ITS78 Data, Cybersecurity, and Related Audit, Compliance, and Incident Responses Services is a Statewide Contract (SWC) for This is a Statewide Contract for Data, Cybersecurity, and Related Audit, Compliance, and Incident Response Services. Services include a full range of audit, penetration tests, reviews, and validation of compliance with legal, regulatory and policy requirements, and related services in areas such as data breach investigation, remediation, and security of confidential information.

Note: This contract may be used to procure the goods or services described in this user guide at any dollar amount. Any limitations, including for procurements involving construction, are outlined in this Contract User Guide.

For the Master Contract Record, refer to the Master Blanket Purchase Order (MBPO) with RFR ITS78 Master Contract Record.

Benefits and Cost Savings

Statewide Contracts are an easy way to obtain benefits for your organization by: 

• Leveraging the Commonwealth’s buying power
• Simplifying the solicitation process
• Providing contracting expertise
• Enhancing vendor relationships through proactive management and oversight
• Offering competitive pricing
• Offering Prompt Payment Discounts (PPD), which is a percentage discount given to the buyer if the invoice is paid within a specified time, in accordance with the Commonwealth’s Bill Paying Policy

• Partnering with a pool of qualified and experienced vendors
• Offering Prompt Payment Discount
• Accessing a wide range of environmentally preferable products and services 
  

This contract includes 4 categories of services listed as follows: 

• Category 1: Full range of data and cybersecurity audits and compliance reviews and related consulting services, including best practices, gap analysis, scorecards, compliance with internal and external controls (e.g., internal process and procedures, HIPAA, IRS, PII, CJIS), and control validation). 

When to Use Category 1:

For organizations in the early stages of cybersecurity planning, Category 1 is a good entry point, with awarded vendors providing a baseline cybersecurity readiness assessment. Vendors are available to audit and assess organizations’ practices, infrastructure, and compliance with federal, state, other applicable laws and rules, uncover vulnerabilities and irregularities, and make recommendations for improvement.  Category 1 may also be helpful in assessing changes to existing configurations and requirements.  Examples of such changes could be infrastructure, vendors, policies and procedures, or legislative.

• Category 2: Risk assessments as they relate to internal and external (3rd party) components. Services include risk management strategies, quality assurance audits, cloud security, vendor security, and data security management.

When to Use Category 2:

Category 2 offers risk assessments when organizations implement significant changes to hardware or software infrastructure. Examples include a new application or server, adding cloud services, or introducing a new IT service provider. Awarded vendors review the new environment and report on possible data and security risks.

• Category 3: Cybersecurity testing and readiness services including external/internal penetration testing, physical security assessments, social engineering assessments, vulnerability assessments, application testing, network security assessments, endpoint security assessments, tabletop exercises, identity and access management assessments.*

When to Use Category 3:

Vendors awarded to Category 3 provide assistance with assessing the organization's readiness for real-world cyber events, e.g. password cracking, cyber hacking, ransomware, and phishing to ensure security protocols perform as designed. Vendors essentially attempt to “break into” the network environment to identify vulnerabilities and suggest actions to prevent actual breaches.

• Category 4: Information Security and Cybersecurity Incident Response services, including emergency incident response services, incident containment, mitigation, remediation, internal and external communications and required notifications, forensic investigations, managed threat detection and response. Contractors are prepared to engage within 24-48 hours, 7 days a week, and implement incident response protocols as negotiated by the buyer.

When to Use Category 4:

When an organization believes that a cyber event may have taken place, vendors in Category 4 are available to assist with response efforts, including crisis management, business continuity, and communications strategy, among others.

The following is a complete list of the types of organizations generally allowed to use the Operational Service Division’s (OSD's) Statewide Contracts (SWCs). Some SWCs may be open to additional organizations, and some are more restricted in usage.

• Cities, towns, districts, counties, and other political subdivisions
• Executive, Legislative, and Judicial Branches, including all departments and elected offices therein
• Independent public authorities, commissions, and quasi-public agencies
• Local public libraries, public school districts, and charter schools
• Public hospitals owned by the Commonwealth of Massachusetts
• Public institutions of higher education
• Public purchasing cooperatives
• Non-profit, UFR-certified organizations that are doing business with the Commonwealth
• Other states and territories and their cities, towns, districts, counties, other political subdivisions, and public institutions of higher education without prior approval from the State Purchasing Agent 
• Other entities when designated in writing by the State Purchasing Agent
  

Note: The price files and vendor catalogs are accessible through public view in COMMBUYS; therefore, buyers may access the price files and vendor catalogs without signing into a COMMBUYS account.

The pricing options are outlined as follows:

• Fixed Pricing: Pricing is fixed but further negotiations can be made. All engagements will require a SOW in the form of the “Statement of Work” with deliverable-based payments. In the SOW, Bidders must agree to identify any and all costs or charges that will be billed under the SOW.
• Hourly Pricing: All engagements will require a SOW in the form of the “Statement of Work.” In the SOW, Bidders must agree to identify any and all costs or charges that will be billed under the SOW.

Note: Product pricing may be found on the vendor information section, where links to all the vendors’ MBPOs are provided.

Contract users should always reference ITS78 when contacting vendors to ensure they are receiving contract pricing. Quotes, not including construction services, should be awarded based on best value.

For a full description of how to complete a quote in COMMBUYS visit the Job Aids for Buyers webpage, and select How to Request Quotes from Vendors on Statewide Contracts or How to Post a Bid to Receive Quotes from Vendors on a Statewide Contract (Executive Agencies).

The purchase options identified below are the only acceptable options that may be used in this contract:

• Fee-for-Service contract.
• Fixed Pricing: All engagements will require a SOW in the form of the “Statement of Work” with deliverable-based payments. In the SOW, Bidders must agree to identify any and all costs or charges that will be billed under the SOW.
• Hourly Pricing: All engagements will require a SOW in the form of the “Statement of Work.” In the SOW, Bidders must agree to identify any and all costs or charges that will be billed under the SOW.

Links to all the vendors’ Master Blanket Purchase Orders (MBPOs), where product pricing may be found, are provided in the Vendor List and Information.

This contract provides for the following methods of purchase:

• If soliciting multiple quotes (recommended except in unusual circumstances): Solicit quotes and select and purchase quoted item in COMMBUYS.
  • This COMMBUYS functionality provides a mechanism to easily obtain quotes, as specified by the Contract. The buyer would create a Release Requisition, and then convert it to a Bid. After approval by the buyer approving officer, the bid is then sent to selected vendors to request quotes. Buyers must include “ITS78 RFQ” when entering information in the Description field.
  • For a full description of how to complete a quote in COMMBUYS visit the Job Aids for Buyers webpage, and select How to Request Quotes from Vendors on Statewide Contracts or How to Post a Bid to Receive Quotes from Vendors on a Statewide Contract (Executive Agencies).
• If ordering directly from a vendor without seeking multiple quotes: Once the Statement of Work (SOW) has been finalized, COMMBUYS users should attach it to their direct release purchase order in COMMBUYS.
  • For a description of how to complete this purchase in COMMBUYS, refer to the How to Make a Statewide Contract Purchase in COMMBUYS. Note: In Step 8, enter the Unit Cost as 1. In Step 11, attach the SOW and purchase order with detailed pricing and quantity information.

Note: MOSAIC and COMMBUYS do not interface. Payment request and invoice must be reported in both MOSAIC and COMMBUYS.

Performance and Payment That Goes Beyond Contract End Date

The extend beyond period is in place to allow performance and payment obligations under a contract to continue after the contract term has ended. This period is primarily used to aid the transition between an expiring contract and its replacement and to ensure the continuity in service delivery.

For extend beyond, the following stipulations are in place:

• Buyers may not enter into a written agreement that will go more than twelve (12) months beyond the maximum end date of the contract. Existing services may be completed and payments made during this period.
• No new agreements, including leases, rentals, or service contracts, may be made after the contract's expiration.
• Agreements established prior to the Master Agreement expiration may allow performance and payment obligations to continue until the maximum Extend Beyond date.
  

COMMBUYS is the Commonwealth of Massachusetts' e-procurement platform, serving as a central marketplace for state agencies and other Eligible Entities to procure goods and services, connecting government buyers and businesses. It aims to streamline the purchasing process, ensuring transparency and efficiency in the procurement process.

For Executive Agencies, COMMBUYS is required. Per 801 CMR 21.00, Executive Agencies must use established Statewide Contracts (SWCs) for the purchase of products and services. To set up a COMMBUYS buyer account or to update an existing agency account, the buyers must contact the COMMBUYS Help Desk at: 888-627-8283 or OSDhelpdesk@mass.gov.

While COMMBUYS use is not mandated for Non-Executive Agencies and other Eligible Entities, it is highly recommended to streamline the procurement process and assist buyers in making informed purchasing choices. Eligible entities should follow their internal guidelines for COMMBUYS use.

Buyers can view contract documents on COMMBUYS without requiring a COMMBUYS account or logging in.  
To find contract documents in COMMBUYS, follow these steps:

1. On the COMMBUYS home page, enter ITS78 in the search tool and select Blankets from the drop-down list.
2. Select the Search icon. The related Master Blanket Purchase Orders (MBPOs) information opens in a table format. 
3. To view the associated contract documents, under the Blanket # column, select the applicable Purchase Order (PO) link. MBPO opens for the selected PO and the attachments can be found in the Agency Attachments or Vendor Attachments section. 

If applicable, to find vendor-specific documents, view the links to the individual vendor MBPOs on the Vendor Information page, and follow these steps:

1. On the Vendor Information page, select the applicable Purchase Order (PO) link. The Master Blanket Purchase Order (MBPO) opens for the selected PO.
2. If applicable, on the MBPO, scroll down to the Vendor Attachments section to find the vendor-specific documents.
3. To view, select the desired document link.

All engagements entered into under ITS78 will require a SOW in the form of the “Statement of Work” with deliverable based payments. Contracting Departments may include additional terms in the SOW. In the SOW, any and all costs or charges that will be billed under the SOW must be clearly identified. Vendors may include options for Fixed Price engagements, Time and Materials engagements, or both. Three SOW templates, one for Fixed Price, one for Time and Materials, and one for both, are found on the Master Contract Record.

Additional Requirements for Executive Departments and other Eligible Entities that use the Commonwealth Network

If this SOW will be placed under Category 2, 3, or 4 of ITS78, the Eligible Entity will work with the Executive Office of Technology Services and Security (EOTSS) to identify an EOTSS contact who will serve as a point of contact for the project. The EOTSS contact will be named in the Statement of Work and their signature is required on the Statement of Work. The Eligible Entity Project Manager (PM) will coordinate with the EOTSS point of contact throughout the Term of the engagement.

If a point of escalation is required within EOTSS, the Eligible Entity PM will communicate with the EOTSS Chief Information Security Officer, or designee.

Please refer to the following guidelines:

• Executive Departments must use diverse and small businesses to the extent possible based on contract terms, Supplier Diversity Office (SDO), and departmental policies, laws, and regulations.
• The Small Business Purchasing Program (SBPP) applies to small procurements ($250,000 or below annually), while the Supplier Diversity Program (SDP) applies to large procurements (over $250,000 annually). Executive Departments must consider these requirements when soliciting quotes or issuing Statements of Work (SOWs).
• Operational Services Division (OSD) provides a list of SDO businesses through the Statewide Contract Index. Refer to the Programs (SDP and SBPP) tab on the index (scroll to view the tab).

• In cases where all other factors are equal, and particularly when adhering to a best value approach, the department will favor the vendor with stronger SDP commitment.
• For more information, refer to Best Value Evaluation of SDP Plan Forms: A Guide for Strategic Sourcing Teams.
• Vendor SDP commitment percentages may be found on the Vendor List table.

• If available, departments must notify at least two certified small businesses capable of providing the product or service. Bids received from SBPP-participating small businesses must be evaluated, and if one meets the department’s best value criteria, the contract must be awarded to that vendor.
• For more information, refer to Best Value Evaluation of Responses to Small Procurements: A Guide for Strategic Sourcing Teams.
• Vendor SBPP Certification status can be found on the Vendor List table.

The awarded vendor’s use of subcontractors is subject to the provisions of the Commonwealth’s Terms and Conditions and Standard Contract Form, as well as other applicable terms of this Statewide Contract (SWC). 

Vendors in this Statewide Contract offer Prompt Payment Discount (PPD), which may vary for each vendor. PPD is a percentage discount given to the buyer if the invoice is paid within a specified time, in accordance with the Commonwealth’s Bill Paying Policy. 

Note: Vendor discounts are detailed in the vendor list table and the price files within each vendor's Master Blanket Purchase Order (MBPO) or Master Contract Record MBPO.

Vendors on this contract may be required to provide products or services in cases of statewide emergencies. The 801 CMR 21.05(3) defines emergency for procurement purposes. Visit the Emergency Response Supplies, Services and Equipment Contact Information for Statewide Contracts list for emergency services related to this contract.

Vendors' performance is measured by several factors, including the following:

• Buyers provide actionable feedback on vendors for this contract to optimize performance through the Procurated platform. On the Procurated website, click "Search for a Massachusetts Vendor to Review", then search for the vendor by name and select them from the list. Once you enter your professional email address, you will be forwarded to the review screen.
• Buyers are encouraged to reach out to the Category Manager(s) (Kerri Quinn or Joshua Flanagan-Lanier) if vendors are not meeting their contractual obligations and buyers may be surveyed for vendor performance feedback.
• Vendors will be evaluated on their current performance and may be asked to work with the Commonwealth toward improvement.
• Vendors must meet all contractual requirements throughout the life of the contract, including requirements for timely and accurate report submission, to remain in good standing under the contract.
  

For general procurement guidelines and best practices, follow these recommendations:

• Buyers should inform vendors to reference Statewide Contract ITS78 on all quotes and invoices.
• No prepayment should be made for products not yet delivered or services not yet rendered.
• No sales tax should be applied to invoices.
• No fees or surcharges (including travel, fuel, delivery) should be applied to invoices.
• Special order fees must be agreed upon by both parties upfront.
• Payments for products or services provided must be paid within 45 days per Massachusetts Bill Payment Policy, or sooner if applying Prompt Payment Discount.
• Buyers are not required to sign additional agreements with vendors that conflict with the Request for Response (RFR) Terms and Conditions. Contact the Category Manager(s) (Kerri Quinn or Joshua Flanagan-Lanier) for guidance. 
• Vendors must notify buyers of product substitutions.

When placing orders with a vendor, MOSAIC users must reference the contract ID number ITS78* in the Agreement ID field in MOSAIC for encumbrances related to purchases from Statewide Contracts. Please address all inquiries regarding MOSAIC technical support and job aids by emailing the Comptroller Help Desk or by calling 617-973-2468. 

*The asterisk is required when referencing the contract in the Massachusetts Management Accounting Reporting System (MOSAIC).