

7.1.2 Describe in detail the Contract Manager’s experience managing contracts of similar size and scope to the one that will be awarded from this RFP. Provide a detailed resume for the Contract Manager.

The proposed contract manager, Bethany Blackwell, has over 5 years of experience in managing SaaS contracts in both the State and Local and Federal markets.

Bethany developed and manages contracts and associated terms for cloud contracts in more than 10 states. The combination of the State and Federal contract vehicles and BPAs being managed is valued at over $300M. Annually, she oversees 1000+ SaaS transactions off of these contract vehicles which include licensing and implementation that provide end to end cloud solutions to public sector customers.

Name Position
Bethany Blackwell
Carahsoft Senior Account Manager –
Will serve as the NASPO ValuePoint
Contract Manager
Background
 Senior Manager for cloud solutions products, including Salesforce.com, DocuSign, BMC Software  Vendor/Partner manager for 20+ complimentary solution vendors and 25+ implementation partners and system integrators
 Graduated Virginia Tech in 2010 - dual degree with concentrations in Psychology and Political Science
 5+ years of experience at Carahsoft
Skills
#15..
- 760 -
SOLICITATION # CH16012
22  Expertise in negotiating SaaS contract vehicles and terms at State level  Knowledge of contract vehicles, BPAs, multi-year deals, multi-vendor deals  Management of enterprise size product contracts
 Establish and maintain positive customer relationships through proactive communication  Maintained interactions with customers to ensure quick, accurate quotes; facilitated easy ordering process for customers
Relevant Experience
 Oversees the management and execution of 900+ individual SaaS contracts, valued at 85M+ annually
 Maintain the annual recurring subscription renewal bases to ensure no customer’s lapse in service  Oversees the ordering and distribution of licenses on statewide enterprise licenses agreements and various BPAs
 Established vendor specific terms and conditions for 10 different statewide contracts  Assist customers in shifting buying strategy from perpetual to subscription licensing model 

7.1.3 Describe in detail the roles and responsibilities of the Contract Manager as they apply to the NASPO ValuePoint Master Agreement that will be awarded from this RFP.

The Contract Manager assigned to this contract will be in charge of all coordination and organization efforts between Carahsoft and NASPO ValuePoint. This includes, but is not limited to:
 contract negotiation
 roll-out plan
 amendments completion
 renewal execution
 reseller/subcontractor additions
 contract pricelist updates and upkeep
 contract compliance
 marketing coordination
#15..
- 761 -
SOLICITATION # CH16012
23 TECHNICAL RESPONSE
This section should constitute the Technical response of the proposal and must contain at least the following information:

A. A complete narrative of the Offeror's assessment of the Cloud Solutions to be provided, the Offerors ability and approach, and the resources necessary to fulfill the requirements. This should demonstrate the Offeror's understanding of the desired overall performance expectations and clearly indicate any options or alternatives proposed.

In response to the State of Utah request for Cloud Solution Proposals, Carahsoft has assembled a response that includes a number of Cloud Solution Offerings from within the Carahsoft Cloud framework.

These offerings are all supported in part or wholly by twelve leading cloud technology providers. Each provider’s technology is an integral part of Carahsoft’s proposal. Within this framework, Carahsoft will orchestrate, assemble, and execute on all activities necessary to support this contract, engaging each cloud technology provider as needed in the delivery of a particular service or solution offering.

The Carahsoft Cloud framework will provide for all requirements of the State of Utah Request for Proposal to be fulfilled. Carahsoft will be able to provide Cloud Solution Offerings to the State of Utah as well as to those entities that may participate via the cooperative purchasing program. The Carahsoft Cloud proposal provides for the provision of PaaS, IaaS, and SaaS offerings that are compliant with all requirements as outlined by the State. Carahsoft will provide dedicated resources to supporting this agreement. Carahsoft will insure that adequate resources are supplied to fully support this agreement during all phases from contract launch through termination. Usage requirements and demand resources fluctuate over time and Carahsoft’s Cloud offering has been constructed in a manner that provides for the ability to scale without interruption, disruption, or any other similar interruption of customer service and solution availability.

B. A specific point-by-point response, in the order listed, to each requirement in the Section 8 of the RFP. Offerors should not provide links to a website as part of its response.

Offeror’s should focus their proposals on the technical qualifications and capabilities described in the RFP.

Offerors should not include sales brochures as part of their response.

For the purposes of Carahsoft’s response to the technical requirements (section 8) of this RFP, please note that any response provided related to a specific manufacturer should be treated as a response to the following categories:

8.1 – Technical Requirements

8.1.1 Offeror must identify the cloud service model(s) and deployment model(s) it intends to provide to Eligible Users. See Attachment D.
#15..
- 762 -
SOLICITATION # CH16012
24 CA APM CA APIM SaaS offering helps accelerate, secure and manage APIs. CA is responsible for development and management of application. AWS provides IaaS services to CA for management of the underlying cloud infrastructure.

MAA CA Mobile App Analytics stimulates collaboration between business analysts, developers, operations and support in order to accelerate mobile app delivery and improve end-user experience. This service is hosted at CenturyLink Data center and the infrastructure is managed and maintained by CA SaaS Ops and Delivery team.

CA Agile CA Agile Central is a SaaS offering that is generally used to document and manage work within the SDLC.

ASM CA App Synthetic Monitor (ASM) provides end-to-end transaction response-time visibility into cloud, mobile and Web applications. Application utilizes Rack Space IaaS services.

Google The Cloud Service Models that we intend to provide include SaaS, PaaS, and IaaS. In our response we will describe the various options for using Google Apps under the SaaS model and the functions of Google Cloud Platform under Paas and Iaas.

AODocs The Cloud Service Models that we intend to provide is SaaS.

Virtru All Virtru services are cloud-based and accessed via browser or downloadable browser extensions and plugins.

Salesforce Salesforce’s deployment model is a “public” cloud infrastructure, as defined by NIST 800-145 ServiceNow Cloud service model: Software as a Service (SaaS) Deployment model: Private Cloud
QTS "QTS is a leading national provider of Infrastructure as a Service (IaaS) data center solutions and fully managed cloud services and a leader in security and compliance. The company offers a complete, unique portfolio of core data center products, including custom data center (C1), colocation (C2) and cloud and managed services (C3), providing the flexibility, scale and security needed to support the rapidly evolving hybrid infrastructure demands of web and IT applications.

With 12 data centers in eight states, QTS owns, operates and manages approximately 4.7 million square feet of secure, state-of-the-art data center infrastructure and supports more than 850 customers. QTS’ Critical Facility Management (CFM) can provide increased efficiency and greater performance for third-party data center owners and operators.

QTS offers a number of IaaS solutions.

SAP Ariba Our solutions are offered and delivered in a true subscription-based model and shared service (multi-tenant) offering. There is no software to install, no hardware to buy, no maintenance or support costs and no need to hire consultants or tech specialists to run the system. We deploy and manage the infrastructure. Customers only need a web browser for access. Subscriptions include system maintenance, automatic upgrades, enhancements and application of service packs, Level 1– 3 help desk support, professional services and best practices built directly into the application.

Fieldglass The SAP Fieldglass application is exclusively offered in a software as a service (SaaS) model.

Hanna SAP HANA Enterprise Cloud (HEC) is a private managed isolated & dedicated ladnscape (single tenant) offering end-to-end cloud-based infrastructure and managed services for SAP applications powered by SAP HANA. It is a fully scalable, enterprise-ready, mission-critical, secure and high-availability cloud service.

Hybris The SAP Hybris Commerce, Cloud Edition offering are all single tenent hosted VM environments. Customers have their own VM's with SAP Hybris instances deployed to those VM's. The SAP Hybris Commerce, Cloud Edition currently #15..
- 763 -
SOLICITATION # CH16012
25 has Development, Staging, Testing, and Production environment. More environments can be added as required.

SuccessFactors Our solutions are delivered through a private cloud using a multi-tenant architecture. We refer to this as a Controlled Cloud. It includes a contractual framework reflecting applicable data privacy regulations, implementation and maintenance in accordance with Technical and Organizational Measures (TOMS) and regular audits by an independent third party for industry compliance and transparency.

VMware vCloud Air IaaS – Public, Hybrid, Community
Horizon Air
Desktop & Apps
IaaS – Public
vCloud Suite IaaS – Private, Hybrid, Community
Airwatch IaaS – Private
SaaS – Public
Horizon 6 IaaS – Private
Realize Air
Complaince
SaaS – Public
SocialCast SaaS – Public
FireEye All FireEye cloud offerings included in this response fit the SaaS cloud service model and private cloud deployment model.

VirtueStream Virtustream solution is fully NIST compliant for Essential Characteristics, as the Infrastructure as a Service (IaaS) Service Model, with all deployment options – Private Cloud, Community Cloud, Public and Hybrid Cloud.

8.1.2 For the purposes of the RFP, meeting the NIST essential characteristics is a primary concern. As such, describe how your proposed solution(s) meet the following characteristics, as defined in NIST Special Publication 800-145:

8.1.2.1 NIST Characteristic – On Demand Self-Service: Provide a brief written description of how the cloud solutions proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how self-service technical capability is met.

CA APM N/A. This is a SaaS service and clients do not have direct access to the underlying infrastructure in order to provision computing capabilities. CA is responsible for the management and maintenance of the infrastructure and will make any necessary adjustments as part of providing this service to its clients.

MAA This is a SaaS offering and On-Demand service is not available, however, MAA customers are enabled to manage their accounts and carry out configuration changes required to manage mobile applications.

CA Agile We are a fully multi-tenant environment and do not provide the On-Demand SelfService capability.

ASM This does not apply as this is a SaaS service. ASM customers are able to manage all aspects of their accounts, create sub-accounts, and make any configuration changes necessary for their monitors.

Google SaaS, Google Apps administrators have access to an Admin Panel that allows them to perform user administration, service configurations, reporting on demand.

Paas/IaaS, Google Cloud Platform is an integrated set of Compute tools, Storage Tools, Networking Tools, Big Data analytic tools, Management tools and Services APIs. A customer can use any of these services on demand via the Developer's Console.

AODocs SaaS, AODocs administrators have access to an Admin Panel that allows them to perform user administration, product configurations,reporting on demand. #15..
- 764 -
SOLICITATION # CH16012
26 Virtru All required services can be provisioned immediately when required. Users only need to install application to get single-user capability, or login to administrative dashboard for administrative features.

Salesforce Salesforce PaaS and SaaS solutions are delivered on-demand via the web and can be accessed with a browser and internet connection or mobile device. No additional software or infrastructure is required. Salesforce hosts the entire solution, thus freeing up customers to manage their mission, not manage an infrastructure solution. Additionally, Salesforce is browser agnostic and supports all major browsers (Firefox, Chrome, Safari, IE). No installations on users’ laptops or desktops are required and thus the solution is accessible from anywhere an internet connection and supported browser are available, including mobile devices.

ServiceNow Customer instances are provisioned automatically after an agreement between a customer and ServiceNow is executed. ServiceNow actively monitors customer instance performance and can automatically scale its application servers out horizontally by adding them to the load balancer pools for a particular instance.

Docusign DocuSign’s DTM® solution is ISO 27001:2013 certified and many of the ISO 27001:2013 controls are mapped to the NIST 800-53 requirements; we can provide additional information upon request.

QTS On-demand self-service. A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.

SAP Ariba The solution provides self-service user profile management. Users profit from the intuitive, minimal-step nature of the user interface with little or no training.

Changes to user profile includes workflow capability for profile changes.

Fieldglass All system resources are available to all customers without limitation. The system is highly configurable with most configurations being available to the customer’s administrators.

Hanna HANA Enterprise Cloud is a private managed cloud therefore infra & services could be requested (added or decommisioned) on demand by placing change requests with SAP HEC teams. HEC roles & responsibilties document clearly articulates what is included in the monthly HEC pricing and what is available on-demand in addition to scaling up or down on the infra/compute.

Hybris N/A
SuccessFactors All self-service is in one place, including benefits and payroll if those products are in scope. Self-service is an intuitive experience. We provide the ability for employees to have configured permissions to take action in the tool such as field or data updates for personal information, benefits changes, payroll actions, completing workflow for assigned activities in the tool, etc. Selfservice for both employees and managers is configurable to fit your business rules and organizational requirements.

VMware VMware's IaaS and SaaS offerings complies with the On-Demand Self-Service characteristic, because once purchased, a user can unilaterally provision compute resources with no human interaction with VMware. The subscription includes access to two self service consoles: My VMware for account management, and the VMware vCloud Air Console which is the primary interface for access consumption and management of cloud resources purchased from VMware. (See doc for a complete list of products/ features that comply) FireEye FireEye is offering 4 distinct SaaS cloud solutions each featuring self-service features specific to the unique capabilities of the offerings:

1.Email Threat Prevention (ETP)
Email Provisioning
#15..
- 765 -
SOLICITATION # CH16012
27 Once the ETP infrastructure is provisioned, customers can self-service the acceptance of upstream mail and delivery to user mailboxes by configuring their own domain settings. No user mailbox provisioning is required as ETP will automatically check the validity of the email recipient with the downstream service.

2.Mobile Threat Prevention (MTP)
User Provisioning
Once the MTP infrastructure is provisioned, customers can self-service the creation of service users by integrating with an LDAP service or manually adding the users via the user interface.

Device Provisioning
Once the MTP infrastructure is provisioned, customers can self-service the creation of managed devices by instructing users to install the FireEye MTP Application on their mobile device and having a valid user account provisioned.

3.Threat Analytics Platform (TAP)
User Provisioning
Once the TAP infrastructure is provisioned, customers can create and assign role-based access control to user accounts. The enrollment process includes the ability to create two-factor authentication for newly provisioned users.

Data Sources
Once the TAP infrastructure is provisioned, customers can configure new data sources to feed the TAP instance without the assistance of FireEye. The TAP communications broker accepts data feeds in the following formats: syslog, flat files, TCP/UDP streams, and JDBC connections.

4.FireEye as a Service with Continuous Vigilance (FaaS CV) User Provisioning
Once the FaaS infrastructure is provisioned, customers can create and assign role-based access control to user accounts via the on premise FireEye sensors.

VirtueStream Virtustream IaaS provides a self-service portal called xStream, where users can access, view, edit, provision, and modify compute, storage, network and application services based on granular Role Based Access Control, which can be integrated with Active Directory or LDAP. Virtustream portal that enables the user to provision VMs, order services through a catalog, add storage, upload service templates, and run various reports all through the same portal.

8.1.2.2 NIST Characteristic – Broad Network Access: Provide a brief written description of how the cloud solutions proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how network access is provided.

CA APM The APIM service is accessed via HTTPS on a supported browser with no requirements for a workstation client install ; mobile friendly and optimized for use with iOS and Android tablets
MAA Upon native authentication, MAA dashboard is accessible by any host over public internet. Also, mobile devices connect to the service using REST API.

CA Agile All access to the application is through a browser.

ASM The ASM dashboard and API are accessible from any host connected to the public Internet. The API and dashboard require authentication, and each account is only accessible by the account owner (customer).

Google SaaS, Google Apps is device, platform and network agnostic. As a pure play cloud-based solution the services can be accessed via any modern browser from any network access point. Customers that have requirements to limit access to trusted devices or trusted access points have access to Device Management tools via the Admin Panel at no additional cost.

PaaS/IaaS, Google Cloud Platform management services can be accessed via any modern browser from any network access point. End-users can accesses services through one or more #15..
- 766 -
SOLICITATION # CH16012
28 appropriate tools (browser, CLI, APIs, etc.). Administrators can also monitor and manage services through a mobile app.

AODocs SaaS, AODocs is service, platform and network agnostic. As a pure play cloud-based solution the services can be accessed via any modern browser from any network access point.

Virtru All Virtru services are available on the publically available internet.

ServiceNow ServiceNow’s physical architecture is deployed into ServiceNow’s managed dedicated colocation cage space. Multiple diverse Internet connections terminate within the dedicated cage space providing redundant access from the Internet to the ServiceNow environment.

All users, administrators and developers connect to the ServiceNow private cloud over HTTPS, leveraging TLS, for communication to and from a ServiceNow instance with all normal interactions via a web browser. There is no requirement to install any client software on any desktop, laptop, tablet, or smart phone used to access a ServiceNow instance.

Docusign Please see above.

QTS Broad network access. Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations).

QTS recognizes that the connectivity challenges of today are largely driven by consolidation, virtualization and adaptive architectures. Our agile connectivity solutions provide you with both unification across your communication infrastructure and with built-in network scale, reliability, and high-performance.

QTS metroConnect is a fast, reliable, high bandwidth connection to hundreds of network and service providers inside the local Carrier Hotel. With access to the numerous networks at the carrier hotel, QTS delivers the interconnection necessary to support your connectivity, business continuity and application collaboration needs. metroConnect offers redundancy and diversity options that ensure your content is always available.
•High availability
•Backed by a 99.999% SLA
•24x7x365 monitoring and management
•Carrier-neutral model
•Convenient access to an array of Carriers and Internet providers •Dedicated, secure, and highly resilient connectivity with speeds of 100Mbps, 1Gbps or 10Gbps* •Supports all connectivity redundancy, business continuity, and collaborative application needs QTS data centerConnect Service
Data centerConnect is a secure, scalable, cost-effective way to connect your primary and secondary sites between two or more client environments located in different QTS data centers providing a reliable interconnection option for any size business. QTS data centerConnect enables data replication and recovery through its resilient and redundant network. This ensures your business operates successfully with seamless, day-to-day transactions over a high-performance, low latency connection that supports business continuity, data replication and other IT business application needs.

With QTS data centerConnect you get:
•High Availability – Resilient network architecture provides high availability and reliability #15..
- 767 -
SOLICITATION # CH16012
29 •Dedicated and Secure – Dedicated bandwidth with secure MPLS encapsulation •Scalable Bandwidth – Easily scale your bandwidth (from 10Mb up to 1Gb) •Flexible Network Configurations – Supports multiple network topologies •Cost-effective, Bundled Solution – All inclusive, bundled offer •Fully Managed, End-to-End – End-to-end, proactive monitoring and management, 24x7x365 QTS internetConnect Service
internetConnect provides a multi-homed, high performance, dual access, multi-carrier network that meets all your Internet service needs. We ensure maximum uptime, guaranteed availability, and various bandwidth speeds through our flexible, high performance, carrier-neutral offer. For enterprises and government agencies conducting business over the Internet, QTS internetConnect Service provides a highly reliable, secure connectivity solution for production environments. •Direct access to multiple ISP backbones gives unmatched reliability and guarantees maximum uptime
ゼDual connections with direct access to multiple ISP backbones ゼDiverse, redundant paths to multiple backbone providers ゼDual paths, with diverse entry points into the QTS Data Center •Anti-DDoS Mitigation Services provide an additional level of protection and security •Dedicated with burstable bandwidth options provides resiliency and flexibility •Backed by an industry leading 100% SLA
•Optional service plans to meet your needs
QTS ethernetConnect Service
You need to be able to connect your employees and customers to your applications and to the outside world. Whether hybrid cloud, disaster recovery/disaster recovery as a service, data replication, data migration or other applications, you need the ability to seamlessly and conveniently connect your business together and to the outside world as if there is no distance between you.

QTS ethernetConnect offers a variety of connectivity options. You can centralize your services with a single provider. And since QTS can handle everything from ordering to billing you have a single provider for a complete solution – “One Stop Shopping”. QTS understands your needs and will tailor your end-to-end solution for your business. •High Bandwidth – Speeds are available in select increments of 100Mb to 10Gb •Data Privacy – Data is separated from IP traffic as it traverses the carrier backbone •High Performance Options – Solutions can be developed to fit your specific performance or reliability requirements
•Consistency – Ethernet circuits travel over a single carrier’s infrastructure and data follows a consistent path.

SAP Ariba Ariba uses Cisco Routers and Catalysts (high-speed switches) for ensuring maximum network connection performance. They deliver enterprise-class versatility, integration, and power to Ariba. Together, these routers provide the required support for Internet/intranet access with firewall security.

Fieldglass Customers are only required to use a standard web browser with default settings to access and use the Fieldglass solution.

Hanna Cloud Capabilities are available over the network (via secure MPLS or VPN network connectivity) and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms such as mobile phones, laptops. HEC is an extension of customers existing netwerk and uses customes IP range and /24 range.

Hybris All capabilities of SAP Hybris are available over the network. Furthermore, they are accessible by standard mechanism including heterogenous thin or #15..
- 768 -
SOLICITATION # CH16012
30 thick client platforms through either standard web technologies or through the hybris OCC REST web service API's.

SuccessFactors Our solution was designed from the outset for high availability. We provide a system availability SLA of 99.5%. Every component (hardware and software) is completely redundant. There is a redundant piece of equipment or software for every hardware or software component for every layer of the infrastructure stack (server, software and network).

We load balance at every tier in the infrastructure, from the network to the database servers. F5 load balancers are used to route traffic to an available web server to process the request. Application server clusters are enabled so that servers can fail without interrupting the user experience. We maintain an N+1 approach for all equipment in the hosted cloud environment, so that there is never a single point of failure. All customer database backups are encrypted and streamed in a secure manner from the customer’s “primary” data center to their “alternate” data center, allowing for a timely restoration of service in the event of disaster.

Based on the terms of the agreement, we will designate one of the data centers as the customer’s “primary” data center, with an additional data center designated as the “alternate” for data redundancy and disaster recovery purposes.

Load balancers will automatically detect a software or hardware error and take the servers out of service if needed without interrupting the user experience or application. They also allow capacity addition or reduction without interrupting service.

All of the JBOSS application servers are clustered. Each is designated as a primary and a secondary, so any application server can fail without any loss of service or interruption of the application or user experience.

The database servers are also clustered using a Veritas high availability cluster. The Veritas suite will detect any hardware or software errors in the database machines and automatically fail them over to a standby server VMware VMware's IaaS offerings complies with the Broad Network Access characteristic. All fo these products' capabilities are available over the public internet and can be used by heterogeneous thin or thick client platforms. Consumers only need internet access to access these resources.

Additional capabilities exist including the ability to secure communications over the public internet including IPSEC VPN, SSL Client VPN, and the ability to consume via WAN connectivity.

VMware's SaaS offering AirWatch can be accessed over the internet or private network through standard mechanisms.

FireEye All FireEye cloud offerings included in this response meet the definition of broad network access.

Each of the solutions performs its designed functionality over standard internet-facing services and is accessible via a web browser from any internet connected device when valid credentials are provided.

VirtueStream Virtustream IaaS provides Broad Network Access, where it can provide landing zone for any private network (Point-to-Point, Virtual Private Label Switching, Multi-Protocol Label Switching, or Direct Connect), public network (Internet, Trusted Internet Connectivity as landing zone, IPSEC VPN and SSL VPN) and also extranet connectivity (shared network, i.e, Cloud Connect, Cloud Exchange, etc.) which is growing rapidly as option for connecting cloud resources.

8.1.2.3 NIST Characteristic - Resource Pooling: Provide a brief written description of how the cloud solutions proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how resource pooling technical capability is met. #15..
- 769 -
SOLICITATION # CH16012
31 Carahsoft’s multiple Cloud Service Provider’s solution provides for Resource Pooling, as defined by NIST, in a variety of methods. Each method optimizes the cloud subscriber’s experience while optimizing the availability of compute, network, and data resources. Each service provider provides Resource Pooling, see below for details.

CA APM CA API Management SaaS (SaaS APIM) has been built from the ground up to be a multi-tenanted, SaaS-based offering that leverages Amazon’s infrastructure to scale appropriately; utilize a continuous integration model to provide for frequent updates; and fail over across multiple availability zones.

MAA MAA core service utilizes dedicated infrastructure layered with virtualization capabilities. It doesn’t share computing resources with other services. Tenants are segregated using application containerization capabilities.

CA Agile We monitor all system resources and have alerting mechanisms when resource constraints have reached a defined threshold. We can easily scale our systems to accommodate any additional capacity. If we determine a single user is using a significant amount of resources we will proactively reach out to them to understand what they are trying to accomplish and help them to formulate more performant queries.

ASM All ASM core servers are dedicated physical servers. ASM Public Status Pages are served from dedicated web servers (used only by CA ASM) in the Amazon Cloud, on shared tenancy virtualization. Amazon Cloud virtual machines used by ASM are managed by and provisioned by CA ASM systems administrators.

Google SaaS, Google's global infrastructure is a shared pool of resources that dynamically serve each end user with a primary data center access point that may rotate throughout the session without the end user being aware while at the same time replicating any data across at least two additional geographically dispersed data centers which also may rotate through the session.

PaaS/IaaS, Google Cloud Platform also operates across the global Google infrastruture. The elements of this service can be defined within the Developer's console to run within a higher level of abstraction which covers four regions; Central US, Eastern US, Western Europe, East Asia where each region has three or four zones.

AODocs AODocs infrastructure is hosted in Google App Engine and data of our customers on Google Drive. This protection is insured by Google.

Virtru Virtru Services are offered in a fully multi-tenant mode if the customer requests.

Salesforce Salesforce is a multitenant cloud-based subscription service. Multi-tenant cloud solutions provide a single, shared infrastructure, one code base, one platform that is all centrally managed, with platform-based API to support all integration traffic, and multiple release upgrades included as part of the subscription service. Multi-tenancy and the Cloud Computing model remove unneeded tasks from the process of delivering, managing, and integrating software. Salesforce customers will not need to maintain any hardware or software. Without multiple versions to support, integrations don’t break during updates; they are simply updated automatically. As a result, both the initial integration and its continued maintenance are simplified. More resources can be focused on creating a better product, with a faster cycle of innovation, instead of having to manage the complexity of many different versions to support a vast installed base.

Salesforce's position as an online service enables us to roll out all levels of improvement, from patch releases to major upgrades that are largely transparent to the end users. When a bug is fixed and tested, it is rolled out to the application as part of regular maintenance; the nature of the service prevents special patches and code branches for individual customers, so all fixes can potentially benefit all customers.

ServiceNow The ServiceNow environment is a private cloud, fully owned and operated by ServiceNow, which supports a logically single tenant architecture. Customer data is isolated from other customer data #15..
- 770 -
SOLICITATION # CH16012
32 by leveraging an enterprise-grade cloud architecture and a dedicated database and application set per instance. This gives ServiceNow customers cost reduction through shared infrastructure, while having the security benefits of customer-specific isolation at the application and data layers. In addition to the security features that come standard within the platform and each customer instance, customers can leverage the additional security features within ServiceNow to augment the security configuration of their instances based on their own needs and risk profile.

Customers share a hardware platform (no virtualization), but access entirely separate individual instances of the ServiceNow platform.

Docusign
QTS Resource pooling. The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, and network bandwidth.

SAP Ariba Ariba recognizes that customers need the highest-possible availability and reliability. To that end, Ariba infrastructure is scalable and redundant at all tiers. To provide high availability and reliability, Ariba has extensive error handling and fail-over capabilities. In order to ensure the highest availability, Ariba uses such best practices as frequent systems backup and maintenance, redundant systems, proactive customer notification of unplanned down-time and international support coverage.

Fieldglass Fieldglass is offered in a SaaS model. All customers access the same Fieldglass application version in a multi-tenancy database. The system is hosted in a secure hosting facility. All system resources are available to all customers without limitation.

Hanna SAP HEC does not pool resources for critical business systems as it’s a managed private cloud, which is dedicated to one particular customer.

However, network routers, availability reporting & monitoring could be shared.

Details can be provided during HEC technical assessment workshop.

Hybris All computing resources of the data centers are pooled to serve multiple customers. Each customer gets their own separate VM's and their own instances of hybris deployed to those VM's.

SuccessFactors Load Balancing & Server Clustering – We load balance at every tier in the infrastructure, from the network to the database servers. Application server clusters are enabled so that servers can fail without interrupting the user experience. Database servers are clustered for failover. We maintain an N+1 approach for all equipment in its hosted environment, so that there is never a single point of failure.

Complete Redundancy - Every infrastructure component is redundant. There are at least two of each hardware component that processes the flow and storage of data.

Backup & Restore - the Data center runs full data backups weekly and incremental data backups nightly.

VMware All VMware's IaaS products comply with the Resource Pooling characteristic (except for the Hybrid Cloud Manager which is Not Applicable). vCloud Air provides a pool of vCPU, vRAM, Network and storage on the shared physical infrastructure. vCloud Air provides the required location independence and requires that the customer directly specify location of the datacenter that will host their cloud at time of instantiation. Note VMware's SaaS is also Not Applicable.

FireEye The FireEye cloud infrastructures consists of web and application servers, operating systems, and databases in a hosted environment and are comprised of both physical and virtual devices. #15..
- 771 -
SOLICITATION # CH16012
33 Computing power and resources are load-balanced across infrastructure and replicated to redundant datacenters in the event of a disaster. Client-specific data stored in databases are logically separated from other clients’ data providing segmentation and isolation.

VirtueStream Key to Virtustream solution is its proprietary and patented solution of uVM technology, which is effectively a granular solution for resource pooling, providing application performance, pay for consumption only and segregate resources for security and compliance, but aggregate for cost efficiency. In addition, Virtustream is currently one of very few Cloud Service Provider with capabilities for Geo-Fencing and Geo-Tagging of the virtual machines to a specific data center, and getting down to cluster and host machine level. The resources are pooled based on two specific criteria:
•ONLY Accessible Using Private Network – We call this pool “Enterprise” which most of Virtustream’s IaaS workload is residing. There is no direct access from Internet into this pool. This is protected via a pair of routing and firewall from any other zones.

8.1.2.4 NIST Characteristic - Rapid Elasticity: Provide a brief written description of how the cloud solutions proposed satisfies this NIST Characteristic. Attest capability and briefly describe how rapid elasticity technical capability is met.

MAA The pool of web and application servers can be grown or shrunk when necessary.

Any changes to the size of the pool remains transparent to end-users and customers, and would only be done by CA MAA systems administrators.

CA Agile This is a SaaS service, therefore, CA monitors all system resources and have alerting mechanisms when resource constraints have reached a defined threshold. Data storage and network capacity are monitored and scaled to meet current client demands. Compute resources are scaled to meet client processing requirements ASM All ASM core servers are dedicated physical servers; there is no elasticity. The ASM Public Status Pages are served from web servers in the Amazon Cloud, and the pool of web servers can be grown or shrunk if necessary. Any changes to the size of the pool would be transparent to end-users and customers, and would only be done by CA ASM systems administrators. Since this is a SaaS environment the CA SaaS Operations and delivery along with RackSpace are responsible for management of the capacity and monitoring.

Google Saas, Google Apps can scale from 1 user to tens of thousand users. The usage of the services included are designed to horizontal scale within the confines of the per user storage allocation.

Google Apps can be purchased with a 30gb per user allocation or with unlimited storage.

Paas/IaaS, Google Cloud Platform was designed to scale on demand both in terms of available resources for applications designed and running on Google App Engine but also Compute Engine resources and more.

AODocs AODocs can scale from one user to tens of thousand users. The storage is based on the Google Apps storage which could be from 30Gb to unlimited storage depending on the Google Apps subscription.

Virtru Presently we over-provision services by 2.5x peak traffic in order to handle spikes. We are in the process of implementing horizontal scaling of all services and expect to have that work completed in the second half of 2016.

Salesforce User AuthenticationLogon is form-based. When users log into the Salesforce application, they submit a username and password, which are sent to Salesforce via an TLS-encrypted session. #15..
- 772 -
SOLICITATION # CH16012
34 Security features are developed by Salesforce and built into the application. Third-party packages are not used for development or implementation of security internal to the application.

In addition, single sign-on and two-factor authentication may be used to authenticate users. Some organizations prefer to use an existing single sign-on capability to simplify and standardize their user authentication. You have two options to implement single sign-on—federated authentication using Security Assertion Markup Language (SAML) or delegated authentication.

Federated authentication using Security Assertion Markup Language (SAML) allows you to send authentication and authorization data between affiliated but unrelated Web services. This enables you to sign-on to Salesforce from a client application. Federated authentication using SAML is enabled by default for your organization.

Delegated authentication single sign-on enables you to integrate Salesforce with an authentication method that you choose. This enables you to integrate authentication with your LDAP (Lightweight Directory Access Protocol) server, or perform single sign-on by authenticating using a token instead of a password. You manage delegated authentication at the profile level, allowing some users to use delegated authentication, while other users continue to use their Salesforce-managed password. Delegated authentication is set by profile, not organization wide. You must request that this feature be enabled by Salesforce.

Salesforce can be configured to utilize Active Directory directly via Delegated Authentication, or indirectly via Federated Identity using either SAML 1.1, or SAML 2.0. Additionally your users can be loaded from information drawn from your Active Directory servers and modifications made in Active Directory can be propagated into Salesforce.

Customers can use their own SAML Identity Provider, or license one directly from Salesforce with our Identity Connect product.User ProvisioningUser provisioning and management is performed through the Salesforce Administrative Setup environment and is performed by Salesforce customers. Users, their profiles, permissions and passwords may be managed, edited, activated and deactivated as needed by those with appropriate permissions. An administrator (appointed by the customer and not by Salesforce) with appropriate privileges can manage session timeout, password policies, IP range login restrictions, delegated authentication/SSO, and requirements as part of this process. On first time login or password reset request, users are required to change their passwords to gain access. Salesforce also offers delegated authentication, enabling customers to provision and deactivate users from an external directory service.User Access ProfilesSalesforce enables administrators to manage roles and relationships between roles from within the application, in a single easy to read page depicting the role hierarchy.

All users and application-level security are defined and maintained by the organization administrator and not by Salesforce. The organization administrator is appointed by CSBS. An organization's sharing model sets the default access that users have to each other's data.

There are four sharing models: Private, Public Read Only, Public Read/Write, and Public Read/Write/Transfer. There are also several sharing model elements: Profiles, Roles, Hierarchy, Record Types, Page Layouts, and Field Level security.

Details about sharing models and sharing model elements are provided below:

Private
Only the record owner, and users above that role in the hierarchy, can view, edit, and report on those records.
#15..
- 773 -
SOLICITATION # CH16012
35 Public Read Only
All users can view and report on records but not edit them. Only the owner, and users above that role in the hierarchy, can edit those records.

Public Read/Write
All users can view, edit, and report on all records.

Public Read/Write/Transfer
All users can view, edit, transfer, and report on all records. Only available for cases or leads.

Profiles
A profile contains the settings and permissions that control what users with that profile can do within Salesforce. Profiles control:

Standard and custom apps the user can view (depending on user license) Service providers the user can access
Tabs the user can view (depending on user license and other factors, such as access to Salesforce CRM Content)
Administrative and general permissions the user has for managing the organization and apps within it
Object permissions the user is granted to create, read, edit, and delete records Page layouts a user sees
Field-level security access that the user has to view and edit specific fields Record types are available to the user
Desktop clients users can access and related options
Hours during which and IP addresses from which the user can log in Apex classes a user can execute
Visualforce pages a user can access
User Roles
Every user must be assigned to a role, or their data will not display in opportunity reports, forecast rollups, and other displays based on roles.

All users that require visibility to the entire organization should be assigned the highest level in the hierarchy.

It is not necessary to create individual roles for each title at the company, rather a hierarchy of roles should be defined to control access of information entered by users in lower level roles.

When a user's role is changed, any relevant sharing rules are reevaluated to add or remove access as necessary.

Record Types
If the customer's organization uses record types, edit the record type to modify which pick list values are visible for the record type. A default pick list values can be set based upon the record type for various divisions.

Field Level Security
Field-level security settings let administrators restrict user's access to view and edit specific fields on detail and edit pages and in related lists, list views, reports, Offline Edition, search results, email and mail merge templates, Custom Links, and when synchronizing data. #15..
- 774 -
SOLICITATION # CH16012
36 The fields that users see in detail and edit pages are a combination of page layouts and field-level security settings. The most restrictive field access settings of the two always apply. For example, if a field is required in the page layout and read-only in the field-level security settings, the field-level security overrides the page layout and the field will be read-only for the user.

ServiceNow ServiceNow is a multi-instance architecture that gives every customer its own unique database, which means that it is impossible for your data to be commingled with any other customer. The multi-instance architecture is not built on large centralized database software and infrastructure.

Instead, we deploy instances on a per-customer basis, allowing the multi-instance cloud to scale horizontally and infinitely. For our multi-instance cloud, we deploy separate application logic (Apache Tomcat Java Virtual Machines) and database processes (MySQL) for every customer.

This allows ServiceNow to scale its application servers out horizontally by adding them to the load balancer pools for a particular instance.

QTS Rapid elasticity. Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly out ward and in ward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time.

Delivering scalable, secure, high-performing, virtual data centers for government applications QTS is committed to not only giving your cloud the most secure home, but also the ability to utilize bestof-breed technologies.

Flexible, high-performing, future proof infrastructure: Built upon the VMware vCloud® Suite, you’ll benefit from reliable, high-performing infrastructure using a platform that includes VMware, EMC and Cisco. This compatible solution easily integrates with private VMware environments and provides a pathway to a hybrid cloud.Our scalability increases agility, efficiency and productivity:

Your technologists can focus more time on your business and customers, and less time on your infrastructure. Rapid provisioning and improvements in utilization enhances your speed to market, delivers applications faster, and gets projects out the door.

Virtually unlimited bandwidth and communications diversity QTS operates carrier-neutral data center facilities. This means that customers can select their communications service providers from hundreds of carriers, Internet Service Providers, dark fiber and satellite companies to meet their transport requirements. Selecting a provider from such a broad list of options gives customers exceptional route diversity and pricing options, as well as different Service Level Agreements and installation schedules. Customers who need very high amounts of bandwidth to conduct their business efficiently will never have to worry about running out of capacity at a QTS facility. Similarly, customers who require exceedingly high communications security have the benefits of selecting from physically diverse routes between their ends points and dark fiber that is not shared with any other users. In short, there are virtually no limitations to the type, amount, or security of communications available at each QTS data center facility.

SAP Ariba There are no scalability limits with our products. We can scale accordingly to fit any data amount or user volume scenario.

Fieldglass The hosted Fieldglass solution can be horizontally and vertically scaled very quickly as the web server farm is fully virtualized. Only the SQL server is bare metal by design.

Hanna SAP HEC can be rapidly scaled to provision infrastructure & services on demand per customer requests.

SuccessFactors Our solution was designed and developed, from the outset, to be a highly scalable application. We also use the concept of “PODS,” from a hardware perspective. A POD is a fault tolerant cluster of application & DB servers #15..
- 775 -
SOLICITATION # CH16012
37 designed, as a scalable unit, to provide core processing and data storage services for fixed increment of customers.

Attributes include:

A POD is designed to support millions of subscribers. Our current 2nd Generation POD is scaled to 5M+
Multi-Vendor High Performance Blade Servers with 40GBps backplane fabric interconnects
Multiple redundant Application Engines
Clustering for availability and performance
Hardware load balancers to route each new incoming session to the most available web and application processor
Designed to support a high rate of concurrent connections while maintaining sufficient redundant capacity to meet SLA requirements
New production PODs undergo a verification process before being brought into service
Excess capacity PODs are always available on standby (scalability-ondemand) We will increase capacity if data center utilization surpasses the 70% threshold
VMware All vCloud Air offerings partially comply with Rapid Elasticity. vCloud Air can be purchased as a pool of vCPU, vRAM, Network and Storage on shared or dedicated physical infrastructures that can be elastically provisioned and released. VMware's vCloud Air On Demand is fully compliant because capabilities can be elastically provisioned and released. VMware's SaaS Products i.e.

AirWatch, does comply but the NIST requirement is not relevant to SaaS offerings. Note the vCloud Air Hybrid Cloud Manager is not Applicable.

FireEye FireEye cloud environments are continuously monitored by cloud service operations (CSO) personnel to help ensure secure operation and available of the system. Capacity is actively monitored and pro-active upscaling is conducted to ensure resources are always available to endusers. Procedures are in-place for rapidly adding resources in the event the infrastructure approaches capacity.

VirtueStream Virtustream’s self-service portal, ticketing system and also the Technical Account Manager, who is the single point of contact for State of Utah allows for provisioning and deprovisioning of resources and services. In addition, Virtustream is uniquely positioned to provide application level provisioning as part of its standard automation and orchestration tool. Resources can be scaled based on application size, memory, storage, network requirements. xStream utilizes a supply chain to define resource profiles, attributes and offerings than can be provisioned.

8.1.2.5 NIST Characteristic - Measured Service: Provide a brief written description of how the cloud solutions proposed satisfies this NIST Characteristic. Attest capability and briefly describe how measured service technical capability is met.

CA APM Continuous monitoring of all service components (infrastructure and application) is deployed to proactively identify any component or service trending towards failure or approaching capacity. This portion is handled for the underlying cloud infrastructure by AWS with active participation by CA including escalations of issues.

MAA CA MAA systems administrators track the resource consumption of each virtual machine in use. ITIL flows are utilized to ensure service delivery. MAA customers do not need this information in order to use the service, nor do they have access to view it.
#15..
- 776 -
SOLICITATION # CH16012
38 CA Agile Continuous monitoring of all service components (infrastructure and application) is deployed to proactively identify any component or service trending towards failure or approaching capacity
CA’s best-of-breed monitoring solutions are deployed and supplemented with vendor specific diagnostic tools where appropriate
24x7 staffed network operation center (NOC) to analyze and respond to automated monitoring alerts
ASM CA ASM systems administrators track the resource consumption of each virtual machine in the cloud. Since this is a SaaS service, ASM customers do not need this information in order to use the service, nor do they have access to view it.

Google Saas, Google Apps is already optimized for unlimited use by all end users. Google ensures high availability, low latency and fault tolerance as a part of the contracted services. No metering or rate limiting would be required as Google does not charge based on bandwidth use.

Paas/IaaS, Google Cloud Platform includes application development tools, Google App Engine, compute resources, Compute Engine and Container Engine, data storage solutions and networking solutions. The pricing model is based on actual usage and that usage can be monitored with Google's Cloud Monitoring Service which also includes options to autoscale a project.

AODocs AODocs is already optimized for unlimited use by all end users. AODocs ensures high availability, low latency and fault tolerance as a part of the contracted services. No metering or rate limiting would be required as AODocs does not charge based on bandwidth use.

Virtru All services in our system monitored for availability, stabiity, security, and intrusion using a combination of tools, such as Dtrace, LogTrail, CloudWatch, DataDog, ElasticSearch and AlienVault.

Salesforce Subscription-based Service
The Salesforce PaaS and SaaS offerings are subscription based and in a per user/month or user/year format billed annually with some of our products offered as total logins per month or by defined number of members billed annually.

Bandwidth
Salesforce is designed to use as little bandwidth as possible so that the site performs adequately over high-speed, dial-up, and wireless Internet connections. While average page size is on the order of 90KB, Salesforce uses compression as defined in the HTTP 1.1 standard to compress the HTML content before it is transmitted as data across the Internet to a user's computer. The compression often reduces the amount of transmitted data to as little as 10KB per page viewed due to the lack of image content. The site was designed with minimum bandwidth requirements in mind, hence are extensive use of color coding instead of images. Our average user also is known to view roughly 120 pages from our site per day. Our application is stateless; therefore, there are no communication requirements in the background once the page loads, like traditional client server applications, e.g., Outlook. Therefore, once the page loads, there are no additional bandwidth requirements until a user queries or writes information to Salesforce.

System Overview
In addition to our Trust site (http://trust.salesforce.com/trust/status), you will also have access to a System Overview, which will help Salesforce customers monitor performance and usage of their own Salesforce org. This overview includes:

Schema - # and % of custom objects and data storage
Business Logic - # and % of Rules, Apex triggers and classes, as well as % of code used Licenses
API Usage - # and % of requests in the last 24 hours
User Interface - # and % of custom apps, sites, flows, custom tabs and pages #15..
- 777 -
SOLICITATION # CH16012
39 Portal
The above list is of all the possible metrics that Salesforce customers may have in their system overview.

ServiceNow ServiceNow is a subscription service measured by number of user accounts or number of managed nodes. ServiceNow has a documented capacity-planning model, which is used to determine sizing requirements and scaling options. The need to address capacity and horizontal system scaling is in the background, transparent to our customers.

Docusign
QTS Measured service. Cloud systems automatically control and optimize resource use by leveraging a metering capability 1 at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service.

SAP Ariba We have an Internal Tools Development Team which has established active monitoring systems with alerting and automated escalation. This includes log monitoring from the backend of the systems and this is tied to established internal processes related to security incident management. The environment, policies, tickets and reports are reviewed under ISAE 3402 assurance audit every six months.

Fieldglass Fieldglass utilizes various methods to ensure the system is available and is operating as expected.
• Our network performance monitor ensures that all servers and devices are available and performing as expected.
• All devices and servers on our network log into our enterprise SIEM tool. All activity is monitored by the Fieldglass security team to ensure activity does not vary from our known baseline.
• An Active Performance Monitor has been built into the Fieldglass system.

This monitor logs all system activity and enables Fieldglass engineers to drill into data such as concurrent user count, thread count, memory, CPU, SQL duration, server duration, client duration, page hits, etc. This data can be drilled into by day, hour, minute, server, and user.
• Customer SLAs are tracked and communicated on a monthly basis. For 2015 we have a 99.4% success rate in meeting all customer page response time SLAs.

Hanna SAP HEC services are measured via SAP solution manager and reports are shared with the customer on a monthly basis as well as via self-service reports. SAP HEC operations team monitors the customer landscape and any disruption is addressed after reaching out to the customer and associated approval.

SuccessFactors Our hosting sites are designed to accommodate customers desiring a high level of managed service performance. In order to achieve such a level of performance, proactive monitoring is available through a variety of on-line tools that are implemented and managed by Cloud Operations. At a customer management level, the Cloud Operations monitors a series of “key metrics” that measure the results of various processes involved in supporting the business operations and service reliability. These metrics include reports of transaction volumes, latency, system availability, capacity, change management, and help incident response times as compared with established service level goals and standards.

To facilitate required system performance, we monitor and tune the use of resources, and makes projections of future capacity requirements. We employ #15..
- 778 -
SOLICITATION # CH16012
40 a variety of services to monitor and enhance application performance. The network makes extensive use of high availability architecture, and is monitored on a 24x7 basis at multiple levels.

We utilize real time web applications performance monitoring software to do the following:

Sample web traffic in real time via performance analysis software Track web application errors, (e.g. http 4xx-5xx errors) Monitor end-to-end user performance trends
Detailed session analysis for session troubleshooting
This data is reviewed on a daily and weekly basis by Operations Support, and is further supported with automated alerts. We proactively gather performance statistics, set triggers to alert on capacity thresholds, and regularly review utilization trends for capacity planning.

VMware VMware's provides automatic monitoring and metering services to their IaaS and SaaS offerings.

Note the vCloud Hybrid Manager is not applicable as it is not metered, because it is for management.

FireEye FireEye cloud environments are continuously monitored by cloud service operations (CSO) personnel to help ensure secure operation and availability of the system. An internal monitoring system operates 24 hours per day to assess system availability and performance. The system is configured to send email alert notifications to FireEye operations personnel on a real-time basis communicating potential issues with the production systems.

VirtueStream The fundamental of Virtustream solution is based on uVM Technology, which is very unique in terms of billing. Virtustream solution takes average consumption of compute resources, and State of Utah would only pay for actual resources based on a monthly average. This is in comparison with traditional cloud solution, where the billing is based on allocation of resources in T-Shirt size (Micro, S, M, L, XL, XXL), and if the server is up, consumer of the cloud pays, but when it is down, they don’t. In case of the Virtustream solution, customer only pays based on the average of vCPU, RAM, IOPS and Network I/O; the key is average, not aggregate and based on consumption not allocation. In addition, all storage, security, application management services are offered as a monthly fee, based on the VMs; also, Virtustream can provide consultative and project support based on time and materials.

The µVM brings significant benefits: enabling application level performance SLAs – which an average VM cannot. µVMs eliminate wasted headroom in fixed size VMs, generating significant efficiency improvements (up to 40% beyond traditional virtualization) and Virtustream only charges by the µVM so you only pay for the resources you actually consume not what you might need.

Using µVMs also enables applications to be used across multiple hypervisors, across multiple clouds and between different locations – enabling true hybrid clouds. µVM technology allows Virtustream to offer enterprise class clouds capable of running both mission-critical enterprise applications and web-scale applications, delivering the full benefits of cloud to the enterprise.

8.1.3 Offeror must identify for each Solution the subcategories that it offers for each service model. For example if an Offeror provides a SaaS offering then it should be divided into education SaaS offerings, eprocurement SaaS offerings, information SaaS offering, etc.

CA APM In addition to the APIM SaaS offering CA Technologies also offers educational services and consultancy services. CA provides education and training services to its clients.

MAA CA MAA helps app developers visualize, investigate, manage, and support user interactions with their mobile apps. It provides deep insights into the performance, user experience, crash, and log analytics of mobile apps. CA MAA is aimed to help #15..
- 779 -
SOLICITATION # CH16012
41 enterprises understand the experience of mobile app users across the DevOps application lifecycle. Enterprises can accelerate the delivery of user-experiencefocused mobile applications and can achieve faster time to market by continuous application delivery while ensuring robust security.

CA Agile We provide a SaaS offering that is generally used to document and manage work within the SDLC. In addition to the CA Agile offering CA Technologies also offers educational services and consultancy services
ASM CA ASM is a SaaS offering that provides customers with the ability to monitor the availability, health, and performance of network services (web sites, email servers, etc.).

Google Education SaaS offering - Google Apps for Education Messaging SaaS offering - Google Apps for Work, Google Apps Unlimited Collaboration SaaS offering - Google Apps Unlimited
Identity Management SaaS offering - Google Apps SSO
eDiscovery/Archving SaaS offering - Google Apps Vault
Application Development PaaS -
Storage IaaS offering -
AODocs AODocs Team Folders
AODocs Document Management
AODocs Retention Application
AODocs Email Connector
Virtru SaaS email encryption and SaaS file encryption.

Salesforce Salesforce is the enterprise cloud computing leader dedicated to helping companies and government agencies transform into connected organizations through social and mobile technologies.

Over 150,000 Salesforce customers across nearly every industry have successfully transformed their operations including over 1000 government agencies, representing all federal cabinet level agencies and the majority of the United States. Customer examples include: State of Texas, State of Colorado, State of California, GSA, USDA, USAID, and others.

Salesforce was named one of the World’s Most Innovative Companies by Forbes for the last five years in a row. Salesforce is #1 in Enterprise Cloud Computing and #1 in CRM according to IDC.

Salesforce ranks as the Leader in the Gartner Magic Quadrant for “CRM Customer Engagement Centers” (SaaS), “Sales Force Automation” (SaaS), and “Enterprise Platform as a Service” (PaaS).

Government agencies are using Salesforce PaaS and SaaS solutions for a multitude of government functions including grants management, constituent communications and correspondence management, incident and case management, call/contact center management, outreach programs, learning management, volunteer management, project management, and even donor management, among numerous others.

ServiceNow SaaS Offerings:
•Cloud and Infrastructure Management Tools
•Customer Relationship Management
•Project and Portfolio Management (PPM) Tools
•Security
•Workflow and Electronic Signature
•Proposed new category: Information Technology Service Management Tools #15..
- 780 -
SOLICITATION # CH16012
42 QTS QTS has built some of the world’s largest, most robust, and redundant data centers. The company’s innovative 3C product set of custom data center, colocation, and cloud and managed services provides a fully integrated platform and a flexible, scalable level of service that is difficult to match.

Our service categories include:

IaaS Custom Data Center
IaaS Enterprise Cloud
IaaS Managed Cloud
IaaS vCGS Cloud
IaaS Federal Solutions
IaaS Healthcare Solutions
IaaS Financial Service Solutions
Colocation
Connectivity
Critical Facilities Management
Hybrid IT Solutions
Disaster Recovery as a Service (DRaaS)
Managed Services: Managed Hosting, Managed Network, Managed Systems, Managed Security, Managed Storage & Backup, Managed Disaster Recovery, Data Security SAP Ariba We provide solutions that allow enterprises to efficiently manage the purchasing of non-payroll goods and services required to run their business.

We refer to these non-payroll expenses as “spend.""
Our solutions include software, network access, and expertise. They are designed to provide enterprises with technology and business process improvements to better manage spend and, in turn, save money. Our solutions streamline the business processes related to the identification of suppliers of goods and services, the negotiation of the terms of purchases, and ultimately the management of ongoing purchasing and settlement activities.

Our solutions allow enterprises to take a systematic approach with products and services that work together. By combining software, network access and professional services into a comprehensive solution, we help customers to address six key areas of spend management:

Visibility - enhance spend visibility and control across spend categories, disparate systems and corporate divisions
Sourcing - identify top suppliers, negotiate procurement terms, leverage aggregate spend, and manage procurement contracts
Contract Management - streamline and automate from contract creation to compliance
Procurement – streamline requisitioning and procurement across all types of spend
Invoice and Payment - automate invoicing and payment processes Supplier Management - optimize buyer-supplier interactions throughout the spend lifecycle
Fieldglass The SAP Fieldglass Vendor Management System (VMS) application is a workforce management SaaS offering.

Hanna HANA Enterprise Cloud is a private managed cloud primarily for all SAP enterprise-wide SAP applications such as: ERP, CRM, SRM, BW, etc. All SAP applications can be hosted in HANA Enterprise Cloud (via BYOL or Subscription Licensing model)
SuccessFactors Our original product release dates are as follows:
#15..
- 781 -
SOLICITATION # CH16012
43 Performance Management – 2001
Goal Management – 2002
360/Multi-Rater Reviews - 2002
Succession Management - 2004
Compensation Management – 2004
Analytics & Reporting – 2005
Learning & Development – 2006
Recruiting Management – 2006
Variable Pay Compensation – 2007
Employee Profile – 2007
Stack Ranker – 2008
Employee Central – 2009
Metrics Navigator – 2009
Goal Execution – 2010
Calibration – 2010
Workforce Planning (Acquisition) – 2010
Workforce Analytics (Acquisition) - 2010
Plateau LMS (Acquisition) – 2011
JAM – 2011
Employee Central Payroll – March 2012
Onboarding (acquisition of KMS) – May 2013
FireEye FireEye is offering 4 distinct cloud solutions that can be classified into the following service categories and sub-categories:

1.Email Threat Prevention (ETP)
Security – SaaS

2.Mobile Threat Prevention (ETP)
Security – SaaS

3.Threat Analytics Platform (TAP)
Threat Intelligence – SaaS

4.FireEye as a Service with Continuous Vigilance (FaaS CV) Managed Security Service – SaaS
VirtueStream Virtustream is an Infrastructure as a Service (IaaS) offering focused on mission critical workloads and applications.

The solution provides as part of the response is IaaS only. Virtustream’s IaaS is targeted for all virtualized, x86 based cloud solution. While we have secured and segmented infrastructure for FedRAMP, FISMA, PCI and other regulated workload, it is best suited for any and all enterprise workload as long as the workload can be virtualized and run on x86 platform. For non x 86 environments, Virtustream provides Collocated areas, which is cross connected with the cloud.

8.1.4 As applicable to an Offeror’s proposal, Offeror must describe its willingness to comply with, the requirements of Attachments C & D.

Carahsoft complies with the requirements in attachment C & D. Cloud service models by vendor are broken out in section 6.6 of this response per the request in attachment C.

8.1.5 As applicable to an Offeror’s proposal, Offeror must describe how its offerings adhere to the services, definitions, and deployment models identified in the Scope of Services, in Attachment D.

Carahsoft’s cloud vendors fit into multiple categories as listed out in Attachment D. Many of our vendors fit a hybrid cloud deployment method with ability to silo off a private cloud if security needs dictate such. Our cloud vendors are broken out by service model in section 6.6 of this response. Carahsoft’s cloud vendors #15..
- 782 -
SOLICITATION # CH16012
44 also fit into many categories as listed in section 1.1.3 of Attachment D. Depending on the type of data and service requested our vendors can support everything from on demand self service delivery to a completely managed and measured service option.

8.2 Subcontractors

8.2.1 Offerors must explain whether they intend to provide all cloud solutions directly or through the use of Subcontractors. Higher points may be earned by providing all services directly or by providing details of highly qualified Subcontractors; lower scores may be earned for failure to provide detailed plans for providing services or failure to provide detail regarding specific Subcontractors. Any Subcontractor that an Offeror chooses to use in fulfilling the requirements of the RFP must also meet all Administrative, Business and Technical Requirements of the RFP, as applicable to the Solutions provided. Subcontractors do not need to comply with Section 6.3.

Carahsoft will be utilizing Subcontractors to provide services and solutions for specific manufacturers within this response. In other cases, Carahsoft will work with the manufacturers to provide these services and solutions to all Participating Entities. All Subcontractors shall be vetted to ensure they have the necessary qualifications to do business within the State of Utah and any applicable Participating States. All Subcontractors will also comply with the applicable terms and conditions of the RFP and subsequent contract, as well as all Participating Addendums for the States they are subcontracting in.

8.2.2 Offeror must describe the extent to which it intends to use subcontractors to perform contract requirements. Include each position providing service and provide a detailed description of how the subcontractors are anticipated to be involved under the Master Agreement.

Carahsoft will use subcontractors as a third party company to provide services in relation to the solutions provided by the manufacturer. No other functions of contract management or execution will be performed by the subcontractor. While Carahsoft cannot determine all roles and responsibilities of the positions for each subcontractor, there are multiple different standards which subcontractors utilize for these types of contracts. Here is an example set of the traditional roles a subcontractor would play on behalf of Carahsoft for this RFP:

Job Title: Consulting Engineer
Functional Responsibility: Working under close supervision, person provides technical or scientific and project support for multiple large-scale projects that cross-cut multiple specialization and product development areas. Applies advanced business and/or technical expertise to assist others with defining, analyzing, validating and documenting complex customer operating environments, states of technology and current engineering processes. Provides advanced technical support to others involved in applying specialized knowledge to complex customer processes and requirements. Supports complex technical investigations through advanced research techniques, analysis or development phases of engineering projects. Works with other engineering disciplines in the development and application of processes to improve quality, reliability, cost customer appeal, and satisfaction.

Job Title: Project Manager
#15..
- 783 -
SOLICITATION # CH16012
45 Functional Responsibility: Possesses a thorough understanding of the process requirements and provide both technical and management oversight of the project. Responsible for customer satisfaction, serves as the single point of contact, compliance with the Statement of Work, project planning and management, resource allocation, and reporting.

Job Title: Senior Information Architect
Functional Responsibility: Provides supervision, person designs Intranet/Internet/Extranet architectures and develops implementations plans; administration activity; i.e., hardware, security, firewalls. Implements security architecture using LDAP, SSL and firewalls. Installs, configures and maintains all Intranet/Internet/Extranet tools, databases and features; provides support to e-commerce and other systems. Implements server design, development, and operation as well as analyze and develop requirements for hardware sizing/capacity, data validation, security and integration points to other applications.

Job Title: Information Architect
Functional Responsibility: Designs Intranet/Internet/Extranet architectures and develops implementations plans; administration activity; i.e., hardware, security, firewalls. Implements security architecture using LDAP, SSL and firewalls. Installs, configures and maintains all Intranet/Internet/Extranet tools, databases and features; provides support to e-commerce and other systems. Implements server design, development, and operation as well as analyze and develop requirements for hardware sizing/capacity, data validation, security and integration points to other applications.

Job Title: Senior Consulting Engineer
Functional Responsibility: Provides supervision, person provides technical or scientific and project support for multiple large-scale projects that cross-cut multiple specialization and product development areas.

Applies advanced business and/or technical expertise to assist others with defining, analyzing, validating and documenting complex customer operating environments, states of technology and current engineering processes. Provides advanced technical support to others involved in applying specialized knowledge to complex customer processes and requirements. Supports complex technical investigations through advanced research techniques, analysis or development phases of engineering projects. Works with other engineering disciplines in the development and application of processes to improve quality, reliability, cost customer appeal, and satisfaction.

8.2.3 If the subcontractor is known, provide the qualifications of the subcontractor to provide the services; if not, describe how you will guarantee selection of a subcontractor that meets the experience requirements of the RFP. Include a description of how the Offeror will ensure that all subcontractors and their employees will meet all Statement of Work requirements.

Carahsoft will be making the determination of what subcontractors to include on the NASPO ValuePoint Cloud contract upon time of award. Carahsoft will ensure a subcontractor has all of the necessary certifications to do business in the State before adding them to the contract as a subcontractor. In addition, Carahsoft will do credit checks and meet with the subcontractor on multiple occasions to confirm that they are reliable and exceed expectations as a services and solutions provider. Finally, an agreement will be put in place between Carahsoft and the subcontractor to ensure optimal efficiency with the subcontractor’s responsibilities.
#15..
- 784 -
SOLICITATION # CH16012
46 A subcontractor will be actively involved in understanding and shaping any Statements of Work created for the services of a deal in order to make sure that they have the capacity to meet all of the necessary requirements. These Statements of Work will dictate the terms upon which the subcontractor is deployed for services, so Carahsoft will work specifically with subcontractors that are active in the public sector and understand the nuances of selling to government entities.

8.3 Working with Purchasing Entities

8.3.1 Offeror must describe how it will work with Purchasing Entities before, during, and after a Data Breach, as defined in the Attachments and Exhibits. Include information such as:
 Personnel who will be involved at various stages, include detail on how the Contract Manager in Section 7 will be involved;
 Response times;
 Processes and timelines;
 Methods of communication and assistance; and
 Other information vital to understanding the service you provide.

Security is of the uptmost importance to all of the Service providers that Carahsoft is submitting. Should and actual breach occur, it is the first priority of Carahsoft and the service provider to identify the source of the breach and implement safe guards to prevent one from happening in the future. The Service Provider will promptly notify the Purchasing Entity of the incident. Notification of the breach will be provided by the service directly to the security or customer contact that is identified by the Purchasing Entity. Methods of communication could include phone or email notification.

8.3.2 Offeror must describe how it will not engage in nor permit its agents to push adware, software, or marketing not explicitly authorized by the Participating Entity or the Master Agreement.

Carahsoft ensures that no unwanted marketing efforts are made to customers through an easy to manage opt out system in our database. Carahsoft can also limit communications by vendor to ensure that only those vendors approved by the customer reach out with marketing materials or product updates. Carahsoft will never support or assist in the pushing of adware or unwanted software to participating customers.

8.3.3 Offeror must describe whether its application-hosting environments support a user test/staging environment that is identical to production.

For applicable cloud offerings, user test/ staging environments are available that are identical to real-time production environments.

8.3.4 Offeror must describe whether or not its computer applications and Web sites are be accessible to people with disabilities, and must comply with Participating entity accessibility policies and the Americans with Disability Act, as applicable.

The user interfaces provided for within this proposal are accessible to people with disabilities using assistive technologies.

8.3.5 Offeror must describe whether or not its applications and content delivered through Web browsers are be accessible using current released versions of multiple browser platforms (such as Internet Explorer, Firefox, Chrome, and Safari) at minimum.
#15..
- 785 -
SOLICITATION # CH16012
47 All cloud solution offerings within this proposal that are delivered via web browsers are accessible using current releases of common internet browsers such as Internet Explorer, Firefox, Chrome, Safari, and more.

8.3.6 Offeror must describe how it will, prior to the execution of a Service Level Agreement, meet with the Purchasing Entity and cooperate and hold a meeting to determine whether any sensitive or personal information will be stored or used by the Offeror that is subject to any law, rule or regulation providing for specific compliance obligations.

Upon request of the customer, Carahsoft can host meetings via Adobe Connect web conferencing software or travel in person if the need presents itself. Carahsoft is happy to support and comply with any regulations or sensitive data compliance needs that the customer identifies. Carahsoft has the ability to limit customer information to a secure and isolated database if needed.

8.3.7 Offeror must describe any project schedule plans or work plans that Offerors use in implementing their Solutions with customers. Offerors should include timelines for developing, testing, and implementing Solutions for customers.

Project scheduling and work planning documents are developed in conjunction with customer requirements. Project planning activities are conducted with a focus on developing a statement of work that defines deliverables, customer and contractor areas of responsibility, as well as project benchmarks, and deadlines. Project complexity and customer requirements determine the overall timelines for development, testing, and solution implementation.

8.4 Customer Service

8.4.1 Offeror must describe how it ensure excellent customer service is provided to Purchasing Entities.

Include:
 Quality assurance measures;
 Escalation plan for addressing problems and/or complaints; and  Service Level Agreement (SLA).

The core of Carahsoft's business is to provide the best customer service to our government customers and vendor partners. We are an IT solutions provider delivering best-of-breed hardware, software, and support solutions to federal, state and local government agencies since 2004. Carahsoft has built a reputation as a customer-centric realtime organization with unparalleled experience and depth in government sales, marketing, and contract program management. This experience has enabled Carahsoft to achieve the top spot in leading software license GSA resellers. Carahsoft has leveraged its vast contracting experience and extended it to quoting and order management. Carahsoft seamlessly generates quotes within 30 minutes or less and processed over 56,000 orders in 2014 that were each completed the same day received. Over the past ten years Carahsoft has acquired and maintained a wide variety of purchasing contract vehicles for agencies at the state, local, and federal levels.

Associated with all contracts are dedicated and experienced contract management resources. Quality and accuracy is the driving factor behind Carahsoft's successin the government market. All solutions proposals and price quotes that are sent to our customers go through a three step review process for quality. The first is a pricing review that is automatically run against the pricing database to ensure pricing accuracy for the proper contract. The second review is at the certified Account Representative level who will check pricing and configurations for accuary and also review any SOWs that are included. Finally, mangagement review confirms the quality and accuracy of the proposal that will be sent to the Purchasing Entity. Carahsoft has instituted an escalation procedure for any problems or complaints that may arise. There are four levels of escalation and include review by the Account Representative assigned to the #15..
- 786 -
SOLICITATION # CH16012
48 Purchasing Entity, followed by the Regional Manager of the territory, next to the Vice President of State and Local and finally to the President/CEO. Each stage of escalation shall have a response SLA of no more than 24 hours.

8.4.2 Offeror must describe its ability to comply with the following customer service requirements:
a. You must have one lead representative for each entity that executes a Participating Addendum. Contact information shall be kept current.
b. Customer Service Representative(s) must be available by phone or email at a minimum, from 7AM to 6PM on Monday through Sunday for the applicable time zones. c. Customer Service Representative will respond to inquiries within one business day. d. You must provide design services for the applicable categories. e. You must provide Installation Services for the applicable categories.

Carahsoft confirms and agrees that we will name a lead representative for each Participating Addendum. The contact information will be listed on the Carahsoft website and kept current. Carahsoft confirms it will have a representative available by phone and email available 7am-6pm on Monday through Sunday in the applicable time zones. Carahsoft confirms that it will respond to all inquiries within one business day or sooner. Carahsoft will engage with our service providers to provide design services in the applicable categories Carahsoft will engage with our service providers to provide installation services in the applicable categories.

8.5 Security of Information

8.5.1 Offeror must describe the measures it takes to protect data. Include a description of the method by which you will hold, protect, and dispose of data following completion of any contract services.

Security is of the utmost importance to Carahsoft and our service providers. As an example of our Service Provider's security standards, please see the government security response for Salesforce: Government Trusted Security and Infrastructure
Salesforce understands that the confidentiality, integrity, and availability of our customers’ information are vital to their business operations and our own success. We use a multi-layered approach to protect that key information, constantly monitoring and improving our application, systems, and processes to meet the growing demands and challenges of security.

Independent audits confirm that our security goes far beyond what most companies have been able to achieve on their own. Using the latest firewall protection, intrusion detection systems, and TLS encryption, Salesforce Force.com gives you the peace of mind only a world-class security infrastructure can provide.

Third-party validation
Security is a multidimensional business imperative that demands consideration at multiple levels, from security for applications to physical facilities and network security. In addition to the latest technologies, world-class security requires ongoing adherence to best-practice policies. To ensure this adherence, we continually seek relevant third-party certification, including ISO 27001, the SysTrust audit (the recognized standard for system security), and SSAE 16 SOC 1 audit (an examination and assessment of internal corporate controls, previously known as SAS 70 Type II). SOC1, SOC2 and SOC3 audits are performed by third party auditor annually at a minimum. Additional audits and certifications include: CSA ‘Consensus Assessments Initiative’, JIPDC (Japan Privacy Seal), Tuv (Germany Privacy Mark), and TRUSTe.

Protection at the application level
#15..
- 787 -
SOLICITATION # CH16012
49 Salesforce protects customer data by ensuring that only authorized users can access it. Administrators assign data security rules that determine which data users can access. Sharing models define companywide defaults and data access based on a role hierarchy. All data is encrypted in transfer. All access is governed by strict password security policies. All passwords are stored in SHA 256 one-way hash format.

Applications are continually monitored for security violation attempts.

Protection at the facilities level
Salesforce security standards are stringent and designed with demanding customers in mind, including the world’s most security-conscious financial institutions. Authorized personnel must pass through five levels of biometric scanning to reach the Salesforce system cages. All buildings are completely anonymous, with bullet-resistant exterior walls and embassy-grade concrete posts and planters around the perimeter. All exterior entrances feature silent alarm systems that notify law enforcement in the event of suspicion or intrusion. Data is backed up to disk or tape. These backups provide a second level of physical protection.

Neither disks nor tapes ever leave the data center.

Protection at the network level
Multilevel security products from leading security vendors and proven security practices ensure network security. To prevent malicious attacks through unmonitored ports, external firewalls allow only http and https traffic on ports 80 and 443, along with ICMP traffic. Switches ensure that the network complies with the RFC 1918 standard, and address translation technologies further enhance network security. IDS sensors protect all network segments. Internal software systems are protected by two-factor authentication, along with the extensive use of technology that controls points of entry. All networks are certified through third-party vulnerability assessment programs.

Trust.salesforce.com is the Salesforce community’s home for real-time information on system performance and security. On this site you'll find:
ズ Live and historical data on system performance
ズ Up-to-the minute information on planned maintenance
ズ Phishing, malicious software, and social engineering threats ズ Best security practices for your organization
ズ Information on how we safeguard your data

8.5.2 Offeror must describe how it intends to comply with all applicable laws and related to data privacy and security.

Carahsoft is happy to support and comply with any regulations or sensitive data compliance needs that the customer identifies. Carahsoft has the ability to limit customer information to a secure and isolated database if needed. Under no circumstances will Carahsoft ever publish or release secure customer data.

Carahsoft’s cloud vendors are all FIPS certified or have equivalent security standards in place to ensure no customer data is released outside of the secure cloud.

8.5.3 Offeror must describe how it will not access a Purchasing Entity’s user accounts or data, except in the course of data center operations, response to service or technical issues, as required by the express terms of the Master Agreement, the applicable Participating Addendum, and/or the applicable Service Level Agreement.
#15..
- 788 -
SOLICITATION # CH16012
50 Carahsoft will use customer accounts and data only in the processing of an order and management of the customer’s service entitlements. Carahsoft’s vendors, as outlined in their specific Master Agreements, only us customer account data for the express purpose of providing the service to the customer. Included in that service is implementation, technical support, and training efforts. Under no circumstances will Carahsoft or its cloud partners use customer information outside of normal operating procedures.

8.6 Privacy and Security

8.6.1 Offeror must describe its commitment for its Solutions to comply with NIST, as defined in NIST Special Publication 800-145, and any other relevant industry standards, as it relates to the Scope of Services described in Attachment D, including supporting the different types of data that you may receive.

CA APM CA technologies understands that security is a top concern when evaluating cloudbased applications, which is why CA technologies operations worldwide conform to rigorous certification, compliance and security programs and processes. In addition, we contract with independent auditors to regularly evaluate and validate the security of our service. High risks are identified, validated and remediated before production systems are made available. Medium risks are evaluated and resolved on a priority basis.

MAA
CA Agile We use CIS and NIST standards as baselines for hardening our systems. We are currently working towards a NIST 800-53r4 certification however this is not yet complete. We are continuously reviewing our compliance with these standards. We perform monthly scans against our Production Infrastructure based on CIS standards.

We scan for both vulnerabilites and compliance best practices bases on NIST 800- 53v4 standards. Vulnerabilites are tracked and remidiated based on severity and risk.

ASM Please see our response to APM/MAA
Google Google's currently maintains a FedRAMP Authorization to Operate. FedRAMP incorporates the relevant NIST SP and FIPS security requirements. Further, Google contractually commits to maintaining SOC2 and ISO27001 certifications.

AODocs AODocs is committed to comply SOC2 type 2.

Virtru Virtru's business depends on its ability to support healthcare and criminal justice markets, which requires us to maintain compliance with HIPAA and CJIS standards which both make extensive use of NIST standards
Salesforce On May 23, 2014 Salesforce achieved a FedRAMP Agency Authority to Operate at the moderate impact level (as described in FIPS 199 and 200) issued by Health and Human Services (HHS) for the Salesforce Government Cloud. Additionally, on May 15, 2015, HHS, as the FedRAMP authorizing agency, approved the Salesforce Government Cloud authorization package that was updated based on annual attestation requirements and updates to the FedRAMP baseline which is FISMA compliant and based on the current release of NIST SP 800-53 Rev. 4.

Salesforce provides contractual assurance to its customers that the Customer Data hosted in Salesforce’s services will be kept confidential and not accessed by third parties except under narrow circumstances (such as a customer support issue or as required by law). In the case of customer support, the company's personnel will access a customer's Org only with prior approval and subject to confidentiality obligations.

ServiceNow ServiceNow is a cloud service provider offering a SaaS solution deployed from a private cloud that meets the five essential characteristics of cloud computing as described in 8.1.

ServiceNow applies the same data classification for all hosted customer data. ServiceNow does not inspect or monitor its customers’ information and therefore has no ability to sub-classify #15..
- 789 -
SOLICITATION # CH16012
51 customer data. The overriding requirement of the assigned classification is that customer data remains hosted in the private cloud until the customer terminates their subscription. It is never stored anywhere apart from the private cloud.

Customers remain the data owner and data controller for all data placed into their instance.

ServiceNow does not examine, inspect, monitor or analyze customers’ data.

Customers apply access controls to restrict access to data within their instances based on their own requirements and needs, including their own data classification.

QTS QTS understands the growing number of requirements along with the complexity of managing the high cost-risk if you are not in compliance, and makes compliance a top priority. Our dedicated QTS Internal Audit team is focused on helping you define controls and processes to meet your ever-expanding compliance requirements. We are steadfast in protecting your data with the commitment to allocate required resources, technology and controls to not only help you achieve and maintain compliance today, but to expertly support your needs as they inevitably grow and change in the future.

QTS tackles compliance differently. We provide a flexible, integrated approach to meet the IT compliance and regulatory needs across a wide variety of industries – from Payment Card Industry Data Security Standard (PCI DSS) and the Health Insurance Portability and Accountability Act (HIPAA) to U.S.–EU Safe Harbor. Our approach reduces the complexity and workload to effectively support their compliance efforts.

SAP Ariba Our security framework, which consists of semi-annual independent third party AICPA audit under the Trusted Services Principles of security, confidentiality, process integrity and availability as well as annual certification by an independent Qualified Security Assessor for PCI DSS, is highly aligned with the NIST controls.

Our security framework and cloud services are designed to receive process and store data sets of a commercial business-to-business nature and are multi-tenant and international in scope. FISMA/NIST is designed to protect US government data that can include classified information as well as sensitive PII such as ePHI and SSN’s or government identifiers.

We practice data avoidance where these data sets are concerned primarily to reduce the risk to us and to our customers but also to avoid additional regulatory compliance which has onerous reporting and high costs which would have to be passed on to our customers. Where FISMA regulated entities can take advantage of our solutions, the data sets they expect to store must be validated to avoid being under regulatory requirements beyond what we can provide in terms of both security as well as reporting.

Fieldglass Fieldglass has based its security program on the ISO 27002 security standard and has maintained its ISO 27001 certification since February 2011.

However, to ensure that a robust security framework was developed, additional controls were added and/or modified based on COBIT DS5 Ensure Systems Security, specific NIST special publications, and vendor specified best practices. Fieldglass uses a SSAE 16 audit with a twelve-month audit cycle to validate that the controls defined within the security framework are operating effectively.

Hanna SAP will show the compliance with the SAP Cloud Security Framework by the compliance audits and/or certification audits only as it pertains to the HANA Enterprise Cloud. SAP Cloud and Infrastructure Delivery’s Security, Risk & Compliance Office has developed the Integrated
#15..
- 790 -
SOLICITATION # CH16012
52 Information Security Management System (IISMS) Framework. The IISMS Framework is based on SAP’s corporate quality and security policy as well as the corporate security standards and guidelines relating to information security and business continuity. This IISMS Framework was adapted to SAP Cloud Security Services as SAP Cloud Security Framework (Cloud SFW).

SAP’s security, process and compliance team conducts technical security audits to validate that security concepts have been implemented successfully and to safeguard the usage of newly developed tools.

Compliance Audits
Cloud solutions from SAP have passed ISAE3402/SSAE16-SOC 1 Type II and/or SOC 2 Type II audits (in the following referred to as SOC audits) and can provide the related audit reports on request.

Certification Audits
The SAP HANA Enterprise Cloud has attained certifications according to the following ISO standards are available (related audits are in the following referred to as ISO audits):
• ISO 27001:2013
• ISO 22301:2012
• ISO 9001:2008
SuccessFactors Our IT architecture is aligned with ISO 27002. We are Safe Harbor certified and in alignment with BS10012 and ISO 20000 for Service Delivery. We demonstrate an on-going commitment to protecting the confidentiality, integrity and availability (“CIA”) of data from internal and external threats, making us a reliable and secure system provider.

Our secure multi-tenant Software as a Service (SaaS) platform is designed for availability, security, scalability, and performance. Industry best practices and standards are adopted and incorporated.

Our Network also complies with the Authority to Operate as a Moderate Risk Federal Information System by the Office of Personnel Management and Department of Homeland Security; NIST SP800-53 Security Controls; EU Privacy Directive 95/46/EC for EU and non-EU customer data; Payment Card Industry (PCI) Data Security Standard (DSS) v 2.0; Safe Harbor.

We provide privacy compliant data center facilities not only in the United States but also as a Member State of the European Union (EU) or a state of the European Economic Area (EEA). Currently, such data centers are certified for ISO27001, ISO9001 and PCI-DSS compliance.

Our security services provide complete and thorough monitoring of all traffic on the network on a 24x7x365 basis, and include security technology, alert services and incident management support. We are audited twice annually to SSAE16 (US) or ISAE 3402 (international) accounting standards.

VMware VMware is fully committed to complying with NIST and all other relevant industry standards including FedRAMP, FISMA, PCI, CSA CAIQ, etc. This is demonstrated by VMware’s track record of pursuing and obtaining certifications such as those listed above. vCloud Government Service has been certified to store and secure Low Risk Level and Moderate Risk Level data as defined by FIPS PUB 199. In addition, VMware is capable of enhancing the vCloud Government Service to meet participating State’s requirements to be able to store data that is defined by FIPS Pub 199 as High Risk Data.

VMware is committed to maintaining compliance with all of our existing and future compliance certifications. Our ability to remain competitive as a software and services provider in the public sector depends upon it. Thus we have established a comprehensive security and compliance team to ensure that we maintain compliance as well as a strong security posture. #15..
- 791 -
SOLICITATION # CH16012
53 VMWare supports regular internal and external audits to ensure compliance with its certifications as required.

The AirWatch Information Security Program is built on the security framework laid out in NIST 800-

53. Although AirWatch is not required to register with any regulatory agencies, we provide a suite of tools for our customer’s to maintain industry-relevant compliance guidelines within their mobile device fleets. AirWatch has recently been awarded the HP-IAPP Privacy Innovation Award for Most Innovative Privacy Technology by the International Association of Privacy Professionals (IAPP) for our commitment to delivering an EMM platform focused on end-user privacy. To help ensure the confidentiality, integrity, and availability of our cloud offering, we comply with the European Data Protection Directive (95/46/EC) and our top-tier data center partners have undergone SSAE16 SOC2 Type II audits and have ISO 27001 certifications.

FireEye FireEye has mature and well documented security and privacy programs. The programs include third party certifications for SSAE 16 SOC 2, FedRAMP certifications, Model clauses, Privacy and security standards among others. The data that FireEye receives is only in conjunction with the malware analysis.

VirtueStream The Virtustream Federal Cloud (IaaS) has met the requirements for a FedRAMP moderate P-ATO.

The IAAS is assessed annually by a FedRAMP certified 3rd Party Assessment Organization (3PAO). The annual assessment will review a subset of the NIST 800-53 Revision 4 controls as designated by FedRAMP. Virtustream’s 3PAO shall demonstrate impartiality throughout the assessment to accurately assess the status of all security controls in place.

8.6.2 Offeror must list all government or standards organization security certifications it currently holds that apply specifically to the Offeror’s proposal, as well as those in process at time of response. Specifically include HIPAA, FERPA, CJIS Security Policy, PCI Data Security Standards (DSS), IRS Publication 1075, FISMA, NIST 800-53, NIST SP 800-171, and FIPS 200 if they apply.

CA APM AWS EC2 datacenters annually undergo SOC 3 audits.

The application currently does not hold a Soc 2 attestation.

MAA CA MAA is certified for SOC 2 Type 1 Security Audit.

CA Agile Our data center provider has a SOC 2 audit report that can be provided upon request.

Our application does not currently have such certifications.

ASM Rackspace datacenters annually undergo various certification including SOC 3 audits.

The application currently does not hold a Soc 2 attestation.

Google Google has a FedRAMP ATO at the Moderate impact baseline. FedRAMP incorporates many NIST SPs and FIPS including 800-53, FIPS 199, FIPS 200), and has a specific offering. Google Apps for Education that is FERPA and COPPA compliant. Other compliance standards such as HIPAA and CJIS don't offer certification per se, but are commonly accommodated (i.e. Google will sign a BAA to meet HiTECH/HIPAA requirements, and has numerous customers who bear responsibility for meeting CJI processing requirements). PCI DSS is generally not applicable to SaaS systems (though we can do email hygiene processing to protect against incidental usage), but Google IaaS/PaaS does meet PCI DSS v3 standards. Google also holds and is committed to maintaining SOC2 and ISO27001 certifications.

AODocs AODocs doens't hold an HIPAA certifications per se, but are commonly accommodated to meet HIPAA requirements signing a BAA.

Virtru HIPAA, FERPA, CJIS, NIST 800-53, NIST SP-800
Salesforce Salesforce and the Salesforce Force platform is ISO 27001 certified and PCI-DSS compliant. SOC1, SOC2 and SOC3 audits are performed by third party auditor annually at a minimum. Additional audits and certifications include:
#15..
- 792 -
SOLICITATION # CH16012
54 FedRAMP Authority to Operate from Department of Health and Human Services CSA ‘Consensus Assessments Initiative’
JIPDC (Japan Privacy Seal)
Tuv (Germany Privacy Mark)
TRUSTe
HIPAA
In provisioning and operating the services, Salesforce complies with the provisions of HIPAA’s Privacy Rule and Security and the HITECH Act that are applicable to business associates. Salesforce’s customers are still responsible for complying with the same in their capacity as a covered entity or business associate using the Salesforce services. The services’ features permit customers to customize use as per a compliance program for HIPAA (including the HITECH Act) and many customers store protected health information (PHI) on our service. From a legal standpoint, some of our customers have asked Salesforce to assist them in meeting their compliance obligations; for example, by entering into business associate agreements (BAA) to address formal legal requirements pertaining to use and disclosure of protected health information (PHI).

FERPA
Salesforce maintains appropriate administrative, physical, and technical safeguards to help protect the security, confidentiality, and integrity of data our customers submit to the Salesforce Services as Customer Data. Salesforce's customers are responsible for ensuring the security of their Customer Data in their use of the service and implementing any necessary customer-controlled settings. To aid, Salesforce offers robust security functionality that provides our customers the flexibility to use the application in a configuration that furthers compliance with local data protection laws and regulations.

While Salesforce complies with applicable law in provisioning and operating the Salesforce services, it is the sole responsibility of Salesforce’s customers to ensure compliance with applicable laws in their respective uses of the Salesforce services.PCI-DSSSalesforce is PCI Level 1 compliant and has received a signed Attestation of Compliance (AoC) for the Payment Card Industry Data Security Standard (PCI-DSS). Salesforce customers who must adhere to PCI compliance may store personal account numbers (“PAN” or “credit card numbers”) in Salesforce, with the following caveats:
- PANs may only be stored in a custom field encrypted via Classic Encryption or supported field types via the Platform Encryption functionality. PANs must not be stored in clear text fields, attached files, or any other location.
- Customer administrators must configure Salesforce features to support their organization’s PCI controls.NIST SP 800-171NIST Special Publication 800-171 is intended for use by federal agencies when agencies are providing CUI to nonfederal organizations (or when CUI is developed by those organizations for federal agencies) for purposes unrelated to information processing. In other words, the nonfederal organizations are not operating their information systems to process agency data, including CUI, on behalf of the agency but rather for other purposes (e.g., when designing or producing an aircraft, performing a study, or conducting background investigations for security clearances).

Salesforce recommends that its customers use the classifications as detailed in FIPS 199.

FIPS 140-2, FIPS 197, FIPS 199, and FIPS 200
On May 23, 2014 Salesforce achieved a FedRAMP Agency Authority to Operate at the moderate impact level (as described in FIPS 199 and 200) issued by Health and Human Services (HHS) for the Salesforce Government Cloud. Additionally, on May 15, 2015, HHS, as the FedRAMP authorizing agency, approved the Salesforce Government Cloud authorization package that was updated based on annual attestation requirements and updates to the FedRAMP baseline which is FISMA compliant and based on the current release of NIST SP 800-53 Rev. 4. #15..
- 793 -
SOLICITATION # CH16012
55 As part of the Salesforce Government Cloud, Salesforce is capable of responding to FIPS 140-2/3 cryptographic implementations for data being transferred between the customer’s web browser and Salesforce. Data that resides within Salesforce’s protected boundary does not use FIPS 140-2 validated encryption as compensating/mitigating controls are in place to protect data.

Additional information is provided below.

Data Transmission between the customer’s web browser and Salesforce:

Salesforce employs cryptographic mechanisms to protect information during transmission. All transmissions between the user and Salesforce are encrypted by default with a 2048-bit Public Key.

Our service uses International/Global Step Up certificates. We support one-way TLS, in which customers create secure connections before sharing private data. Secure routing and traffic flow policies ensure that customer traffic is encrypted entering Salesforce until the load balancer decrypts the traffic. The load balancers decrypting the traffic are FIPS 140-2 compliant and are located inside of the Salesforce Government Cloud isolation boundary.

Data Transmission for Backup Media:

Media containing customer data is not transported outside of controlled salesforce.com areas and therefore relies on physical access controls to protect the data.

Data at Rest:

NIST 800-53 Rev. 3 states in SC-28, “Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system.” SC-28 also states, “Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate.” All secondary storage media (hard drives, disk drives, and tapes) containing customer data are maintained within Salesforce's secure production data centers until the media has been sanitized and destroyed. Salesforce relies on physical access controls as a compensating control to protect the data.

Primary Data Storage:

User passwords are stored in the RDBMS encrypted via the SHA algorithm with a 256-bit hash. This is a one way hash. The passwords are encrypted by the application.

For primary data storage, Salesforce provides customers with a built-in capability to apply field-level encryption, using 128-bit keys with Advanced Encryption Standard (AES) encryption (as defined by FIPS 197), for a selection of custom fields included in the Salesforce Platform and CRM applications.

Field-level encryption ensures the data associated with designated fields is encrypted in storage.

ServiceNow ServiceNow’s security policy is based on ISO27001:2013 and has been since 2012. ServiceNow also has annual SSAE 16 SOC 1 Type 2 and SOC2 Type 2 attestations with controls being based off NIST 800-53.

The ServiceNow Service Automation Government Cloud Suite is a FedRAMP Compliant Cloud System with a JAB Provisional Authorization. This cloud offering has regulatory restrictions to the types of tenants that can use it. ServiceNow’s FedRAMP compliant and standard commercial datacenter environments are virtually identical. The differences that do exist, such as only allowing access to specially adjudicated US citizens, exist for regulatory reasons not because the environment is superior in some way.

QTS QTS assists with mapping between DOD IT RMF/DIACAP and NIST as well as International Standards Organization (ISO) standards and many others.

QTS maintains control mappings that include:
• NIST 800-53/FedRAMP (Low/Moderate/High)
#15..
- 794 -
SOLICITATION # CH16012
56 • DOD IT RMF/DIACAP (MAC I/II/III Sensitive & Public) • HIPAA-HITECH-Omnibus
• PCI-DSS
• ISO/NATO
• CNSS/ICD/DCID/NISPOM
SAP Ariba We are audited and certified by independent third-party auditor PricewaterhouseCoopers (PwC) for compliance with ISAE 3402 SOC1 Type II, SOC2 and SOC3 every six months. Upon completion of the audit, an attestation letter is issued, stating our compliance. In addition, our primary hosting facility (Equinix) infrastructure is audited for compliance with SSAE 16 SOC1 Type II.

The Service Organization Controls report (SOC) is aimed at three different audiences. SOC1 (aimed at financial auditors) is the same type of report as the SAS70 but also includes an attestation letter signed by both our company and the auditor. SOC2 is aimed at IT and security practitioners. The SOC3 is the publicly viewable web seal to show that we have been audited.

In addition, we have attained PCI (Payment Card Industry) - DSS (Data Security Standard) certification as a Level 1 Service Provider and compliance with the Visa USA Cardholder Information Security Program (CISP) and MasterCard Site Data Protection (SDP) program. These programs were created specifically for merchants and service providers who process, store, or transmit cardholder data.

The PCI DSS is a set of comprehensive requirements for enhancing payment account data security which was developed by the founding payment brands of the PCI Security Standards Council, including American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa Inc. It was developed to help facilitate the broad adoption of consistent data security measures on a global basis. The PCI DSS is a multifaceted security standard that includes requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures. This comprehensive standard is intended to help organizations proactively protect customer account data. CISP and SDP reflect Visa's and MasterCard's respective longstanding commitment to information security.

Fieldglass SAP Fieldglass has achieved the following certifications:
• ISO 27001
• SSAE 16 SOC 1 and SOC 2
HIPPA
Fieldglass does not store Protected Health Information (PHI) on its system and is not required to comply with the Health Insurance Portability and Accountability Act.

PCI
The Fieldglass application does not process credit card information.

We are not (and are not required to be) PCI compliant.

Hanna Please see response to 8.6.1
Hybris The Savvis datacenter located in Boston, MA is SSAE16 Type II SOC I Compliant.

This replaces the older SAS70 Type II audit standard.

SuccessFactors We have been audited to the SOC 2 Trust Services Criteria. This signifies that our control objectives and control activities have been examined by an independent accounting and auditing firm, and that these controls fairly presented the controls in operation as of a specific date and were suitably designed to achieve the control objectives. Our SOC 2 audits are conducted semi-annually (May, November) by PricewaterhouseCoopers (PwC). We also hold US Federal FISMA Moderate #15..
- 795 -
SOLICITATION # CH16012
57 Authority to Operate with both OPM and NTIS. We are compliant with EU Privacy Directive 95/46/EC and are Safe Harbor self-certified.
https://safeharbor.export.gov/companyinfo.aspx?id=26196We are aligned with ISO 27001 for Information Security, BS 10012 for Data Protection, and ISO 20000 for Service Delivery to create an Integrated Compliance Framework (“ICF”). Where these standards overlap in subject matter, Information Security ISO 27001 takes precedence. Our Network also complies with Authority to Operate as a Moderate Risk Federal Information System by the Office of Personnel Management and Department of Homeland Security; NIST SP800-53 Security Controls; EU Privacy Directive 95/46/EC for EU and non-EU customer data; Payment Card Industry (PCI) Data Security Standard (DSS) v 2.0; Safe Harbor.

We are aligned with ISO 27001 for Information Security, BS 10012 for Data Protection, and ISO 20000 for Service Delivery to create an Integrated Compliance Framework (“ICF”). Where these standards overlap in subject matter, Information Security ISO 27001 takes precedence. Our Network also complies with Authority to Operate as a Moderate Risk Federal Information System by the Office of Personnel Management and Department of Homeland Security; NIST SP800-53 Security Controls; EU Privacy Directive 95/46/EC for EU and non-EU customer data; Payment Card Industry (PCI) Data Security Standard (DSS) v 2.0; Safe Harbor.

VMware VMware IaaS Services
ISO/IEC 27001: ISO/IEC 27001 is a globally recognized standard for the establishment and certification of an information security management system (ISMS). vCloud Air continues to maintain a current ISO/IEC 27001 Certification and has recently issued updated certification for ISO/IEC 27001:2013. Achieving certification means that VMware has implemented a holistic security program that conforms with the ISO 27001 standard requirements, both in the security management system and control activities. The audit of the ISMS was completed by Brightline CPAs and Associates - an ANAB accredited certification body.

HIPAA: The Health Insurance Portability and Accountability Act of 1996(HIPAA), which has incorporated requirements from the Health Information Technology for Economic and Clinical Health Act (HITECH) of 2009, established national standards for the security and privacy of Protected Health Information (PHI) in the United States. To help customers comply with HIPAA, VMware offers a Business Associate Agreement (BAA) to all interested customers using our US-based data centers.

The BAA was designed in conjunction with a leading law firm with expertise in HIPAA and provides fair and reasonable terms for healthcare providers, insurers, and other organizations. VMware has completed an independent third party examination of vCloud Air against applicable controls of HIPAA.

SOC 1 (SSAE16/ISAE 3402): Service Organization Control (SOC) 1 reports are conducted in accordance with Statement on Standards for Attestation Engagements (SSAE) No. 16 put forth by the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPS).

The SOC 1 framework reports on internal controls over financial reporting for any service organization such as VMware vCloud Air. SOC 1 aligns to the International Standard on Assurance Engagements (ISAE) 3402 international reporting standards. SOC 1 examinations are specifically intended to meet the needs of the managements of vCloud Air's customers and vCloud Air's customers' auditors, as they evaluate the effect of the controls at vCloud Air on the clients' financial statement assertions.

VMware has completed an independent third-party examination of vCloud Air which spans a twelve (12) month review period.

SOC 2: The Service Organization Control 2 (SOC 2) report is composed of a comprehensive set of criteria on security, availability, processing integrity, confidentiality, and privacy and is similarly set forth by the America Institute of Certified Public Accountants (AICPA). The SOC 2 reports are #15..
- 796 -
SOLICITATION # CH16012
58 intended for use by stakeholders (e.g. customers, regulators, business partners, suppliers, directors) of the service organization that have a thorough understanding of the service organization and its internal controls. VMware has completed an independent third-party examination of vCloud Air that also spans a twelve (12) month review period.

SOC 3: Trust Services Report for Service Organizations Control 3 (SOC 3) reports are designed to meet the needs of customers who want assurance on the controls at a service organization related to security, availability, processing integrity, confidentiality, or privacy. vCloud Air has completed an independent third-party SOC 3 examination of VMware vCloud Air. SOC 3 is composed of a comprehensive set of trust principles including security, availability, processing integrity, confidentiality and privacy.

Cloud Security Alliance: VMware vCloud Air has completed the Cloud Security Alliance (CSA) Consensus Assessments Initiative Questionnaire (CAIQ). CAIQ provides industry-accepted ways to document what security controls exist in IaaS, PaaS and SaaS offerings.

FedRAMP Provisional Authority: VMware vCloud Government Service, provided by Carpathian, now has FedRAMP Provisional Authority to Operate issued by the Joint Authorization Board (JAB).

FedRAMP is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. This approach uses a ""do once, use many times"" framework that can reduce government organizations' costs, time, and staff required to conduct redundant agency security assessments. U.S. government agencies can now leverage vCloud Government Service to meet the stringent security and privacy requirements of FedRAMP.

FIPS 140-2: VMware vCloud Government Service is fully FIPS 140-2 compliant including hardware which provides its 2-Factor Authentication capabilities.

FIPS Pub 199: As discussed previously, vCloud Government Services is certified to store and secure Low Risk Data and Moderate Risk Data as defined by FIPS Pub 199. VMware is willing to work with participating States that require High Risk Data Storage to enhance vCloud Government Services to store and secure this data.

CJIS: vCGS recently underwent a CJIS assessment by CoalFire, Inc. CJIS is not a certification, it is a policy that must be followed and accredited for each deployment which requires it. The goal of VMware’s CoalFire assessment was to create a baseline configuration that can be reused across any CJIS opportunity to accelerate the implementation and accreditation timeframes.

FERPA: Like CJIS, FERPA compliance is assessed and confirmed for each deployment that requires it. VMware’s vCloud Government Service FedRamp certification and others provide evidence that the underlying infrastructure is capable of meeting rigorous information security and availability requirements. VMware will work with Participating Entities to meet FERPA requirements on a task order basis.

PCI Data Security Standards (DSS): Neither vCloud Air nor vCGS are currently PCI certified at this time. VMware will work with Participating Entities to meet PCI requirements on a task order basis.

IRS Publication 1075: Because both IRS 1075 and FedRAMP are based on NIST 800-53, the compliance boundary for IRS 1075 is the same as the FedRAMP authorization. This, vCGS complies with IRS Publication 1075 on the basis that it is FedRAMP certified.

FISMA: vCGS is FISMA Low and Moderate compliant.
#15..
- 797 -
SOLICITATION # CH16012
59 NIST 800-53: NIST 800-53 provides the core controls that must be met to achieve FedRAMP compliance. VMware vCloud Government Service has FedRAMP Provisional Authority to Operate issued by the Joint Authorization Board (JAB), thus we are compliant with NIST 800-53.

NIST SP 800-171: VMware vCloud Government Service has FedRAMP Provisional Authority to Operate issued by the Joint Authorization Board (JAB). NIST 800-171 outlines a subset of the NIST 800-53 requirements, and as stated above, VMware vCloud Government Service is compliant with these guidelines. Since NIST 800-171 outlines a subset of the NIST 800-53 requirements, VMware vCloud Government Service is compliant with NIST SP 800-171.

FIPS 200: Neither vCloud Air nor vCGS are currently FIPS 200 certified at this time. VMware will work with Participating Entities to meet PCI requirements on a task order basis.

VMWare AirWatch
The AirWatch Information Security Program is built on the security framework laid out in NIST 800-53.

Although AirWatch is not required to register with any regulatory agencies, we provide a suite of tools for our customer’s to maintain industry-relevant compliance guidelines within their mobile device fleets. AirWatch has recently been awarded the HP-IAPP Privacy Innovation Award for Most Innovative Privacy Technology by the International Association of Privacy Professionals (IAPP) for our commitment to delivering an EMM platform focused on end-user privacy. To help ensure the confidentiality, integrity, and availability of our cloud offering, we comply with the European Data Protection Directive (95/46/EC) and our top-tier data center partners have undergone SSAE16 SOC2 Type II audits.

FireEye Currently the standards that apply are SSAE 16 SOC 2 Type 2, with a FedRAMP ATO in place and full FedRAMP certification in process. We are also in the process of becoming FedRAMP ISO 2700x certified.

8.6.3 Offeror must describe its security practices in place to secure data and applications, including threats from outside the service center as well as other customers co-located within the same service center.

MAA All MAA core servers are behind firewalls; only systems administrators have access to the servers; all data is encrypted when transmitted between data centers. The MAA dashboard and API are protected with HTTPS/TLS encryption, and users are required to authenticate in order to access these.

CA Agile We use a co-located data center provider and within that environment we have a dedicated cage to which only our Operations Team has access. We also monitor all traffic across our systems using HIDS (OSSEC) and NIDS (Snort) to notify of any suspicious activity.

ASM All ASM core servers are behind firewalls; only systems administrators have access to the servers; all data is encrypted when transmitted between data centers. The ASM dashboard and API are protected with HTTPS/TLS encryption, and users are required to use a username and password to login to their accounts. #15..
- 798 -
SOLICITATION # CH16012
60 Google In this DPA the obligations of Google to hold all customer data as confidential and wholly owned by the customer is detailed.

Google’s internal data access processes and policies are designed to prevent unauthorized persons and/or systems from gaining access to systems used to process personal data. Google aims to design its systems to: (i) only allow authorized persons to access data they are authorized to access; and (ii) ensure that personal data cannot be read, copied, altered or removed without authorization during processing, use and after recording. The systems are designed to detect any inappropriate access. Google employs a centralized access management system to control personnel access to production servers, and only provides access to a limited number of authorized personnel. LDAP, Kerberos and a proprietary system utilizing RSA keys are designed to provide Google with secure and flexible access mechanisms. These mechanisms are designed to grant only approved access rights to site hosts, logs, data and configuration information. Google requires the use of unique user IDs, strong passwords; two factor authentication and carefully monitored access lists to minimize the potential for unauthorized account use. The granting or modification of access rights is based on: the authorized personnel’s job responsibilities; job duty requirements necessary to perform authorized tasks; a need to know basis; and must be in accordance with Google’s internal data access policies and training. Approvals are managed by workflow tools that maintain audit records of all changes. Access to systems is logged to create an audit trail for accountability. Where passwords are employed for authentication (e.g., login to workstations), password policies that follow at least industry standard practices are implemented.

These standards include password expiry, restrictions on password reuse and sufficient password strength. For access to extremely sensitive information (e.g., credit card data), Google uses hardware tokens.

AODocs AODocs being built in Google AppEngine and Google Drive.

Virtru Please see the Virtru Security Policies and Procedures and the Virtru Privacy Policies and Procedures provided in the Supplemental Information section of this response.

Salesforce Government Trusted Security and Infrastructure Salesforce understands that the confidentiality, integrity, and availability of our customers’ information are vital to their business operations and our own success. We use a multi-layered approach to protect that key information, constantly monitoring and improving our application, systems, and processes to meet the growing demands and challenges of security.

SOC1, SOC2 and SOC3 audits are performed by third party auditor annually at a minimum.

Additional audits and certifications include: CSA ‘Consensus Assessments Initiative’, JIPDC (Japan Privacy Seal), Tuv (Germany Privacy Mark), and TRUSTe.

Protection at the application level
#15..
- 799 -
SOLICITATION # CH16012
61 Salesforce protects customer data by ensuring that only authorized users can access it.

Administrators assign data security rules that determine which data users can access. Sharing models define company-wide defaults and data access based on a role hierarchy. All data is encrypted in transfer. All access is governed by strict password security policies. All passwords are stored in SHA 256 one-way hash format. Applications are continually monitored for security violation attempts.

Secure Data Centers
Data centers provide only power, environmental controls, and physical security. Salesforce employees manage all other aspects of the service at the data centers. Colocation data center personnel do not have network or logon access to the Salesforce systems. Colocation personnel have physical access to the
Salesforce secure server room in the event of an emergency, but do not have keys to the individual racks containing hardware. Data centers maintain a common baseline of physical and environmental controls across data centers.

The exterior perimeter of each anonymous data center building is bullet resistant, has concrete vehicle barriers, closed-circuit television coverage, alarm systems, and manned 24/7 guard stations that together help defend against non-entrance attack points. Inside each building, multiple biometric scans and guards limit access through interior doors and to the Salesforce secure rooms at all times.

Access to Salesforce’s secure server rooms in the datacenter is authorized based on position or role. Additional access controls enforced by an electronic key box are implemented for the dedicated Salesforce Government Cloud racks to ensure that access is limited to Qualified U.S.

Citizens. Salesforce has an established process to review data center access logs to the server room. Additionally, an at
least annual assessment of the data center is performed to ensure the data centers are meeting Salesforce’s security control requirements.

In addition to securing the data center locations, it is critical that the data center facilities maintain robust critical infrastructure to support Salesforce through the following services:
#15..
- 800 -
SOLICITATION # CH16012
62 Temperature and Humidity Controls
• Humidity and temperature control
• Redundant (N+1) cooling system
Power
• Underground utility power feed
• Redundant (N+1) CPS/UPS systems
• Redundant power distribution units (PDUs)
• Redundant (N+1) diesel generators with on-site diesel fuel storage Secure Network Logistics
• Concrete vaults for fiber entry
• Redundant internal networks
• Network neutral; connects to all major carriers and located near major Internet hubs • High bandwidth capacity
Fire Detection and Suppression
• VESDA (very early smoke detection apparatus)
• Dual-alarmed, dual-interlock, multi-zone, pre-action dry pipe water-based fire suppression ServiceNow The ServiceNow cloud is built for the enterprise customer with every aspect aimed towards meeting the customer’s demand for reliability, availability and security. ServiceNow’s comprehensive approach to address this demand is enabled by the following: (a) ServiceNow’s robust cloud infrastructure runs on its own applications and utilizes industry best-of-breed technology to automate mission critical functionalities in the cloud service with around-the-clock and around-the-world delivery; (b) ServiceNow achieves flexibility and control in its ability to deliver a stable user experience to the customer by having a logical single tenant architecture; (c) ServiceNow’s application development which has a paramount focus on quality, security, and the user experience is closely connected to the operations of delivering those applications in a reliable and secure cloud environment; (d) ServiceNow invests in a comprehensive compliance strategy that allows its customers to attain their own compliance to applicable laws by obtaining attestations and certifications and running its subscription service from paired data centers situated close to where its customers are located; and (e) ServiceNow’s homogeneous environment where all applications are on a single platform offers ServiceNow a competitive advantage in being able to concentrate its efforts to make the customer’s user experience the best possible.

The “Data Security Guide” contained within the “Subscription Service Guide” included with this response describes the measures ServiceNow takes to protect Customer Data when it resides in the ServiceNow cloud.

QTS The QTS Information System Security Officer (ISSO) develops, disseminates, annually reviews and updates a formal, documented access control policy; System and Communications Protection and addresses the following:
•Purpose and scope
•Roles, responsibilities
•Compliance
QTS develops, disseminates, and annually reviews/updates a formal, documented security policy executive summary, SP Executive Summary - Information System Security Program Policies, which addresses:
•management commitment
•coordination among customer entities
#15..
- 801 -
SOLICITATION # CH16012
63 QTS cloud’s Policies are maintained within a biometric secure office located in the Suwanee facility at 300 Satellite Blvd, Suwanee, GA 30024. It is disseminated to all individuals, including but not limited to employees, contractors, consultants, temporaries, and other personnel affiliated with third parties, who use any QTS Information Resource that is owned or leased by QTS. This policy is consistent with QTS’s mission and functions and with applicable laws, directives, policies, regulations, standards, and guidance.

The previously mentioned artifacts are disseminated via a centralized secure document repository among all QTS cloud’s personnel who have any service operations or service delivery role for QTS cloud’s IaaS offerings system environments, and is to be individually or by group reviewed semi-annually, especially by any personnel who have administrative access.

QTS can provide its Information Security Policies as required:
• IT_POL_03_System_and_Communications_Protection_Policy (v1.2 – 1/17/14) SAP Ariba We are committed to the security and integrity of customer information. We utilize security measures to protect against the loss, misuse or alteration of the information under our control. To prevent unauthorized access, maintain data accuracy, and facilitate the correct use of information, we have put in place appropriate physical, electronic, and managerial procedures to safeguard and secure the information we collect within the solution.

Fieldglass Please see the Fieldglass Security and Hosting Overview provided in the Supplemental Information section of this response.

Hanna Communication between data centers is via VPN or MPLS; VPN is encrypted by default and MPLS can be encrypted as well.

Internet facing customer systems are protected by perimeter protection systems using technologies such as web application firewall (WAF) or intrusion prevention systems (IPS). Perimeter protection systems operate by monitoring traffic and blocking attaches towards SAP HANA Enterprise Cloud customer systems.

Hybris Both IDS and IPS are included the SAP Hybris Commerce, Cloud Edition The security infrastructure includes firewall security and hardened security policies on all servers. Log management procedures are in-place for log review for firewall, applications, network devices, including file-integrity management. SAP Hybris utilizes technologies from leading security firms for Log Management and File Integrity Management. SAP Hybris employs twofactor authentication across its network. SAP Hybris undergoes vulnerability and penetration testing. SAP Hybris validates against requirements for PCI DSS 2.0.

The infrastructure also includes Web Application Firewalls and DDoS Mitigation Services.

In addition, security policies and change management policies are in-place ensuring that all access and changes to customer systems and information is accessible only by SAP Hybris staff with access authorization.

Security of the software application which is controlled by the Customer (or its implementation partner) remains the responsibility of the Customer.

SuccessFactors Technologies and measures used to help protect the security of customer data include:

Redundant firewalls in a dedicated environment
Network intrusion detection to help guard against attacks by monitoring all data center traffic around-the-clock and notifying operations and security teams in the event of an imminent threat
Vulnerability scanning to proactively test internet-connected web servers by searching for weaknesses in the same way that a hacker would #15..
- 802 -
SOLICITATION # CH16012
64 Penetration testing at least annually
Security teams monitoring the infrastructure 24x7x365
Any security issues discovered are reported in real time to information security staff and IT management, entered into our ticketing system for follow-up investigation, and tracked to resolution. All actions taken to resolve the problem are documented, allowing all problems to be tracked to completion.

We provide application level memory separation between each client instance as well as data level segmentation and separation with each customer's data residing in its own schema and table space at the database tier. The database tier provides isolation and security of data, and the use of application clustering provides availability, reliability and scalability.

Each customer’s data is maintained in a separate database schema with its own discrete set of tables, facilitating a high degree of data isolation thus preventing potential for data segmentation breaches
Flexibility to backup individual customer table spaces without affecting adjacent customers
Each schema has separate authentication credentials and assigned resource profile to restrict access rights and resource consumption VMware The VMWare Approach to Compliance
Many organizations have initiatives to virtualize their Information Technology (IT) infrastructure, or to move to a Cloud Computing model. However, these initiatives are often complicated by the increasing number of regulatory compliance requirements, which require protection of data such as PCI, HIPAA, FISMA, DIACAP, FedRAMP, GLBA, and other State and Federal requirements.

Organizations are increasingly concerned with the complexity, risk, and impact that a new technology can bring to their existing environments.

VMware addresses these challenges by establishing a Compliance Reference Architecture Framework (RAF) that provides a consistent method for VMware, its partners, and customers to assess and evaluate the impact of regulations on virtual and cloud environments. The intent of the RAF is to provide a single framework for VMware, its partners, and organizations to address a variety of compliance requirements across an IT infrastructure.

We designed our security architecture using a defense-in-depth approach to implement multiple layers of security throughout the SaaS environment and to mitigate any potential attacks through multiple safeguards, including:
• Access control mechanisms, firewalls, anti-virus/malware software, auditing mechanisms, network controls, maintaining defined configuration settings, etc.

We perform regular internal scans to assess the vulnerability of our internal network.

FireEye All data is stored within locked and monitored cages in secure data centers. Customer data is restricted to a need to know basis. Data is logically tagged and virtually segregated in our cloud services. Access is managed and only given to those with need to know including internal employees and customers.

VirtueStream All data for this environment will remain in the United States. Customers can elect Intel's TxT technology to demonstrate geo-fencing of data to specific data centers.

Virtustream data centers are physically accessible by designated employees and approved employees only. Virtustream employees who are assigned to the data center are issued a proximity card which is required to access the data center. Once inside, physical access to the data processing areas is further restricted to specific employees. Physical access to the data processing areas is protected by biometric locks on the doors. Data center personnel maintain a list of all approved personnel who have access to the data center offices and who have access to the data processing areas.

Virtustream offers security solutions which customers can select to protect their data while in transit and at rest. Customers are responsible for the protection of their data within their customer #15..
- 803 -
SOLICITATION # CH16012
65 zone. Virtustream does not process, store, or disseminate customer data within the Virtustreamcontrolled management zone.

Virtustream invokes a defense-in-depth model for monitoring the management zone with tools such as Splunk, Trend Micro, Fortinet, and Tenable. These tools are available for customers to select as a managed service.

8.6.4 Offeror must describe its data confidentiality standards and practices that are in place to ensure data confidentiality. This must include not only prevention of exposure to unauthorized personnel, but also managing and reviewing access that administrators have to stored data. Include information on your hardware policies (laptops, mobile etc).

CA APM All personnel with access to client data undergo annual, mandatory security training and are covered under the CA Technologies NDA. Violations of security policies are grounds for termination. All access to data and other resources used to deliver the service are granted under the least principle.

MAA Customer accounts are password protected, and users can only access their data in their accounts. System administrators have access to MAA servers, and database administrators have access to database servers. Account access is reviewed periodically.

CA Agile All customer data is treated as confidental and as a policy we do not access customer data without explicit written consent. Access to systems containing customer data is restricted to our Operations Team according to our Elevated Permissions Policy.

ASM Customer accounts are password protected, and users can only access their data in their accounts. System administrators have access to ASM servers, and database administrators have access to database servers. Account access is reviewed periodically. All data on CA laptops are encrypted and a PIN is required to boot.

AODocs The data stored in Google AppEngine are backed up every day.

The application is hosted on Google Cloud Platform infrastructure and benefits from the network security.

Virtru See 'Virtru Security Policies and Procedures' and 'Virtru Privacy Policies and Procedures' Salesforce Logical Access Control
Salesforce provides contractual assurance to its customers that the data hosted in the Salesforce Services will be kept confidential and not accessed except under narrow circumstances (such as a support issue) and only for a set amount of time chosen by customer. In such circumstances, we will access your org only with prior approval and subject to a Non-Disclosure Agreement (NDA).

To protect against access through the application, Salesforce employees don't have access at the application level for any customers, unless the customer grants access through the “login as” feature.

Access to the production environment infrastructure is restricted to a very limited number of fulltime Salesforce employees required to manage the service. Salesforce's Technical Operations team and Release Managers have logical access to servers. These employees must authenticate to the production environment via a secure server (Secure Global Desktop) using 2 points of RSA two-factor authentication. This tool provides pixel data only to these administrators. Systems access is role-based and controlled and logged. DBAs do not have login access to customer's instances (org) and do not see customer data in an assembled manner. They manage the system in aggregate-performance tuning, allocating space, building indices, etc. The Oracle tables and rows in our infrastructure do not reflect the view of a single customer instance (org) since we are multi-tenant and the data is spread across multiple disk arrays. #15..
- 804 -
SOLICITATION # CH16012
66 Database administrator account activity is logged. These logs are sent to the security information and event management (SIEM) system. These database activities logs are reviewed for appropriateness by the Computer Security Incident Response Team (CSIRT) team on a regular basis. This log data is also available as a forensic audit trail to support CSIRT during incident investigations.

A customer's instance (org) of Salesforce is an aggregate of the raw data. The data model is very complicated, normalized, and the rows are identified by base62 encoded keys (primary and foreign). Re-establishing data ownership and a business context for the data would be very difficult to do at the database level. In order to reassemble any given customer's application (org), someone would need access to our source code in order to reassemble the raw data in a manner that could be interpreted and understood, and would need the entire set of tapes or disks/arrays supporting a given Instance, as the data for any one customer is spread across several tapes/disks. Data center engineers with physical access to the servers do not have logical access to the production environment and administrators with logical access to the systems do not have physical access to the data centers.

ServiceNow ServiceNow applies the same data classification for all hosted customer data. ServiceNow does not inspect or monitor its customers’ information and therefore has no ability to sub-classify customer data. The overriding requirement of the assigned classification is that customer data remains hosted in the private cloud until the customer terminates their subscription. It is never stored anywhere apart from the private cloud.

Customers remain the data owner and data controller for all data placed into their instance.

ServiceNow does not examine, inspect, monitor or analyze customers’ data.

Customers apply access controls to restrict access to data within their instances based on their own requirements and needs, including their own data classification.

QTS The customer will be assigned one or more Org Administrators. All users will be configured with RSA AD two-factor Risk Based authentication as a requirement for cloud portal access.

SAP Ariba We participate in the following national and international standards committees:

WebTrust: (2001 - current) The Security, Availability, Processing Integrity and Confidentiality of our applications are based on the Trust Services Principles now incorporated into the SSAE16/ISAE 3000 SOC 2 standards SSAE16: (formerly SAS 70) certification: (Since 2011)
ISAE 3402: (The International Standard on Assurance Engagements since 2014) every six months we undergo a rigorous ISAE 3402 audit by independent auditor PricewaterhouseCoopers (PwC)
Payment Card Industry (PCI) Data Security Standard (DSS): (Since 2008) we have adopted and adhere to the PCI-DSS). PCI certification and compliance with the Visa USA Cardholder Information Security Program (CISP) and MasterCard Site Data Protection (SDP) program
Safe Harbor: (Since 2007) Current on the Safe Harbor list for ""Online Data"" for the ASN and Cloud Solutions/Services
A firewall separates the Ariba corporate network from Ariba infrastructure computers. Therefore, unauthorized Ariba employees cannot access Ariba data from the Ariba corporate network infrastructure. Access is limited to specific roles or functions within Ariba Operations. Additionally, access is managed on an “exception” basis whereby personnel need clearance to be #15..
- 805 -
SOLICITATION # CH16012
67 authorized. Access is time-limited, after which time re-authentication is required.

Internally, we have deployed an active monitoring system tied back to Human Resources. Logical access management reports are rolled up monthly and are part of the monthly Privacy & Security board review. All logical access management is subject to review and audit under ISAE 3402 assurance every six months and annually under PCI DSS certification.

Wireless technology is not allowed within the production operations infrastructure where customer data is received, processed and stored.

All corporate laptops are whole disk encrypted. All approved portable devices are encrypted and have a phone home capability which allows them to be wiped remotely.

Fieldglass Fieldglass has the following categories for classifying information:

Confidential - This is the information that Fieldglass and end users have a legal, regulatory and/or contractual obligation to protect or information that unauthorized disclosure, compromise, or destruction that results in severe damage, provides significant advantage to a competitor, or incurs serious financial impact to Fieldglass and/or our customers. Fieldglass will not disclose to a third party without signing a nondisclosure agreement requiring the third party to protect such information.

Internal Use - This is information that, due to a technical or business sensitivity, requires special precautions to ensure the confidentiality and integrity of data by protecting it from unauthorized access, modification or deletion. This information is intended for use only within the company and must be limited to end users who are employed by Fieldglass or individuals that have a business requirement to access the data and have signed a nondisclosure agreement.

Public - This information has been made available for public distribution through authorized company channels. Public information does not require special protection. It is information that can be disclosed to anyone without violating an individual’s right of privacy. Knowledge of this information does not expose Fieldglass to financial loss, embarrassment, or jeopardize the security assets.

Laptops
Every Fieldglass laptop issued to employees and contractors have a DLP agent installed that cannot be modified. This agent detects whether customer data or the Fieldglass source code is being copied externally. Monthly access reviews are conducted by product and file share owners to ensure access is limited to a need-to-know basis. Privileged user account access is also monitored on a weekly basis.

Hanna SAP treats all customer data stored in cloud solutions from SAP as “Confidential” according to SAP’s data classification standard.

Personal Data is subject to strict security and legal requirements in the legislation of several countries, for example handling of Personal Data is regulated in the European Union (EU) Data Protection Directive and #15..
- 806 -
SOLICITATION # CH16012
68 corresponding national laws. At SAP intercompany agreements exist, to ensure that these requirements are met in all SAP companies and branch offices throughout the world. Similar data protection agreements were executed with all subprocessors. Personal data must be classified as equally confidential regardless of whether it relates to employees, customers or third parties.

Hybris The security infrastructure includes firewall security and hardened security policies on all servers. Log management procedures are in-place for log review for firewall, applications, network devices, including file-integrity management. SAP Hybris utilizes technologies from leading security firms for Log Management and File Integrity Management. SAP Hybris employs twofactor authentication across its network. SAP Hybris undergoes vulnerability and penetration testing. SAP Hybris validates against requirements for PCI DSS 2.0.

The infrastructure also includes Web Application Firewalls and DDoS Mitigation Services.

Security of the software application which is controlled by the Customer (or its implementation partner) remains the responsibility of the Customer.

SuccessFactors We are aligned with ISO 27001 for Information Security, BS 10012 for Data Protection, and ISO 20000 for Service Delivery to create an Integrated Compliance Framework (“ICF”). Where these standards overlap in subject matter, Information Security ISO 27001 takes precedence. Our Network also complies with Authority to Operate as a Moderate Risk Federal Information System by the Office of Personnel Management and Department of Homeland Security; NIST SP800-53 Security Controls; EU Privacy Directive 95/46/EC for EU and non-EU customer data; Payment Card Industry (PCI) Data Security Standard (DSS) v 2.0; Safe Harbor.

VMware VMware monitors for security events involving the underlying infrastructure servers, storage, networks, and information systems used in the delivery of vCloud Air over which VMware have sole administrative level control. The goal of this process is to identify security incidents and respond to them proactively.

This responsibility stops at any point where customers have control, permission, or access to modify any aspect of the service offering. The customer is responsible for the security of the networks over which they have administrative level control. This includes, but is not limited to, maintaining effective firewall rules, exposing communication ports that are only necessary to conduct business, locking down promiscuous access, and other such capabilities.

Proactive Security Monitoring over Internet and Social Media (e.g. searching filesharing sites for customer data, seeding data with honey tokens) VMware security teams perform OSINT monitoring on the Internet for all VMware products and services. This includes harvesting data from search engines, le sharing, and social networking sites. This data is analyzed for keywords and other specific indicators.

With regards to potential data leaks, the customer is solely responsible for protecting the security of his or her content, including any access provided to employees, customers or third parties. vCloud Air provides certain software and functionality to help protect content from unauthorized access such as firewalls, load balancers, and IPsec VPNs. Customers are encouraged to deploy additional security mechanisms similar to what exists in their current data center to address other security controls such as data encryption, intrusion detection, le integrity monitoring, and other such concerns relevant to the sector and regulatory requirements that apply to the specific business of a customer.
#15..
- 807 -
SOLICITATION # CH16012
69 FireEye FireEye has mature and well documented security and privacy programs. The programs include third party certifications for SSAE 16 SOC 2, and FedRAMP certifications, Model clauses, Privacy and Security Standards among others. The data that FireEye receives is only in conjunction with the malware analysis.

Our data protection standards includes prevention of exposure to unauthorized personnel and managing and reviewing all access to systems (not just for admin) quarterly or when employees have a role change. FireEye has standards for hardware and software such as gold images for all operating systems and hardened systems, these are managed and distributed centrally. It also includes supported and managed configurations of hardware and software on mobile devices and acceptable use policy for all FireEye resources.

VirtueStream Customers are responsible for the protection and confidentiality of data within their application and/or system which resides on the Virtustream IaaS. Virtustream customers are logically separated via VLAN and VRF technologies which ensure that different customers’ data is not accessible and cannot be altered. Customers are responsible for controlling access to their data.

Virtustream does not have direct access to customer data within their customer zone. Virtustream employees who are assigned to IaaS must pass a Virtustream background investigation. In addition, Virtustream employees assigned to the IAAS must adhere to any requirement by customers to pass federal, state, or local background investigations if they are to provide managed services to the customer zone.

Virtustream offers an encryption at rest and encryption in transit managed service. This provides an additional level of protection for customer's data within their VLAN, All Virtustream employees with access to the IaaS are required to have hard drive encryption on their laptops. Virtustream performs quarterly privileged user access reviews.

8.6.5 Offeror must provide a detailed list of the third-party attestations, reports, security credentials (e.g., FedRamp), and certifications relating to data security, integrity, and other controls.

CA APM AWS EC2 datacenters annually undergo SOC 3 audits.

MAA CA MAA is certified for SOC 2 Type 1 Security Audit.

CA Agile N/A - we are working towards a NIST 800-53r4 certification but that is not yet complete.

ASM Rackspace datacenters annually undergo various certification including SOC 3 audits.

The application currently does not hold a Soc 2 attestation.

Google SOC 1 (SSAE 16) SOC 2 SOC 3 ISO 27001 ISO 27018 FedRAMP AODocs AODocs is certified SOC2 Type 2
Virtru Vulnerability Scan and Penetration Testing by Cigital and FedRamp In Process sponsored by US Department of Interior
Salesforce Salesforce has comprehensive privacy and security assessments and certifications performed by multiple third parties. The following audits and their frequencies are performed:

ISO 27001 - Annually (3 year certification)
PCI-DSS - Annually
FedRAMP - Annually
SOC 1 (SSAE16/ISAE 3402, previously SAS 70) - Twice a year SOC 2 & SOC 3 - Twice a year
Copies of our SOC reports can be provided to your Agency upon request and under NDA. #15..
- 808 -
SOLICITATION # CH16012
70 Under NDA, your Agency can also be provided Salesforce’s complete FedRAMP Authority to Operate (ATO) package, which contains the following security assessment documentation:
01 - Salesforce Government Cloud System Security Plan
02 - Salesforce Government Cloud System Security Plan - Tracked Changes 03 - Salesforce Government Cloud Attachment 1 - Control Tailoring Workbook (CTW) 04 - Salesforce Government Cloud Attachment 2 - Control Implementation Summary (CIS) 05 - Salesforce Government Cloud Attachment 3 - PTA and PIA 06 - Salesforce Government Cloud Attachment 4 - E-Authentication 07 - Salesforce Government Cloud Attachment 5 - FIPS 199 Categorization 08 - Salesforce Government Cloud Attachment 6 - User Guide - Customer Configurations 09 - Salesforce Government Cloud Attachment 7 - Hardware, Network, and Software System Inventory
10 - Salesforce Government Cloud Attachment 8 - Customer Responsibilities 11 - Salesforce Government Cloud Rules of Behavior - Ground Rules for Security Success 12 - Salesforce Government Cloud Disaster Recovery Plan 13 - Salesforce Government Cloud Incident Response Plan 14 - Salesforce Government Cloud Configuration Guide
15 - Salesforce Government Cloud Continuous Monitoring Plan 16 - Salesforce Government Cloud Security Assessment Plan 17 - Salesforce Government Cloud Security Assessment Report (SAR) 18 - Salesforce Government Cloud Table 4.1 SAR
19 - Salesforce Government Cloud Test Cases (SRTM)
20 - Salesforce Government Cloud POA&M
ServiceNow •ISO/IEC 27001:2013 BrightLine Certificate Number 1980700-4 (see supplemental information section for official certificate)
•SSAE 16 SOC 1 Type 2 (available under NDA)
•SSAE 16 SOC 2 Type 2 (available under NDA)
•FedRAMP Compliant
QTS QTS maintains control mappings that include:
• NIST 800-53/FedRAMP (Low/Moderate/High)
• DOD IT RMF/DIACAP (MAC I/II/III Sensitive & Public)
• HIPAA-HITECH-Omnibus
• PCI-DSS
• ISO/NATO
• CNSS/ICD/DCID/NISPOM
SAP Ariba As assurance collateral, we can provide the BITS SIG and CSA Cloud Service Provider Questionnaire, Our ISAE 3402 SOC 1 Type II, SOC 2 and SOC 3 reports as well as the Attestation of Compliance for PCI DSS are signed by our qualified security assessor and management.

Fieldglass Independent third-party auditors conduct annual audits for the following:
• ISO 27001
• SSAE 16 SOC 1 and SOC 2
Hanna Please see response 8.6.1
Hybris
SuccessFactors We have various third party certifications including ISO 27001 and BS10012. #15..
- 809 -
SOLICITATION # CH16012
71 VMware VMware IaaS Services
The International Organization for Standardization (ISO) has developed he ISO 27001 standard which defines an information security management system (“ISMS”) as a systematic approach to managing sensitive company information so that it remains secure. It includes an organization’s people, processes and IT systems and the application of a risk management process. vCloud Air has established and implemented an Information Security Management System (ISMS) based on ISO 27001 standards to manage risks relating to confidentiality, integrity, and availability of information.
vCloud Air engages an independent third party auditing firm on an on-going basis to validate vCloud's air adherence to the ISO 27001 standard. An ISO 27001 certificate is issued if the auditing firm has validated adherence to the standard.

VMware IaaS Services
The International Organization for Standardization (ISO) has developed he ISO 27001 standard which defines an information security management system (“ISMS”) as a systematic approach to managing sensitive company information so that it remains secure. It includes an organization’s people, processes and IT systems and the application of a risk management process. vCloud Air has established and implemented an Information Security Management System (ISMS) based on ISO 27001 standards to manage risks relating to confidentiality, integrity, and availability of information.
vCloud Air engages an independent third party auditing firm on an on-going basis to validate vCloud's air adherence to the ISO 27001 standard. An ISO 27001 certificate is issued if the auditing firm has validated adherence to the standard.
vCloud Government Service (IaaS): FedRAMP Provisional Authority: VMware vCloud Government Service, provided by Carpathian, now has FedRAMP Provisional Authority to Operate issued by the Joint Authorization Board (JAB). FedRAMP is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. This approach uses a ""do once, use many times"" framework that can reduce government organizations' costs, time, and staff required to conduct redundant agency security assessments. U.S. government agencies can now leverage vCloud Government Service to meet the stringent security and privacy requirements of FedRAMP.

FireEye We have SSAE 16 SOC 2 Type 2 certification for specific cloud services, and associated datacenters. FireEye currently has a FedRAMP ATO for ETP and are in process for full FedRAMP, and ISO 27001 certification.

VirtueStream Security is the foundation of our business. Virtustream's xStream™ cloud software assists our customers to meet mandatory Legislative requirements, and achieve and maintain FedRAMP, FISMA Moderate, PCI-DSS, SSAE16/SOC2/SOC3, ISO 27001/9001/22301, HIPAA, NIST 800-53, CSA STAR and other leading cloud certifications and compliance frameworks in the customer's own environment (when coupled with identified operational and management controls). #15..
- 810 -
SOLICITATION # CH16012
72 8.6.6 Offeror must describe its logging process including the types of services and devices logged; the event types logged; and the information fields. You should include detailed response on how you plan to maintain security certifications.

CA APM CA has various log monitoring tools that help us keep track of live production systems in order to understand load vs. resource utilization vs. performance. CA along with AWS monitors the service and provides real time alerting when systems suddenly die, or when system loads or response times approach critical thresholds. Logs are kept for forensic examination and identification of trends in order to proactively ensure stability.

MAA CA MAA servers log all activity, and data retention is anywhere from 14 to 180 days depending on the component and volume of logs generated CA Agile All systems are required to send logs to a centralized log server. At a minimum log data must contain timestamps, usernames, IP Addresses, and query parameters.

ASM ASM servers log all activity, and data retention is anywhere from 30 days to 1 year depending on the application and volume of logs generated.

Google This is largely the responsibility of the customer. Google’s obligations, as described in 8.6.4, are to ensure there is no unauthorized access of Customer data. Customers are responsibility for ensuring their end users use the service according to the Customer’s acceptable use policies.

During the onboard process, Customers will be assisted in the configuration controls that are included to enforce acceptable use and security policies and trained in how to maintain oversight on the ongoing usage of the services in scope.

AODocs AODocs does not manage the authentification. The authentification is managed by Google.

Virtru See 'Virtru Security Policies and Procedures'
Salesforce Salesforce Infrastructure Logs
Salesforce internal infrastructure logs are collected by various monitoring tools for activities on the systems that host Salesforce, and include:

Server access
Network access
Firewall management events
Network intrusion detection systems traffic
Cache
Database
File integrity
Network device configuration
Anti-virus detection
Log events are correlated to generate alerts. Alerts are configured to notify the Technical Operations and Computer Security Incident Response Team (CSIRT) teams. Security alerts require acknowledgement and follow up, if appropriate by the CSIRT. Firewalls and IDS systems are configured with automated syslog notifications for key events. Logs are archived and are currently stored for a minimum of (1) one year.

NOTE: These logs are not available to customers.

Customer Auditing Capabilities
Within Salesforce, the creator and last updater, as well as timestamps, are recorded for every record. Additionally, the Salesforce Platform and Salesforce Applications have a multitude of history tracking and auditing features that provide valuable information about the use of an #15..
- 811 -
SOLICITATION # CH16012
73 organization’s applications and data, which in turn can be a critical tool in diagnosing potential or real security issues. Auditing features include:

Record Modification Fields - All objects include fields to store the name of the user who created the record and who last modified the record. This provides some basic auditing information.

Login History - You can review a list of successful and failed login attempts to your organization for the past six months within Salesforce.

Field History Tracking - You can also enable auditing for individual fields, which will automatically track any changes in the values of selected fields. Although auditing is available for all custom objects, only some standard objects allow field-level auditing.

Setup Audit Trail - Administrators can also view a Setup Audit Trail for the past six months within Salesforce, which logs when modifications are made to your organization's configuration. This trail can be downloaded into Excel or as a csv file.

While the Login History and Setup Audit Trail are available for six months within Salesforce, audit trails can be downloaded and stored locally to meet longer audit log retention requirements.

Detailed application logs can be used for forensics investigations by customers. These logs are stored for 12 months and are available for a fee.

Event Monitoring (Additional License Option)
In addition to Salesforce’s core auditing capabilities, Salesforce also offers Event Monitoring as an additional license option. Your Agency can use event monitoring to discover how often and at what times your users are logging in to and out of your organization. This includes insight into what Salesforce applications are being adopted by users, who is logging in and from where, what pages users are viewing, what reports users are running and exporting and other aspects of application usage. This capability helps you discriminate between valid and invalid login requests and also track user login patterns for future reference. Not only can your Agency now better understand how your apps are being utilized, you can also monitor if users download large amounts of data that might put your agency at risk. In addition, your Agency can also determine if an employee is unnecessarily downloading sensitive customer/citizen information, pinpointing the exact time and location of that event. Event Monitoring is delivered as an API-first feature and there are Salesforce partners with visualization tools available.

Use the SOAP API and REST API resources to retrieve event log files that contain information useful for assessing organizational usage trends and user behavior. Because event log files are accessed through the Force.com SOAP API and REST API, you can integrate log data with your own back-end storage and data marts so that you can correlate data from multiple organizations and across disparate systems easily. When using event monitoring, keep the following in mind:
- In the unlikely case where no log files are generated for 24 hours, contact Salesforce. - Log data is read-only. You can’t insert, update, or delete log data. - Use the EventType field to determine which files were generated for your organization - LogDate tracks usage activity for a 24-hour period, from 12:00 a.m. to 11:59 p.m. UTC time. - An event generates log data in real time. However, log files are generated the day after an event takes place, during nonpeak hours. Therefore, log file data is unavailable for at least one day after an event.
- CreatedDate tracks when the log file was generated.
#15..
- 812 -
SOLICITATION # CH16012
74 - Log files, represented by the EventType field, are only generated if there is at least one event of that type for the day. If no events took place, the file won't be generated for that day - Log files are available based on CreatedDate for the last 30 days when organizations purchase User Event Monitoring or one day for Developer Edition organizations.

Businesses desire certainty that their data is accurate, complete and reliable, enabling them to meet stringent industry regulations. With Field Audit Trail, customers can track changes at the field level for up to ten years and set different policies for each Salesforce object to ensure data is purged when no longer needed. Life sciences companies running clinical trials in Salesforce, for example, can now maintain a complete audit trail of patient data so they can safeguard the integrity of clinical trial results and comply with FDA regulations. - All event monitoring logs are exposed to the API through the EventLogFile object, however there is no access through the user interface.

Event monitoring can be used with 28 different file types:

Apex Callout, Apex Execution, Apex SOAP, Apex Trigger, API, Async Report, Bulk API, Change Set Operation, Content Distribution, Content Document Link, Content Transfer, Dashboard, Document Attachment Downloads, Login, Login As, Logout, MDAPI Operation, Multiblock Report, Package Install, Report, Report Export, REST API, Salesforce1, Adoption (UI Tracking), Sandbox, Sites, Time-Based Workflow, URI, Visualforce.

Event Monitoring Transaction Security
Transaction Security policies give your Agency a way to look through events in your organization and specify actions to take when certain combinations occur. A transaction security policy consists of events, notifications, and actions. Transaction Security monitors events according to the policies that your Agency sets up. When a policy is triggered, you can receive a notification and have an optional action taken.

For example, suppose that you activate a policy to limit the number of concurrent sessions per user to three. A user with three login sessions tries to create a fourth session. Your Agency can require a user to end one of their existing sessions before proceeding with the new session. At the same time, you are notified that the policy was triggered.

ServiceNow The ServiceNow application writes detailed log information that is stored in tables within a customer’s instance. As this is customer data in a customer’s instance, ServiceNow does not attempt to monitor or view this data unless specifically requested by a customer. As a result the customer is responsible for monitoring the contents of these logs files. The log data is protected in the same manner as all other customer data. Event logs can also be configured to feed into a customer’s environment via ServiceNow’s Syslog probe allowing the logs to be stored within the customer’s environment in a syslog repository or SIEM and retained according to the customer’s requirements.

ServiceNow’s application logging includes verbose transaction logs, these logs are retained within the instance for 30 days. Event logs are stored for seven days and audit histories are retained indefinitely in the instance.

Transaction logs represent every click, view, and system event that occurs in an instance and as a result, will grow very large, quickly. They provide a level of detail that is frequently used for troubleshooting issues with an instance. They can also provide detailed intelligence on the behaviors within an instance. These logs can be downloaded to customers’ environments, if they need to be retained for longer than 30 days.

The event logs on the other hand are less granular; they will include the creation of an incident, or deletion of problem, or any one of the 250 standard events. They may also contain customer #15..
- 813 -
SOLICITATION # CH16012
75 created events. There are a number of security events as well, including successful login, failed login, security privilege escalation, and viewing of a table. These events can either be monitored manually, generate an Incident based on a parameter or when metric is reached; such as failed logins per minute.

The final aspect of logging is the audit history. Audit history may be turned on for any particular table or field. The audit log table then maintains a record of who made changes when to a table or field and what they changed.

QTS All account activities are logged including account creation, modification, disabling and termination. Logs are monitored and notifications are sent for abnormal activity. Splunk Enterprise is used as the centralized audit log monitoring tool to centrally collect, analyze and reduce the amount of audit logs.

As referenced in IT_PRO_07_Audit_and_Accountability_Procedure (v1.0 – 1/20/14), on-site network and security operations monitoring coverage and audit management process; to include analysis, reporting, and alerting into a central repository provided by a highly available Splunk logging service. Splunk logging service supports QTS cloud information systems for organizational–wide situation awareness. Splunk provides built-in capabilities to filter, normalize, and correlate the large amounts of data produced by QTS cloud, and then allows QTS’s support staff to use Splunk’s built-in capabilities to data mine, log mine, and run pre-developed and ad-hoc reports against the result sets obtained during the data and log mining sessions. Logs are centrally correlated and reviewed from devices across QTS cloud Hosting Environment by QTS’s Systems Engineer or designee.

Specific report categories include:
•Authentication and Authorization Reports
• Systems and Data Change Reports
•Network Activity Reports
•Resource Access Reports
•Malware Activity Reports
•Failure and Critical Error Reports
• Vulnerability Correlations Reports
•Anti-Port Correlations Reports
•Watch List Correlations Reports
VMware VMware IaaS Services
In accordance with our ISO and SOC commitments, change-related activity, including administrative actions, performed on the management infrastructure layers supporting vCloud Air are monitored and logged to a centralized logging server for a minimum of 1 year. Infrastructure logging is in place for customer interactions with the vCloud Air management and administrative consoles. These logs are only for the management and administrative interfaces.

These are not in place for monitoring of individual customer VMs installed within the customer tenant org. Limited logging and activity reporting are available from customer tenant environments, with more detailed reporting, auditing and logging capabilities introduced Q4-2014.

VMware AirWatch
To enable user accountability, we have full auditing capabilities on all environments in the AirWatch Cloud. Customers can use the built-in event log, customizable dashboards, integrated reporting engine and AirWatch Hub to audit the web console and end-user actions.

For the SaaS environment logs, our Information Security Team helps ensure that systems generate audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.

FireEye FireEye auditing and log review procedures are based on industry best practices and in accordance with regulatory, statutory, contractual and business requirements. Detailed audit #15..
- 814 -
SOLICITATION # CH16012
76 records (User ID, date, time, type of event, successful/unsuccessful attempts or access secured files and protect the contents of audit trails against unauthorized access, modification or deletion.

VirtueStream Virtustream offers logging as a managed service to customers as optional solution. The types of services and devices are specified by the customer and a monthly report is delivered to the customer.

8.6.7 Offeror must describe whether it can restrict visibility of cloud hosted data and documents to specific users or groups.

CA APM Users of the Portal are divided into two types: Internal users (for publishers of the API) and External users (for developers). There are a number of pre-defined roles for both Internal and External users that inherit functionality in a hierarchical manner. Portal has RBAC built in that allows you to grant access to different functionality for different users. For example, you can assign a user to role that only allows them access to update content, or access apps but not create them.

MAA CA utilizes IaaS vendor to host the service with strict access controls in place. CA SaaS InfoSec team manages users and their associations with groups within LDAP Directory and conducts periodic access reviews to conform to governance requirements.

CA Agile Our databases are shared but logically segregated. We ensure logical security of access to customer data by implementing access restrictions between subscriptions and roles within those subscriptions to assure adequate segregation of data. There is a plugin available in the unlimited edition that allows the administrator to limit access to the application based on IP address.

ASM Only Public Status Page (PSP) data is stored in the cloud, and PSP web pages are accessible by anyone. PSP data is only sent to the cloud if the customer enables this feature, and they can decide which data is made public.

Google If Google becomes aware of a Data Incident, Google will promptly notify Customer of the Data Incident, and take reasonable steps to minimize harm and secure Customer Data. Notification(s) of any Data Incident(s) will be delivered to the Notification Email Address provided by Customer in connection with the Agreement or, at Google’s discretion, by direct communication (e.g., by phone call or an in-person meeting). Customer acknowledges that it is solely responsible for ensuring the contact information given for purposes of the Notification Email Address is current and valid, and for fulfilling any third party notification obligations. Customer agrees that “Data Incidents” do not include: (i) unsuccessful access attempts or similar events that do not compromise the security or privacy of Customer Data, including pings, port scans, denial of service attacks and other network attacks on firewalls or networked systems; or (ii) accidental loss or disclosure of Customer Data caused by Customer’s use of the Services or Customer’s loss of account authentication credentials. Google’s obligation to report or respond to a Data Incident under this Section will not be construed as an acknowledgement by Google of any fault or liability with respect to the Data Incident.

AODocs The AODocs-specific data stored in the Google App Engine Datastore relies on a built-in multitenancy feature named “namespace”, which define virtual “silos” within the AODocs database.

Each customer is assigned a specific namespace (which is in fact the customer’s primary Google Apps domain name), and all the customer’s data is stored within this namespace.

Virtru Key material is encrypted prior to storage, and those keys are backed by HSM. Decryption occurs only for authenticated users
Salesforce The multitenant architecture and secure logical controls address separation of customer data.

There are no dedicated servers used for individual customers. The Salesforce Services infrastructure is divided into a modular architecture based on “Instance”. Each Instance is capable #15..
- 815 -
SOLICITATION # CH16012
77 of supporting several thousand customers in a secure and efficient manner. Services are grouped within each Instance; with app, search, and database elements contained. There are appropriate controls in place to ensure that any given customer’s org (application) is not compromised. The service has been designed to accomplish this and is robustly tested on an ongoing basis by both Salesforce and its customers.

ServiceNow ServiceNow includes built in Role Based Access Control (RBAC) that is based on users, groups and roles. The entitlements granted to users are built from fine grained Access Control Lists (ACLs).

ACLs can be built from individual entitlements that include read, write, create, execute and delete as well as a number of other individual attributes. The attributes that are available also vary, depending on the type of object being secured.

Customers have full control of the entitlements granted to each of their users and integration with customer side directory service is possible through the use of users, groups and group memberships.

SAP Ariba Within our solution, specific logging takes place that is viewable by the customer administrator or their designee. Audit logs produced through use of the solution are considered customer data and are maintained within the customer's instance of the database. These logs are retained so long as the customer has an active contract with us.

As a user control consideration, customers are responsible for monitoring the proper entry of data to the solution and reviewing reports generated by the system.

Fieldglass The Fieldglass Audit Trail tracks a date/time stamp for each user as they log in and out of the application. Likewise, Fieldglass tracks a date/time stamp and owner of every transaction that is created, submitted and approved through the application. Similarly, actions that occur within the reporting tool are also tracked, including when reports are created and run and by whom.

The audit trail log is visible by the State of Utah program office. Audit trail reports can be created with Fieldglass' ad hoc reporting.

Hanna SAP has Security Information and Event Management systems (SIEM) for analysis, reporting and alerting. All critical systems and infrastructure components within the SAP Cloud need to log relevant data, which is stored for a minimum of six (6) months. This is ensured via the security configuration compliance checks and event monitoring. General security monitoring is performed 24x7 for all activities. Resulting warnings and alerts are processed via ticketing system and critical events are handled according to the Incident Management Process.

Hybris Log management procedures are in-place for log review for firewall, applications, network devices, including file-integrity management. hybris utilizes technologies from leading security firms for Log Management and File Integrity Management.

SuccessFactors The application logs the following for every transaction: Event/transaction Time, Transaction ID, Event/transaction Type, Event/transaction Status (Result of the event; if failure, includes reason), Object Attributes (Describes the object affected by the event), Originator User ID (ID of the user who initiated the event or action), Subject ID, Process User ID, Account Number, Transaction Specific Elements.

The application audits changes to the major components. Examples of this are goal auditing and document auditing. The audit trail includes who made the #15..
- 816 -
SOLICITATION # CH16012
78 change, the date of the change and the ability to see the data as it existed at that point in time. The data in the audit log can be viewed with appropriate permissions.

We also provide an optional Audit Framework for additional audit logging capabilities. All audit logs within the application are accessible only by customers. Therefore, the review of application audit logs as well as retention periods for the application audit logs are the customer’s responsibility, and can be determined as per requirements.

To detect unauthorized information processing activities, systems are monitored and all information security events are recorded. Operator logs and fault logging are used to information system problems are identified. We comply with all relevant legal requirements applicable to its monitoring and logging activities. All system logs are created with “write-once” technology so that they cannot be altered or overwritten. All system logs are maintained for a minimum of 90 days on-line and a minimum of 13 months near-line.

Inter host communications are secured by multiple layers of defense including segmented separate VLANS, restricted protocol sharing, multiple levels of stateful firewalls, HOST and NETWORK IDS/IPS and constant vigilant monitoring and testing.

In addition, our Operations Team maintains detailed system logs. Our internal system logs successful and unsuccessful requests for access, and our team monitors all system logs for any errors or unusual activity. Activities are logged and reviewed by various mechanisms such as: RSA, SysLog, NIDS, HIDS, OSSIM and database logging.

The system logs are not made available to customers but are used to monitor the health of the application and facilitate a high level of performance. Alerts are responded to immediately and logs are analyzed daily for any issues or anomalies. The system level logs are written to servers in the data center then copied to our operations team on an as needed basis.

Various logging mechanisms are used to monitor database administration activities. Logging mechanisms include: syslog, alert log and database auditing for the privileged role SYSDBA.

All activities are logged under the SYSDBA role which including: start-up and shutdown of the data base, configuration changes to init.ora and also any queries/data extraction. We would be able to identify dba activities by manual review of the logs and database auditing to detect if client data querying has occurred.

All audit logs are created with “write-once” technology so that they cannot be altered or overwritten.

Controls aim to protect against unauthorized changes and operational problems with the logging facility including:

Alterations to the message types that are recorded.

Log files being edited or deleted.

Storage capacity of the log file media being exceeded, resulting in either the failure to record events or over-writing of past recorded events.

VMware The vCloud Air Terms of Service and Data Privacy Addendum's establish the line of demarcation between the responsibility of VMware and the customer as it pertains to data protection. In addition, security whitepapers are made available to customers to further illustrate these points or to establish transparency regarding the separation of responsibility between VMware and the customer for compliance programs such as HIPAA or PCI.

Subscribers are able to use a VPN connection at multiple layers to maintain data security. For traffic in motion, VPNs can be created for a particular application and also for an entire virtual data #15..
- 817 -
SOLICITATION # CH16012
79 center. A site-to-site IPsec-VPN can also be established to securely tunnel the entire virtual data center back to the private data center. For data ""at rest"", subscribers are provided a role-based access control, whereby specified users are not exposed to the entire infrastructure and can be limited to a single or multiple virtual data centers.

Further details of the controls in place to limit exposure of these groups to customer data is documented within the ATA 101 and SOC reports, available under NDA. vCloud Air has logically separated networks that restrict Tenant access to only their own private networks. The vCloud Hybrid Service has two offerings: The Dedicated Cloud option provides physically isolated and reserved compute resources from all other vCloud Hybrid Service tenants, as well as a private cloud instance. The Virtual Private Cloud option has a multitenant compute resource mode. Both services have logically isolated networking and storage that ensures secure resource separation. Customers have complete control over the file systems and databases they deploy within the service.

Access is technologically enforced and employees are only authorized the level of access to information assets that is required to meet an approved business need or perform prescribed job responsibilities.
• Administrative access is limited to only those users that explicitly require privileged access.

Customers do not have direct access to the SaaS environment; rather, customers administer the solution via the Web console.

FireEye Each of the FireEye offerings include strong access controls including role-based access. Only properly authorized individuals on a need to know basis are granted access to data.

VirtueStream Virtustream does not have access to customer hosted data. Customers control access to their application or system which sits upon the IaaS. Customer would need to create the user in their own Active Directory to allow access by named users of Virtustream for specific system.

8.6.8 Offeror must describe its notification process in the event of a security incident, including relating to timing, incident levels. Offeror should take into consideration that Purchasing Entities may have different notification requirements based on applicable laws and the categorization type of the data being processed or stored.

CA APM CA Technologies documents a plan and associated procedures in case of an information security incident. The incident response plan clearly articulates the responsibilities of personnel and identifies relevant parties for notification. All security incidents will be investigated and triaged to understand where the vulnerability exists.

Software vulnerabilities will be investigated by CA engineering teams; other vulnerabilities will be addressed by the SaaS Ops team in conjunction with AWS.

Affected customers will be notified and given a remediation plan MAA Clients are notified via email of any security incident that resulted in a data breach for that client promptly and no later than 5 days. A root cause analysis is then sent within 30 days. Meeting can be setup upon request.

CA Agile We have a defined Incident Handling Guide which outlines the process and responsibilities during breach investigation. Clients are notified via email of any security incident that resulted in a data breach for that client promoptly and no later than 5 days. A root cause analysis is then sent within 30 days. Meeting can be seutp upon request.

ASM Clients are notified via email of any security incident that resulted in a data breach for that client promptly and no later than 5 days. A root cause analysis is then sent within 30 days. Meeting can be setup upon request.

Google Google’s focus on security and protection of data is among our primary design criteria. Google data center physical security features a layered security model, including safeguards like custom- #15..
- 818 -
SOLICITATION # CH16012
80 designed electronic access cards, alarms, vehicle access barriers, perimeter fencing, metal detectors, and biometrics, and the data center floor features laser beam intrusion detection. Our data centers are monitored 24/7 by high-resolution interior and exterior cameras that can detect and track intruders. Access logs, activity records, and camera footage are available in case an incident occurs. Data centers are also routinely patrolled by experienced security guards who have undergone rigorous background checks and training. As you get closer to the data center floor, security measures also increase. Access to the data center floor is only possible via a security corridor which implements multifactor access control using security badges and biometrics. Only approved employees with specific roles may enter. Less than one percent of Googlers will ever step foot in one of our data centers.

Google operates a global, multi-tenant environment running the world’s second largest IP data network providing customers with a low latency, high performing platform that runs 24x7.

Hard Disks are assets that are tracked throughout its lifecycle at Google from arrival to final destruction. These disks are component parts that Google uses to build its own servers from other component parts including motherboards and a harden, highly customized version of Linux.

Google uses a proprietary storage and processing mechanism that isolates processing of data in chrooted jails within a physical server. Access permissions restrict the ability for processes to interact between jails. In addition, tenant data is striped in chunks across many different drives with each chunk having its own access control list. This helps ensure that data is logically isolated between customers in storage and during processing.

In addition to the inherent processing and storage mechanisms described above, Google’s security controls including least privilege rights, logging and auditing have been implemented consistent with FedRAMP requirements
AODocs Altirnao can use multiple notification channels to communicate incident updates to its customers:
the AODocs status page (https://status.aodocs.com) provide status updates on all the AODocs services the AODocs customer mailing list, which can be used to send emails to the technical contacts of all AODocs customers the AODocs support platform, i.e. ZenDesk, which can be used to communicate with specific customers who have opened tickets.

Salesforce Incident Response
If negotiated into a final contract, Salesforce can promptly notify the Customer in the event Salesforce becomes aware of an actual or reasonably suspected unauthorized disclosure of Customer Data. Notification may include phone contact by Salesforce support, email to customer's administrator and Security Contact (if submitted by customer), and public posting on trust.salesforce.com.

Salesforce maintains an Incident Response Plan and has an established Security Incident Response Process. During a security incident, the process guides Salesforce personnel in management, communication, and resolution activities. Government customers can report security incidents related to their Salesforce products and offerings via [email protected].

Salesforce will respond in accordance with the incident response process described above.

Our incident response plan/process was created in accordance with FedRAMP moderate control requirements which include incident response requirements derived from NIST SP 800-53, NIST SP 800-61, and the FedRAMP Incident Communications Procedure.

ServiceNow Unless notification is delayed by the actions or demands of a law enforcement agency, ServiceNow shall report to Customer the unauthorized acquisition, access, use, disclosure or destruction of Customer Data (a “Breach”) promptly following determination by ServiceNow that a Breach occurred. The initial report shall be made to Customer security contact(s) designated in #15..
- 819 -
SOLICITATION # CH16012
81 ServiceNow’s customer support portal. ServiceNow shall take reasonable measures to promptly mitigate the cause of the Breach and shall take reasonable corrective measures to prevent future Breaches. As information is collected or otherwise becomes available to ServiceNow and unless prohibited by law, ServiceNow shall provide information regarding the nature and consequences of the Breach that are reasonably requested to allow Customer to notify affected individuals, government agencies and/or credit bureaus. Customer is solely responsible for determining whether to notify impacted Data Subjects and for providing such notice, and for determining if regulatory bodies or enforcement commissions applicable to Customer or Customer Data need to be notified of a Breach.

See the “Data Security Guide” contained within the “Subscription Service Guide” included with this response for additional information.

QTS Security Incident handling capability and process is outlined in the following Incident Response related procedures and plans:
•FED_PLN_01_Incident_Response_Plan (v1.2 – 4/09/14)
•IT_PRO_29_QTS-FC_Incident_Response_Procedure (v1.0 – 1/17/14) •IT_PRO_18_ISSO_IRT_Incident_Response_Guidelines_Procedure (v1.2 – 12/11/13) •OPS_PRO_77_OSC_New_Incident_Creation_Procedure (v1.0 -1/23/14) •OPS_PRO_62_Best_Practices_for_Incident_Handling_Procedure (v1.0 – 12/10/13) •OPS_PRO_72_BPG_OSC_Working_and_Resolving_Incidents_Procedure (v1.0 – 1/22/14) •OPS_PRO_84_BPG_OSC_Major_Incident_Management_Procedure (v1.0 – 1/27/14) As outlined in QTS’s IT_PRO_29_QTS-FC_Incident_Response_Procedure (v1.0 -1/17/14) and FED_PLN_01_Incident_Response_Plan (v1.2 – 4/09/14):
•Preparation activities, to include:
-Ensuring the security of systems, networks, and applications through periodic risk assessments of systems and applications to prevent incidents.
-Increasing user awareness of policies and procedures regarding appropriate use of networks, systems, and applications.
-Sharing applicable lessons learned from previous incidents (particularly those involving malicious code and violations of acceptable use policies) with users so they can see how their actions could affect the organization.
-Training Federal Cloud System Administrators to maintain their networks, systems, and applications in accordance with the organization’s security standards. •Detecting activities, to include:
-As referenced in QTS’s IT_PRO_29_QTS-FC_Incident_Response_Procedure (v1.0 -1/17/14), review and analysis of continuous monitoring tools and related log file(s). -3rd Party monitoring services (Alert Logic): help detect and alert on changes in certain resources (e.g., Web pages) or publicly accessible services, such as Web, Domain Name System (DNS) and FTP servers.
-File Integrity Checking Software: help detect any changes to important files caused by incident -IDS are set up for scanning and detection. Detection is achieved either by log analysis, packet capture review or image acquisition and analysis.
•Analysis Activities, to include:
-QTS IR Team is activated and incident identification is performed -Continued and targeted review and analysis of continuous monitoring tools, related log file, and corresponding applications would be performed.
-If an Incident Response Team is required then at least one member of IT Security along with one or more members of QTS’s IT Operations organization responsible for the affected system, as well as any necessary representatives from Network
SAP Ariba We can provide a general overview but our full documentation is confidential.

All of our security processes and procedures are audited by a third party every six months for ISAE 3402 assurance. We also hold PCI DSS certification. The #15..
- 820 -
SOLICITATION # CH16012
82 intent of the following is to describe in a broad manner the actions we take in regard to security incidents, their management, tracking and communications in regard to internal policies and procedures. We have an established security incident plan based on internally-developed policies and procedures where documented results of all security incidents occurring during the six month audit period are reviewed and evaluated against the Trust Services Principles of ISAE 3402 and the PCI DSS standards as appropriate. Upon notification of a security incident, a documentation trail is begun by the InfoSec department and an internal ticket is created as the record of reference. The lead security manger calls a meeting including all personnel required to contain and reduce risk and impact appropriate to the nature of the incident. Tasks are assigned with milestones to be met to validate and determine extent of the incident.

Communication is made to the Privacy & Security Board to alert principal membership and foster internal cooperation and awareness. An appropriate communication channel to affected customer(s) is determined based on how we were notified of the incident, i.e. from a customer, from an internal report or from a third party report. Communication is made to affected customer(s) to include the nature of the incident, actions taken to contain the incident and potential effects of actions if any, in regard to sustained business process and availability of the system. Any workarounds or hot fixes necessary in the solutions are communicated and scheduled reporting to the customer(s) is established with an identified single point of contact within our company.

Based on the nature of the incident, if required, legal counsel present at initial risk & impact meeting, will assist in communicating with law enforcement contacts. The customer is kept informed of the milestones met and at scheduled intervals until the incident is fully contained and no further risk and impact perceived. All incidents are required to be internally managed by InfoSec to include tracking and review on a weekly basis and evaluation of the actions taken in regard to our security concept. All incident reports are presented to and reviewed by the Privacy & Security Board and are formally closed with discussion and evaluation to determine what actions can be taken to prevent similar incidents. Depending on the nature of the incident and impact to customer(s), security incidents are not formally closed by the board until all affected customers are made aware of the incident and appropriate measures to remediate the initial threat are formally communicated.

Fieldglass Fieldglass’ security team is responsible for managing security incidents and all communication is conducted via the respective account managers to ensure timeliness. The process is defined within the Incident Response Management Standard.

Customers are notified of an incident within 48 hours.

Hanna SAP will notify via defined communication channels within 36 hours of a confirmed data security breaches to the affected customers. The report will detail the following information:
• Details relating to the security incident that has occurred, known at the time of notification.
• IT infrastructure and/or application affected by the security incident. • Overview of the performed mitigation actions to restore the security, documented within the incident report form.
• All further applicable requirements by country regulations “on obligation to notify” will be met.
#15..
- 821 -
SOLICITATION # CH16012
83 Hybris Upon a breach that directly affects a customer's environment, hybris would notify the customer as quickly as reasonably possible. Furthermore, hybris follows its information security incident management policy as well as Visa's standard process for responding to a breach. The policy includes procedures such as disclosure of sensitive information, disclosure of system vulnerability, public release of vulnerability information, system vulnerability exploitation as well as incident reporting, contacting of law enforcement and forensic investigation.

SuccessFactors We have a comprehensive and approved Incident Management Policy and process. Upon the occurrence of a security incident, initial communication is distributed to the appropriate individuals and an escalation process is followed. Upon becoming aware of the incident, measures are promptly taken by the team to resolve the situation.

All affected customers should be informed within at most 36 hours of confirming a potential breach in the privacy of their data. Following incident resolution, follow-up is required to ensure that the incident has been resolved effectively and that the threat is no longer present.

We are aligned with ISO 27k standards for event and incident management and have formal incident management policies and processes in place. These policies and procedures are tested in the ISO 27k and SOC 2 audits.

VMware VMware IaaS Services
If VMware determines that there has been unauthorized access to, or use or disclosure of, Your Content, or other incident VMware will use commercially reasonable efforts to notify You, taking into account any applicable law, regulation, or governmental request.

VMware will provide security incident response (e.g., detection, severity/threat classification, forensics, and resolution) pertaining to management infrastructure over which VMware has direct, administrative, and/or physical access and control, such as the vCloud Hybrid Service servers, storage, applications, and network devices.

Documented escalation procedures and a ticketing system are in place to guide employees in identifying, reporting, and responding to system availability issues and related security incidents.

This includes an incident response policy to determine severity of an incident and a breach notification process.

All alerting and monitoring at the guest OS\VM level is the responsibility of the customer.

In the event of a data breach customers will be notified by VMware vCloud Air Global Support Services via their preferred contact means. VMware will provide security incident response (e.g., detection, severity/threat classification, forensics, and resolution) pertaining to management infrastructure over which VMware has direct, administrative, and/or physical access and control, such as the vCloud Air service servers, storage, applications, and network devices.

Notification timeframes are agreed upon between VMware and the customer in standard agreements and contracts. Incidents are handled on a case-by-case basis, but typically occur between 24-48 hours after a breach has been confirmed.

VMware will provide security incident response (e.g., detection, severity/threat classification, forensics, and resolution) pertaining to management infrastructure over which VMware has direct, administrative, and/or physical access and control, such as the vCloud Air service servers, storage, applications, and network devices.

FireEye FireEye has a developed documented process for reporting client notification for regulatory, legal and contractual issues once a breach has been confirmed.

VirtueStream Virtustream shall contact customers in accordance with Service Level Agreements (SLA) and contractual obligations.

There are two primary Incident types; Security Incidents, where there is a possible breach in systems or data integrity, and Services, where there is in impacted or affected service. Although there is some overlap, generally any security-related incident should be classified as a Security #15..
- 822 -
SOLICITATION # CH16012
84 Incident and the response must be managed using the ‘Virtustream Information Security Procedure – Security Incident Response Plan’.

The purpose of this security incident response plan is to provide general guidance to Virtustream staff- both technical and managerial – to enable quick and efficient recovery from security incidents; respond in a systematic manner to incidents and carry out all necessary steps to correctly handle an incident; prevent or minimize disruption of critical computing services; and minimize loss or theft of sensitive or mission critical information including sensitive credit card data. The plan is also a guide to sharing information with other stakeholder organizations who might be impacted by such security incidents such as the credit card associations and law enforcement.

The Security Incident Response Plan (SIRP) provides guidance to prepare for, respond to, and recover from potential incidents. Policy statements surrounding the IR-Plan are provided to ensure continued upkeep and standardized use. The SIRP guidance at the procedural level defines the roles, responsibilities, communication methods and flows, contact information, types of potential incidents, and immediate actions that are to be taken upon an incident’s identification, and elaborates with subsequent recovery steps. Virtustream’s Incident Response Policy requires the implementation and testing of a generalized plan that adheres to the International Standards Organization 27002 guidance for incident management and response, but meets specific requirements for compliance such as PCI-DSS.

The Plan covers the corporate environment associated with Virtustream’s IT assets, the local IT resources and the IT resources at Virtustream’s Data Center. It consists of a series of guidelines (Incident Response Guidelines or “IRG”) that should generally be followed as appropriate for the circumstances as when a security incident occurs or as part of the ongoing maintenance of this plan.

As the incident progresses and has more impact (i.e. severity level increases), the escalation process will be used to engage appropriate resources. Incidents should be handled at the lowest escalation level that is capable of responding to the incident with as few resources as possible in order to reduce the total impact, and to keep tight control. The Table below defines the escalation levels with the associated team involvement.

8.6.9 Offeror must describe and identify whether or not it has any security controls, both physical and virtual Zones of Control Architectures (ZOCA), used to isolate hosted servers.

CA APM AWS EC2 datacenters annually undergo SOC 3 audits.

MAA Physical access mechanisms (e.g., access cards, biometric devices, mantraps and portals) have been implemented and are administered by local operations staff to help ensure that only authorized individuals have the ability to access the data centers.

Portals and mantraps have been installed as anti-tailgating measures in most of data center lobbies. Entry to and exit from the data centers is through either a portal or mantrap where present. In data centers without portals or mantraps, the security officer monitors the entrance to prevent tailgating. Where present, the portal/mantrap bypass doors are only used in the event an individual is unable to use the portal or mantrap in case of emergency. Examples include handicap, phobia, or other restrictions on a case-by-case basis. Tours and emergency data center security operations crews will be permitted to use the portal bypass door, when necessary.

CA Agile Physical access mechanisms (e.g., access cards, biometric devices, mantraps and portals) have been implemented and are administered by local operations staff to help ensure that only authorized individuals have the ability to access the data centers.

Portals and mantraps have been installed as anti-tailgating measures in most of data center lobbies. Entry to and exit from the data centers is through either a portal or mantrap where present. In data centers without portals or mantraps, the security #15..
- 823 -
SOLICITATION # CH16012
85 officer monitors the entrance to prevent tailgating. Where present, the portal/mantrap bypass doors are only used in the event an individual is unable to use the portal or mantrap in case of emergency. Examples include handicap, phobia, or other restrictions on a case-by-case basis. Tours and emergency data center security operations crews will be permitted to use the portal bypass door, when necessary.

ASM Physical access mechanisms (e.g., access cards, biometric devices, mantraps and portals) have been implemented and are administered by local operations staff to help ensure that only authorized individuals have the ability to access the data centers.

AODocs N/A because all our data is hosted on the Google Cloud Platform infrastructure.

Virtru We require 2 Factor and Private Keys to authenticate and Virtrual Private Clouds for purposes of Inter-machine communication
Salesforce A customer's instance (org) of Salesforce is an aggregate of the raw data. The data model is very complicated, normalized, and the rows are identified by base62 encoded keys (primary and foreign). Re-establishing data ownership and a business context for the data would be very difficult to do at the database level. In order to reassemble any given customer's application (org), someone would need access to our source code in order to reassemble the raw data in a manner that could be interpreted and understood, and would need the entire set of tapes or disks/arrays supporting a given Instance, as the data for any one customer is spread across several tapes/disks. Data center engineers with physical access to the servers do not have logical access to the production environment and administrators with logical access to the systems do not have physical access to the data centers.

ServiceNow ServiceNow’s architecture is built on a ServiceNow fully owned operated private cloud. This private cloud hosts the ServiceNow platform and applications that are offered to its customers under a subscription service model. The ServiceNow private cloud operates out of colocation data centers that provide robust physical and environmental controls, with ServiceNow staff exclusively providing the logical management. Access to the private cloud where customer data is hosted is only granted to ServiceNow staff based on their roles and job requirements. ServiceNow does not outsource any function that would give a third party access to customer data.

ServiceNow’s private cloud is a highly standardized environment from the identically configured cages in the data centers through to the consistent logical infrastructure. This private cloud is home to just ServiceNow, limiting the private cloud’s footprint to only those technologies required to support this service. This allows for highly restricted networking rule sets regarding ingress and egress requirements and facilitates the ability for hardened systems, only allowing for the small number of necessary services, protocols and ports to be enabled.

A ServiceNow instance represents an isolated logical environment consisting of application nodes in the web application tier and a dedicated database. Each customer will receive at least two instances, a production High Availability (HA) instance and a sub-production instance without HA.

Each instance is accessed via a unique Domain name in the form of ‘customername.servicenow.com’ (for a production instance) and ‘customername-dev.service-now.com’ as a subproduction example. #15..
- 824 -
SOLICITATION # CH16012
86 There is no comingling of any customer data between instances and there is no single shared multi-tenant databases, with data from multiple customers stored therein.

QTS QTS cloud employs security controls as needed to protect the confidentiality and integrity of the information being transmitted by utilizing Cisco AnyConnect VPN Client with SSL (TLS and DTLS) and IPSec (Internet Key Exchange Version 2 [IKEv2]). DTLS provides an optimized connection for latency-sensitive traffic, such as VoIP traffic or TCPbased application access, TLS (HTTP over TLS/SSL) ensures availability of network connectivity through locked down environments, including those using web proxy servers. IPSec/IKEv2 provides an optimized connection for latency-sensitive traffic when security policies require use of IPSec and complies with applicable federal laws, executive orders, directives, policies, regulations, standards, and guidance.

The QTS Federal Cloud Infrastructure (QTS cloud) is divided into two separate, isolated firewalled environments, each having its own security boundaries, which are physically and logically separated. These are the QTS cloud Hypervisor Management Layer and the QTS cloud Service Delivery Layer.

QTS cloud’s Hypervisor Management Layer management is made available through dynamic FIPS 140-2 validated L2TP/IPSEC or SSL 3. 0/TLS 1. 0 encrypted VPN tunnels, which are authenticated against the RSA SecurID multi-factor authentication security appliances. Once fully authenticated, only a limited RDP session to the physical bastion host (which is also protected by the RSA SecurID multi-factor authentication security appliances) via jump domains is allowed, which prevents the presentation of information systems management related functionality at an interface for general
users.

QTS cloud’s Service Delivery Layer management is also made available through FIPS 140-2 validated L2TP/IPSEC or SSL 3.0/TLS 1. 0 encrypted VPN tunnels, which are authenticated against the RSA SecurID multi-factor authentication security appliances. Connection to the QTS cloud Service Delivery Layer is only available through dedicated site-to-site 140-2 validated L2TP/IPSEC or SSL 3. 0/TLS 1. 0 encrypted VPN tunnels or Trusted Internet Connection (TIC) monitored dedicated datelines to federal customer datacenters, which prevents the presentation of information systems
management related functionality at an interface for general users.

SAP Ariba The Cisco Secure ASA5555 Firewall is a dedicated firewall appliance that delivers strong security and performance and creates almost no network performance impact. The product enforces secure access between an internal network and Internet, extranet, or intranet links.

Ariba uses Cisco Secure ASA5555 Firewall hardware and Cisco Router access lists to control the traffic to and from the Internet, between Ariba Corporate and the Ariba system, and between servers in Ariba. The firewall servers are configured for Fail-Over/Hot Standby Setup. Additionally, Ariba uses internally developed Ariba SafeGuard software to protect customer data from unauthorized Ariba Corporate users, allowing only Ariba Operations personnel access for limited periods of time.

Specifically, firewall servers are used in each level of data communication within Ariba:

Between the Internet and web servers
Between the web servers and the application servers
Between the application servers and the database servers #15..
- 825 -
SOLICITATION # CH16012
87 These ASA5555 Firewall servers allow Ariba Operations to rigorously protect Ariba from unauthorized access, providing full firewall security protection.

The Equinix Data Center utilizes an array of security equipment, techniques, and procedures to control, monitor, and record access to the facility, including customer cage areas. All areas of the center are monitored and recorded using CCTV, and all access points are controlled. The Data Center is staffed with 24-hour security officers. Visitors are screened upon entry to verify identity, and escorted to appropriate locations. Access history is recorded for audit purposes.

Fieldglass Please see the Fieldglass Security and Hosting Overview provided in the Supplemental Information section of this response.

Hanna The fundamental security architecture of the SAP Cloud infrastructure is the principal of a private cloud.

Customers receive an isolated, logical grouping of several virtual machines and physical systems in dedicated customer private networks. Customer private networks are segregated from each other using virtual local area networks (VLAN) technology. Customer systems are deployed in the respective customer private network. Though customers are only able to view or access systems within their assigned customer private network.

Design of customer private networks has to be defined in a workshop between SAP and the customer. Multiple customer private networks might be required to separate different tier levels or to implement customer data flow restrictions.

Modesto City CouncilJune 4, 2024

Modesto City Council
June 4, 2024