addendum no. 4 - metropolitan transportation authorityweb.mta.info/bandt/procure/15-rm-2949 -...

NYCSC System RFP 15-RM-2949

October 6, 2017 Page 1 of 71 Addendum 4

Bridges and Tunnels

Addendum No. 4

October 6, 2017

NYCSC System Request for Proposals (RFP)

15-RM-2949

Prospective Respondents: You are hereby notified of the following information in regard to the referenced RFP:

Part A - Official log of Proposers’ questions and the Authorities’ responses, including: Part B - Official revisions to the NYCSC System RFP

All other terms, conditions and requirements of the original RFP dated June 29, 2017 remain unchanged unless modified by this addendum, or previous addenda to this RFP.

A. QUESTIONS AND ANSWERS

This Addendum 4 includes responses to all questions submitted on or before September 8, 2017 in response to the above referenced RFP, excluding responses to requests for terms and conditions exceptions. Responses to terms and conditions exception requests will be provided in a subsequent addendum. All of the questions have been listed in the order received by TBTA. Please note that responses to questions included in previously issued addenda are provided in Part A below, and are shown in grey shaded text. Addendum 4 responses begin with question 77.



Request for Clarification or Modification (Questions)

NYCSC System RFP

Part A: Response to Questions (Form A-2) # Page Section Section Description Proposer Question Authority Response

Addendum 1 Questions and Responses-Previously Issued

General Whether companies from Outside USA can apply for this? (like, from India or Canada)

Proposers are not restricted to U.S. based companies; however, there are location requirements in the RFP Sections 1 and 3 that must be adhered to. For example, please refer to Section 1, 1.12.3 Location Considerations and to Section 3, 1.1 Environments.

General Whether we need to come over there for meetings?

A Contractor presence is required at meetings during the Implementation and Maintenance Phases. Please refer to Section 3 for descriptions of required meetings. Also refer to Table 1-4 in Section 1 for identification of which Key Personnel must be located 100% on-site.

General Can we perform the tasks (related to RFP) outside USA? (like, from India or Canada)

Please refer to Section 1, 1.12.3 Locations Considerations for restrictions on work locations.

General Can we submit the proposals via email? No. Proposals must be submitted in accordance

with the requirements of Section 1, 1.14 Technical Proposal Instructions.

General Do you have an estimated release date for the NYCSC Operations RFP?

The NYCSC Operations RFP is currently planned for release on or about the week of August 21, 2017. In order to give Proposers sufficient time to review the Operations RFP, the Procurement Schedule is being revised as shown in Part B, Addendum.

General The Triborough Bridge and Tunnel Authority’s RFP # 15-RM-2949 makes mention of an Operator’s Proposal, RFP # PSC-15-2982. How

The document will be accessed in the same manner as the NYCSC Systems RFP was accessed. Also, refer to response to question 5.




NYCSC System RFP


can I access this document to ensure we are responding the appropriate bid?

General This Request for Proposal (RFP) is being issued to select a contractor (“Contractor” or “System Contractor”) to design, develop, implement and maintain the System for NYCSC operations beyond the current contract expiration. Operations services are not covered under this RFP. A separate RFP (PSC-15-2982) is being issued to select a contractor to provide customer service operations that will use the System selected under this RFP. It is recommended that prospective Proposers for this RFP also review the NYCSC Operations RFP. Prospective Proposers are also advised to review Figure 1-1 Major Functional Responsibilities by Project Areas and Appendix I, Project Responsibility Matrix to understand the division of responsibilities between the System Contractor, the Operations Contractor, and the Authorities. The separate RFP to provide for customer service Operations is expected to be

In review of the RFP (15-RM-2949) – can you share any information on timing related to the separate RFP (PSC-15-2982)? Any insight that can be shared would be appreciated.

Refer to the response to Question 5.




NYCSC System RFP


issued in the same approximate time period as this RFP. The selected Proposer from the Operations RFP will use the System selected as a result of this RFP. The Authorities anticipate but do not guarantee that the Operations Contractor will be selected shortly after the selection of the System Contractor. The two contractors will interface and coordinate in an efficient manner in the planning, transition, System Implementation and Operations of the NYCSC.

General I wanted to know if there is a chance for this site seeing tour could be postponed for July 30th or will there be a second one scheduled or simply videos or photos? I am traveling and coming back to the states on July 29th. This trip was scheduled by accident.

There are no more site visits scheduled for this RFP.

We are unable to locate the Excel files for Forms A-8 (Requirements Conformance Matrix) and A-9 (Price Proposal). Did we miss something when we received the RFP from your office? Or will these be issued separately?

These forms are paper-clipped to the RFP PDF.




NYCSC System RFP


General Can you please let me know if you can supply us with the Requirements Conformance Matrix as Form A-8 in an Excel format as well as Excel version of Form A-9. And if you can’t, can you please let me know who I should contact.


General Can you please share with us the plan holder’s list/sign in sheet for the NY Tolling Authority Customer Service Center System. We are interested as participating as an MWBE Subcontractor.

The link to the plan holder’s list: http://web.mta.info/bandt/procure/rfppage.html. The sign-in sheet is included in Part B of this Addendum 1.

General Also, as an MWBE and DBE can the fee for receiving the RFP be waived?

No. The fee cannot be waived.

General We are a NYC/NYS MWBE firm seeking to subcontract with your primes. Can you provide me a list of primes in attendance so that I may reach out to them? If you require further information about my firm, I’d readily supply it.


http://web.mta.info/bandt/procure/rfppage.htmlhttp://web.mta.info/bandt/procure/rfppage.html




NYCSC System RFP


General In addition, do you have any information concerning the MTA’s Small Business Development Program? We provide IT Services – I’m unsure if the Program is geared for construction firms only. Any insight into the program would be great.

Please refer to the following website: http://web.mta.info/mta/procurement/doingbusiness.htm

Section 1 Page 11 (PDF page 22)

1.7.2 Key Team Personnel Qualifications

For Security Manager, it states:” International Information Systems Security Certification Consortium (ISC)² certification or similar” Will NYCSC accept PCI SSC ISA certification (Payment Card Industry Security Standard Council Internal Security Assessor) as an alternate to the “ISC certification”?

Yes, we would consider that as an acceptable, similar certification. The type and number of certifications will be considered in the evaluation.


Section 1 Background, Overview & Proposal Instructions 1.14.2.4.2

Proposal Part 2: Demonstrated Project Experience and Qualifications, e)

This section indicates that Proposers must submit a completed performance and payment bond (Form A-11 or substantial equivalent) with their technical proposal. Performance and payment bonds cannot be executed for a contract that has not been awarded. Is the Agencies’ intent for proposers to submit a surety letter/consent and/or bid bond? If the latter, for what amount?

Proposers may submit a commitment letter from the surety that certifying that should Proposer be awarded the Contract the surety commits to providing a performance and payment bond substantially in the form provided in Form A-11. The RFP will be modified. See Part B, Addendum.




NYCSC System RFP





Proposer (and its surety) respectfully submits the annexed bond form for consideration -- to be used in lieu of Form A-11, which only gives the option to complete the contract. Will this form be considered an acceptable equivalent?

TRV PP Bond multiple year.pdf

This is a request for a terms and conditions exception. We will respond to this question as a part of the Exceptions response per Section 1,1.8.3 of the RFP. Please separately send your request for exceptions in the future in accordance with the instructions therein.




Proposer respectfully requests clarification on how bonding will work, as the RFP indicates that there will be multiple contracts with the various agencies involved. Would there be a single bond with multiple obligees, or multiple bonds (i.e. one with each respective agency)?

A single bond with the three Authorities that covers the full obligation is sufficient.

Section 3 Req Vol I Page 8 (PDF page 103)

1.1.9 Req #58

Hardware, Software and Other Equipment

In order to eliminate the advantage the incumbent currently has with regards to equipment/hardware, can the Authority clarify if this requirement means that no vendor can propose existing/used equipment/hardware to satisfy the requirements of the RFP?

The requirement for new Equipment is clearly stated and reuse of existing equipment will not be considered in the Proposal evaluation.




NYCSC System RFP


Section 3 Req Vol I Page 7 PDF page 102 of RFP

1.1.8 Req #48

The Contractor shall provide the capability for outbound/inbound email and SMS text messaging that meet the outbound/inbound correspondence Requirements.

What is the current volume of SMS texts per year? Is this volume expected to grow each year? Can the Authority provide samples of the text messages currently being sent?

Current volumes and expected growth of SMS are not available. Please refer to requirements for text messaging, including Requirement 1023 and Section 3, 1.1.8. Current text messages being sent are not indicative of anticipated future use with the new system.

Sec 3 Req Vol I Page 13 (PDF page 108 )

1.1.13 Req #96

The OCR system shall interface with the TBTA toll lane system in that it will receive image files from the lane system and shall transmit back to the toll lane system OCR processed image files.

In order to size the system properly, can authority provide historical traffic volume of images sent to Back Office System?

The annual volumes are as follows but are these volumes are current (unless otherwise noted) and are subject to change in the future and should not be considered a projection: • TBTA: upon completion of transition to

cashless tolling (2017): • 140 million video/violation images

annually (70 million video/violation transactions)

• 14 million class mismatch images annually (7 million class mismatch transactions)

• 1.7 million VODS images annually (850,000 VODS transactions, not OCRed)

• PANYNJ: • 5.3 million images annually

• NYSTA: • 74 million images annually (2020)

Section 3 Req Vol I Page 32 (PDF page

1.5.12 Interface to Tokenized Merchant Service Provider(s)

Please provide details on what services are being provided by the “Tokenized Merchant Provider”. Clarify if there is more than one (1)

There is only one Tokenized Merchant Provider. Tokenized Merchant Provider is a merchant services provider who has the ability to tokenize credit/debit card numbers so the actual




NYCSC System RFP


127) provider. Please provide the “Tokenized Merchant Provider” name(s) and contact information.

credit/debit card number is not captured, stored or transmitted at any point or time in the System. Chase Paymentech is the Authorities’ Tokenized Merchant Service Provider. The contact person is:

Matthew P. Leman Executive Director J.P. Morgan / Merchant Services Naperville, IL 60540 T: 630 689 1632

E: [email protected] Proposers are advised that they can inquire generally about the tokenization process and services but no confidential Authority information will be provided.

Section 3 Req Vol I Page 45 (PDF page 140 )

2.1 Req #302

The Contractor shall provide the capability to create and maintain Accounts via methods, including but not limited to: ∙ Self-Service Website; ∙ Self-Service Mobile Application (Account Maintenance only); ∙ Self-Service Mobile Website;

Can authority provide expected traffic volume (number of user visits per day) for the following? ∙ Self-Service Website; ∙ Self-Service Mobile Application; ∙ Self-Service Mobile Website;

Refer to various Web volumes provided in Appendix A for historical information. The Authorities cannot predict future volumes, including expected volumes for a mobile application or a mobile website which do not exist in the current system.

mailto:[email protected]




NYCSC System RFP


Sec 3 Req Vol I Page 97 (PDF page 192)

3.8 Req #669

The System shall accept and process a Configurable number of rear images (up to twelve (12)) and front images (up to twelve (12)) per transaction depending on the source of the images, in accordance with the Approved ICD

In order to size the system properly, can the Authority provide total images sent from the lane systems to the back office? Can authority provide traffic volume data for TBTA, PANYNJ and NYSTA? Can the Authority also provide the number of electronic tolling lanes by Authority Can the Authority provide the size of the images coming from each lane system?

1. Refer to the response to Question 21 for volumes of images sent to the back-office.

2. All volumes provided are subject to change in

the future and are not projections.

Traffic volumes are published on the Authority Web-sites as follows:

• TBTA:

http://web.mta.info/mta/news/books/

http://web.mta.info/mta/news/books/pdf/170724_1200_B&T.pdf

• PANYNJ: • http://www.panynj.gov/bridges-

tunnels/statistics.html

• NYSTA: http://www.thruway.ny.gov/about/financial/monthly/index.html

3. Number of electronic tolling lanes (some

lanes are mixed mode and also take cash): • TBTA: 63 lanes (cashless) • PANYNJ: 69 lanes • NYSTA: 400 lanes

4. Current image sizes/ ranges are as follows;

however, these sizes/ranges are subject to

http://web.mta.info/mta/news/books/http://web.mta.info/mta/news/books/http://web.mta.info/mta/news/books/pdf/170724_1200_B&T.pdfhttp://web.mta.info/mta/news/books/pdf/170724_1200_B&T.pdfhttp://www.panynj.gov/bridges-tunnels/statistics.htmlhttp://www.panynj.gov/bridges-tunnels/statistics.htmlhttp://www.thruway.ny.gov/about/financial/monthly/index.htmlhttp://www.thruway.ny.gov/about/financial/monthly/index.html




NYCSC System RFP


change in the future: o TBTA:

o video/violation/class mismatch= 300kb

o VODS images =150kb o PANYNJ:

o Legacy lanes Image size = approx. 175k

o SI Lanes Nighttime Image Size = approx. 230k SI Lanes Daytime Image Size = approx. 920k.

o NYSTA: o 300 KB

Sec 3 Req Vol II Page 16 PDF page 486

1.3.1 Req #2288

1.3.1 Contractor Developed Documentation The Contractor shall utilize acceptable standards Approved by the Authorities, when updating Documents and submitting revisions.

Please specify the acceptable standards.

These standards for revisions and updates will be developed in the Project Management Plan by the Contractor and Approved by the Authorities per Requirement 2208. See Section 3, Volume II, 1.1.1.

Sec 3 Req Vol II Page 61 (PDF page 511)

4.2 Req #2486

The data migration strategy shall include all current and historical information for E-ZPass, all toll Bills and all Violation Notices.

As part of data migration, how many months of historical data is expected to be migrated from existing system to new system? As part of data migration, how many months of historical violation images are expected to be migrated from existing system to new system?

Refer to Appendix B for requirements. Please see Part B of this Addendum for the revised Appendix B based on recent policy changes.




NYCSC System RFP


Sec 3 Req Vol II Page 76 (PDF page 526)

6.1.3 Req #2572

NYCSC Hardware and Software Maintenance

For Item 2572, during maintenance, if the Authorities’ bank lockbox check scanner needs to be replaced, is the Contractor responsible for the cost of the scanner? If so, what is the cost? Where are the scanners located and how many must be maintained?

The bank will specify the check scanner and the Contractor will be required to provide and maintain in accordance with Requirement 71. This includes providing the scanner(s) at the System Contractor provided Lockbox and at least one scanner at the CSC facility for the Operations Contractor to process any check payments that are sent to the CSC. See Part B of this addendum that clarifies Requirement # 2572.

Appendix B PDF page 572

Appendix B Violations: Open Violation Transaction Images Until Purged by the Authorities

Can authority provide historical purge policy? Can Authority provide historical data of percentage of violation transactions?

Refer to response to Question 26 and the updated Appendix B for your first question. Quantities of Violations Notices are provided in RFP Appendix A. Refer to response to Question 26 for retention requirements.

Tab 3-2 Per Item Volumes PDF page 1636

NYCSC Sys RFP Form A-9 Price Proposal-Pricing Sheets 6-29-17

Pricing Sheets Please provide the examples referred in cells A-4 and A-9 of pricing tab 3-2 (per item volumes).

The references to examples on A4 and A9 were incorrect. Examples are not available.

N/A Section 4, Terms and Conditions, Chapter 11.02

N/A There will be no SDVOB goals for this project. See Part B of this addendum, for the modification to Section 4, Terms and Conditions; however, Proposers shall adhere to the requirements provided in Participation Opportunities for New York State Certified Service-Disabled Veteran-Owned Businesses,




NYCSC System RFP


which is included in the Addendum.

Addendum 2 Questions and Responses-Previously Issued

33 of 48 Section 1 1.14.2.4.5 Item x

Proposal Part 5: Approach to System Requirements Postage Rate Discounts

Please provide the average number of mailings per zip code per day.

This information is not available.

100 of 350 Section 3 Volume I 3.12

License Plate Processing Please provide a list of states whose plates are expected to be the most commonly occurring (above 1% to 2% of the traffic flow) in the traffic stream?

The following are the most common plates for TBTA: in alphabetical order: Connecticut Florida Maryland Massachusetts New Jersey New York North Carolina Pennsylvania Texas Virginia.

100 of 350 Section 3 Volume 1 3.12

License Plate Processing Please provide the camera(s) make and model numbers that will be generating the transaction imagery?

The following cameras are expected to be in place during the Contract term: • TBTA:

o TransCore VCARS units • PANYNJ:

o Kapsch VRX-3400-LPI front plate cameras (infra-red)

o Kapsch VRX-3400-LPW rear plate cameras (white light)

• NYSTA: o ORT – JAI Pulnix 200 o AET – Kapsch VRX2 (Tappan Zee Bridge) o Traditional E-ZPass Lanes – Bosch LTC

630 day/night




NYCSC System RFP


o Traditional E-ZPass Lanes – Bosch Dinion 5000 or Pulnix 200 (a few)

101 of 350 Section 3 Volume 1 3.12.2

Truthing and Automation Expiration Duration

Please confirm that the Contractor is not required to perform the manual image review for the truthing process.

That is correct. Contractor will not be required to provide image review for truthing.

96 of 112 Section 3 Volume II 7. 3

Table 7-1: System Performance Measures Functional - License Plate Extraction

Please provide the license plate extraction accuracy target required for the OCR/VSR processing.

Refer to Section 7.8.3 License Plate Extraction for extraction accuracy requirements.

65 of 112 Section 3 Volume II

Part 5 NYCSC Training Requirements

Can the Authority clarify if Contractor has to provide training to all Operations Contractors employees (including CSR’s) or just provide train the trainer training. Item 2511 training for Operations Contractor personnel and Item 2533 “Train the Trainer “ seem to be in conflict.

The intent is for” train the trainer” to cover CSR training, while all other classes are to be provided directly to the Authorities and the Operations Contractor staff as specified in Requirements 2517 through 2519.

3-2, 3-3 Section 7 A-9

Price Proposal Pricing Sheets In order to provide the most competitive price, can the Agencies provide the current volumes experienced today on an updated pricing sheets? This would eliminate the advantage any vendor would have if they were privy to actual volumes and used those numbers to reduce their unit price while other vendors would be forced to price based on the volumes on the current pricing sheets.

Please refer to the Price Proposal Sheets and the Price Proposal Instructions. The Price Proposal Sheets were designed to avoid an advantage to any proposer, while acknowledging that current volumes are subject to change due to AET and other factors. Therefore, the Contractor is to be paid based on actual volumes, using pricing tiers and unit pricing that it has provided. Further, evaluation quantities are set up and shown in the pricing sheets to provide a transparent process for evaluation so current volumes are not a factor in the evaluation.

443-447 Section 7, Form B-5

Prime vs. MBE/WBE Forms Please confirm that the Equal Employment Opportunity Report, included in Section 7- Forms pages 443-447, should only be completed by the Prime Contractor.

This is correct. This form should be completed only by the Proposer, not Subcontractors.




NYCSC System RFP


39 of 48 Section 1 1.14.3 Technical Proposal Appendices

Proposal Appendix 3: Copies of the Proposer’s certified audited financial statements for the past two years preceding Proposal submission.

Given the length of our audited financial statements (more than 200 pages), can Bidders provide these documents in electronic format only?

One original hard copy may be provided, with all other copies electronic. In addition, please refer to addendum item in Part B. Three years of audited financial statements are now required.

20 of 48 Section 1 1.14.1 General Instructions

Type size shall not be less than 11-point font.

May Bidders use a smaller, still readable font for the following: headers and footers, requirement text, exhibits, and tables?

Headers and footers may be in a 9-point font. Tables shall be in an 11-point font. We are not aware of any exhibits to be included in the Proposal and we are not sure what “requirement text” refers to; however, the conformance matrix text where Proposers are instructed to enter responses may be in 10-point font.


Type size shall not be less than 11-point font.

Several requested documents/samples do not comply with font restrictions and they are not available in a native MS Office format for font adjustments. Please confirm that it is permissible to submit those documents as is.

For documents that are being submitted in an existing form, such as requested appendices, sample reports, or supporting diagrams, the existing font is satisfactory if it is legible. To the extent required, organization charts may use 10-point font. However, Proposers are advised not to include text for responses that should be included within the page limits in these supporting documents.


The Proposal should be indexed and all pages sequentially numbered.

Can Bidders number the pages by major section (i.e., A-1, B-1)?

Yes, pages may be numbered by section; however, page limits still apply.


The Proposal should be indexed and all pages sequentially numbered.

Can Bidders exclude signed forms, attachments, tables of content, etc. from the sequential numbering requirement?

Proposers should separately paginate table of contents per writing style norms (e.g., i of iv). Forms do not need to have pagination, other than what is already provided in the case of TBTA supplied forms. Proposer developed forms should be properly numbered within the form, e.g. 1 of 2, 2 of 2. Attachments, wherever possible should be clearly numbered within the Attachments for ease of review.




NYCSC System RFP


21 of 48 Section 1 1.14.2 Technical Proposal Contents

Proposal Part 8: Completed Forms

Can the Agency provide required forms in a fillable PDF or Word format if available?

Forms cannot be provided in these formats.

6-7 RFP Cover Pages

Use of Service-Disabled Veteran-Owned Business Enterprises In Contract Performance

Pages 6-7 prior to Section 1 of the RFP includes a form titled “Use of Service-Disabled Veteran-Owned Business Enterprises In Contract Performance.” This form is not included in Proposal Part 8: Completed Forms. Should it be included in the proposal submission, and if so, where should it be located?

Yes. This form should be included. Please provide the form in the front of your proposal submission, before the title page.

9 of 112 Section 3, Vol II, Implementation, Training, Maintenance and performance requirements. Section 1.1.8 Req 2236 Section 7 forms.

The Contractor shall provide and maintain a detailed Project Implementation Schedule for the Project in Microsoft Project format (Project 2014 or above and include backward compatibility with earlier versions as required by the Authorities)

Please confirm that this requirement should be for MS Project 2013 as there is not a Project 2014 version.

The correct version is 2013. See Part B for the addendum item.

9 of 112 Section 3, Vol II, Implementation, Training, Maintenance and performance requirements.

Section 3, Vol II Requirement: The Project Implementation Schedule shall be submitted no more than thirty (30) Calendar Days after NTP… Section 4, Chapter 2, Article 2.11 Requirement: f) Within

The two requirements provide conflicting information for when the Project Implementation Schedule should be submitted with regard to Notice to Proceed. Please confirm which requirement is correct.

Section 4 will be changed to reflect the thirty (30) day period for submission of the schedule after NTP. See Part B for the addendum item.




NYCSC System RFP


Section 1.1.8 Req 2237 Section 7 forms. Section 4, Terms and Conditions, Chapter 2, Article 2.11 Schedule and Submittals, bullet point f);

ten (10) days of the Notice to Proceed Contractor shall submit a baseline Project Implementation Schedule…

Section 1 Page 9 of 48; Forms Section 7 A-4; Section 7, Forms A-9 Price Sheet 3-1 Fee Volumes

Section 1.7.1 Minimum Qualifications; Form A-4 Proposer Company Reference Forms; Price Sheets

Table 1-3: Minimum Qualification Requirement Volumes are: Customer Accounts: 500,000 Annual Transactions: 75 million The reference form says: Description of project functions and operations including size (minimum 4,5 million full-service customer accounts and 1 billion annual transactions): The price sheets refers to Volumes as stated in Fee Volumes Tab 3-1 of Pricing Sheets.

Please clarify or confirm that the minimum requirements for this project should conform to those listed in the reference forms in A-4 (4.5 million full-service customer accounts and 1 billion annual transactions) rather than those listed in Table 1-3. This is also consistent with the monthly transaction volumes reflected in the pricing sheets which range from 97 million per month in Year 1 to 178 million per month in Year 11.

The minimum qualifications stated in Table 1-3 are correct. The minimum qualifications in the Company Reference Form A-4 will be changed to be consistent with Section 1.7.1 This item will be clarified in an Addendum item in Part B.

Forms A-4

Section 7 Form A-4

Description of project functions and operations

Please confirm that the “4,5 million” listed on the form should read “4.5

See response to question 47.




NYCSC System RFP


Proposer Company Reference Forms

including size (minimum 4,5 million full-service customer accounts and 1 billion annual transactions):

million” or clarify the correct number of minimum customer accounts.

276 of 48 Section 1 1.14.2.4.4 n) iii)

The Proposer’s approach to providing work space for Operations staff, ensuring continuity of customer service in Disaster Recovery situations

This statement conflicts with the responsibilities defined in Appendix I – Responsibility Matrix, wherein the Operations Contractor is responsible for selecting the locations of primary and alternate Customer Service Center sites. Please clarify that this requirement is outside the scope of this project.

The referenced question will be modified to refer to the disaster recovery data center and not the work space for the Operations Staff. Refer to Part B for the Addendum item.

9 of 48 Section 1 1.7.2

Where applicable, the on-site requirement means that this position is required to be in the office established by the Contractor for this Project

Please confirm our interpretation of “on-site” being equivalent to the primary location where the job function is performed.

Please refer to the language in 1.7.2, which also directs Proposers to Section 3, Volume II. For additional information on these requirements, please refer to Section 3, Volume II Section 1.1.2 for the Implementation Phase and Section 6.1.1 for the Maintenance Phase. Applicable Key Personnel and certain other personnel must meet the on-site requirements detailed in those sections.

2 of 350 Section 3 NYCSC System Requirements Volume I Section 1.1 Req 2

All production servers and Systems shall be located in the primary data center, DR Sites and the Operations Contractor selected Customer Service Center (CSC) Site, unless Approved by the Authorities. CSC supporting customer contact systems shall be located at the CSC location to provide for call handling and other forms of customer contact should connectivity to the System be

As Cloud-based solutions can reduce cost, support readily scalable large systems, enable greater flexibility and security, while also enhancing the ability to support future migration, please confirm that a Proposers’ bid would be compliant if the primary plan for the data hosting, customer relationship management, and other key functions was built upon a Cloud solution.

A cloud based solution is not prohibited; however, the System must meet the requirements established in Section 3, Volume 1, Requirement 4 and those elsewhere in the RFP, including Section 1.3 Cyber Security and Appendix J Port Authority Security Policies and Standards.




NYCSC System RFP


lost.

101 of 112 Section 3 NYCSC System Requirements Volume II – Section 7.4

Event-based measurements may have multiple adjustment amounts for the same event.

Proposer requests that Requirement Number 2671, bullet 2, be removed as it is already included in Requirement 2673, bullet 2.

There is no duplication of the requirements. 2671 bullet 2 refers to critical customer service facing systems, while 2673 refers to all systems that support the Operations Contractor “excluding critical customer service facing systems.”

32 of 48 Section 1 1.14.2.4.5, item 5.t

Requirement ends with “Also discuss the following:”

Please clarify if additional requirements should be addressed in this section.

The reference made is to the following sub-section u). Please discuss the” following items” in section u).

7 of 350 Section 3 Volume I 1.1.8. Email and Text Messaging

The Contractor will provide all systems; communications; Hardware, and Software required to provide for email and SMS text messaging.

Please direct bidders where to include the cost of sending Email /SMS Text communications. There are no line items on the pricing sheets for these categories.

The cost for sending of email/SMS text should be included in the Monthly Fee in Sheet 3-1 Fee Volumes. There is not a separate payment made for sending of individual emails and text messages.

N/A N/A N/A Since the Authorities are planning to add additional AET facilities in the near future, please provide projected volumes for transactions, mail, correspondence and payments associated with this.

Please refer to Appendix A for current information on these items. The Authorities will not provide projections on these items.

Tab 3-2 Per Item Volumes

Section 7 A-9 Price Forms

Printing, paper What type of paper stock is to be used (i.e. 20lb, 24lb, etc.). Is this same paper stock to be used for all mailings (notifications, inserts, flyers, etc.)? If not, please specify for each.

All mailings shall use 24-pound paper.



Printing, post card What type of card stock is to be used for the post card (i.e. 24lb, 30lb, etc.)? What size shall the post card be (3” x 5”, 4” x 6”).

All mailed post cards shall be .016” card stock. Post card size shall be 4.25” by 5.5”.



Printing, stuffer. “Envelope size”.

Please provide the exact size of the non-Authority provided stuffer (i.e. 8.5” x 3.66”, 1/3 of an 8.5” x 11 piece of paper).

The size to be assumed is one-third of an 8.5” x11” piece of paper.




NYCSC System RFP




Printing, flyer. Please confirm that the non-Authority provided flyer shall be a single 8.5” x 11” piece of paper. If not, please provide the number of sheets of paper in a flyer.

The size to be assumed is an 8.5” x11” piece of paper.



Return envelopes. For return envelopes, do the Authorities desire window envelopes where the mailing address will show through, or is return address printing required for the return envelopes?

Return address is to be printed on the return envelope.



Color printing. How many unique colors are required for each of the items denoted as color printing (i.e. return envelope, logo on notification, stuffer, flyer, post card)?

Proposers shall assume two colors.



Postage Pass Thru Please confirm whether or not postage-related costs (i.e. National Change of Address, Zip pre-sort, etc.) are eligible to be treated as pass through costs.

No, these costs are not eligible for pass-through and should be included in the per item pricing on Sheet 3-2 Per Item Pricing.

Tab 3-3 ROV Lookup rates


Blended ROV (Registered Owner of Vehicle Lookups)

Would the Authorities consider making the cost of ROV lookups a pass-through? Reasons: 1) It is not possible to predict what each state will charge for ROV for the 11 years requested on the Price Forms. 2) The Authorities may add or drop existing agreements where the current cost is $0.00 that would impact the requested blended rate. 3) There are several states that currently do not provide ROV information for standard toll invoicing (AET) purposes but violation invoicing only.

Yes, Proposers shall assume that ROV lookups will be a pass-through cost. The price instructions and Price Proposal sheets will be modified to reflect this change. Please refer to Part B for Addendum item.




NYCSC System RFP


4) It is not possible to predict the successful lookups from each state to factor into a blended rate.

Tab 3-3 ROV Lookup rates


Blended ROV (Registered Owner of Vehicle Lookups)

If the Authority will not consider making the cost of ROV lookups a pass-through, would the Authorities please provide the following information: 1) list of current states that the Authorities have a no cost agreement with, and 2) the most recent percentage of successful lookups from each state that the Authorities currently requests ROV information from.

Refer to the response to question 63.

15 & 48 of 112

Section 3 Volume II Section 1.2.7 Software Walkthroughs and Section 2.2.1 Demonstration Testing

Req. 2278 “The Contractor shall conduct a series of Software walkthroughs and product demonstrations covering the full functionality of the Software to solicit input from the Authorities during the development of the NYCSC Software….” Req 2431 “The Contractor shall conduct demonstration testing …, including but not limited to: •…all major functional components of the System using a combination of any of the following: current production Software; Software that will be modified

Since both of these activities occur during the development phase, can the Authorities please confirm if the Software Walkthroughs and product demonstrations can be combined into one activity.

Yes, the Software Walkthroughs and product demonstrations may be combined.




NYCSC System RFP


to meet the Authorities’ Requirements…”

44 of 48

Section 1, 1.15 Price Proposal Instructions

CSC Clerk/Operational Support Seat Desktop Hardware. Role-based access to all required System functionality. One (1) workgroup printer for every 10 seats. One (1) dedicated printer for every 10 seats. One (1) barcode reader for every five (5) seats. One (1) dedicated scanner for every five (5) seats. One (1) dedicated transponder programmer/tester for every 10 seats.

Based upon the volume (200) provided on Price Form tab, 2-1 Imp Cost Sub to Adj Detail, please confirm, that the unit pricing for the CSC Clerk/Operational Support Seat, shall include 10 workgroup printers (200/10), 10 dedicated printers (200/10), 40 barcode readers (200/5), etc. based on the required ratio of seats to equipment.

These assumptions are correct based on the Price Proposal Instructions.

Tab 2-1, Imp Cost Sub to Adj Detail


Workgroup Printer What specifications are required for the workgroup printer? Color printing, duplex, throughput capability?

The workgroup printers shall be enterprise level printers. One (1) in ten (10) workgroup printers shall provide for color printing and duplex at 35 ppm or greater for single-side printing and 25 ppm or greater for duplex printing. Remaining workgroup printers shall be single-side, black and white at 35 ppm or greater. System Volume I, Requirement 71, bullet “workgroup printers” will be updated as follows: • workgroup printers shall meet or exceed the

following specifications: o enterprise class printers; o print single-sided, black and white at 35

ppm or greater, and




NYCSC System RFP


o one (1) in ten (10) workgroup printers shall print in color at 35 ppm or greater for single-side printing and 25 ppm or greater for duplex printing.

Please refer to Part B for Addendum item.



Dedicated Printer What specifications are required for the dedicated printer? Color printing, duplex, throughput capability?

The dedicated printers shall be black and white single sided and 25 ppm or greater. System Volume I, Requirement 71, bullet “dedicated printers” will be updated as follows: • dedicated printers shall be black and white

single sided and 25 ppm or greater;




Scanner What specifications are required for the scanner? Color scanning, duplex scanning, throughput capability?

The scanners shall be capable of color and duplex scanning at a rate up to 30 ppm or greater, multiple page feeder of 30 pages or greater and continuous scan mode for scanning unlimited pages into a single file. System Volume I, Requirement 71, bullet “scanners to convert hardcopy documents, photos, etc. into electronic form for storage and association to customer Accounts or Cases” will be updated as follows: • scanners to convert hardcopy documents,

photos, etc. into electronic form for storage and association to customer Accounts or Cases shall meet or exceed the following specifications: o perform color and duplex scanning at a rate

up to 30 ppm or greater. o provide multiple page feeder of 30 pages or

greater




NYCSC System RFP


o Provide continuous scan mode for scanning unlimited pages into a single file.




Bar Code Reader What specifications are required for the bar code reader? Field of scan size, DPI, power type (AC or thru connected computer), cord length?

The bar code and QR Code readers shall be capable of scanning the bar codes on all transponders, transponder packaging and any bar and QR code created by the system. The bar code scanners shall be powered through the workstation and the cord length shall be such that the operator is not restricted from scanning items within a six- foot radius of the workstation. System Volume I, Requirement 71, bullet “barcode and Quick Response (QR) Code readers“ will be updated as follows: • barcode and Quick Response (QR) Code readers

shall meet or exceed the following specifications: o reading the bar codes on all transponders o reading the bar codes on all inbound

transponder shipping boxes and manifests o reading the bar codes and QR codes on all

system created packaging o reading the bar codes and QR codes on all

system created notifications o bar and QR code scanners shall be

powered through the workstation and not require a separate power source

o the bar and QR code scanner cord length shall be such that the operator is not restricted from scanning items within a six (6) foot radius of the workstation.




NYCSC System RFP





Transponder Programmer/ Tester

Transponder Programmer/Testers are typically manufactured by the transponder providers; who may bid on this RFP. To level the playing field, would the Authority please consider directly providing the transponder programmer / testers? Or, making the transponder programmer / testers an unevaluated pass-thru cost?

No, the Contractor shall remain responsible for provision of the transponder programmer.

1 of 1 Section 6, Project Implementation Schedule

Project Schedule states that Go-Live is September 2020.

Can the Authorities please clarify the apparent conflict between the Go Live date of September 2020 in the RFP Project Schedule and the end date of the current contract which is October 2020?

For purposes of the Proposal, Proposers shall assume a Go-Live Date in September, with an end of contract date on the current contract of October 2020. There may be a small overlap in the two contracts.

Appendix A Appendix A Tag Inventory Statistics Proposers are advised that Total Tag Inventory includes Issuable Inventory and stragglers waiting to be processed plus tags that are being returned to the manufacturer for disposal or because they are defective. The Contractor must be able to have enough space to store Issuable Inventory (about 6 month’s inventory) plus stragglers plus tags awaiting return to manufacturer. The manufacturer will pick up tags for disposal only when the

Please confirm that NYCSC System proposers are not required to provide space for tag inventory storage and that it is instead the responsibility of the CSC/Ops selected provider.

This is correct. The Operations Contractor is required to provide space for transponder inventory.




NYCSC System RFP


quantity meets a certain level.

179 of 350 Section 3 Volume I Requirement 1197

The Contractor shall provide the capability to electronically receive and process correspondence received at the lockbox, for example changes of address.

Will all non-payment correspondence be directed to the contractor provided lockbox? When using the term “process correspondence”, do you mean that the contractor is responsible to receive, digitize and transmit the correspondence to the CSC/Ops provider for handling, research, account update and response to the customer or is that the contractor’s responsibility? If the latter, please provide the types and quantities expected to be received and processed by the contractor.

All non-payment correspondence should be sent to the Operations Contractor; however, for any non-payment correspondence received the Contractor Lockbox, Contractor will digitize it and forward it to the Operations Contractor. An additional line item will be added in the Pricing Sheets for non-payment correspondence processing by the Lockbox. Please refer to Part B for the Addendum item.

N/A Appendix A and Appendix C

Appendix A Background Data and Appendix C Existing Authority Discount and Special Account Plans

N/A Minor updates to the two appendices have been made and are included as part of the Addendum in Part B.

N/A Insurance Requirements TBTA Contract

Section 4, Terms and Conditions-Chapter 5

N/A TBTA has modified its insurance requirements, which are now included in Chapter 13. NYSTA and PANYNJ insurance requirements are unchanged and remain in Chapter 5 of Section 4, Terms and Conditions. Please refer to Part B for the Addendum item.

Addendum 4 Questions and Responses excluding Terms and Conditions Exceptions General If we are bringing a partner in to serve as

the Primary Contractor (with EPX as a subcontractor), would that Primary Contractor first have to register (purchase a CD-ROM etc) with the MTA?

Yes, only Proposers who purchase the RFP may submit a Proposal.

General So we can incorporate our partners If we understand your question correctly, a Proposer




NYCSC System RFP


solutions into our proposal and vice versa? As long as only one of us submits the RFP response, is that correct?

may submit a Proposal that has a single prime Contractor and incorporates Subcontractors, or is structured as a joint venture. The Proposal must meet the requirements of the RFP, including those with regard to Proposal structure and provision of Proposer information, including for Subcontractors.

General • What is the in-lane transaction counts ?

Please refer to the response to questions 21 and 55.

General Is the MTA simply looking for a front-end processor? We are a straight-through (front end, and back end settlement) payment processor and we automatically tokenize all transactions

Please review the RFP Section 1.3 for a summary description of the services that are being procured.

(262 of PDF) 167 of 350 180 of 350

Section 3 Volume I Section 5 Section 5.4

Section 5. Payment Processing (p262) 5.4. Credit Card Proc Processing (p275)

• Can we provide our own tokens?:

The Authorities have designated a Merchant Services provider that has a separate contract with TBTA. This contractor will provide tokens.

(Pg. 11310 of PDF) 3 of 123

Section 4, Chapter 2, Article 2.05

Harmony

Will the contract for the Operations Contractor mirror the contract for the Systems Contractor in regards to liability for losses, damages, etc. to the other party?

Please refer to the Operations RFP which was issued on August 25, 2017.

(Pg. 11310 of PDF) 3 of 123


Harmony Section 4, Article 2.05 states as follows: During the progress of the Implementation Phase and Maintenance Phase the Contractor shall be required to work cooperatively with other parties, including the Operations Contractor and other interfacing third-parties in order to perform its obligations under the Agreement. The following processes shall be in place at all times:

The paragraph further defines the emergency as “creating danger to life and property”. We believe that this is a sufficiently clear explanation.




NYCSC System RFP


… f) In the event of an emergency creating danger to life or property at the Site(s), the Authority may do anything necessary to alleviate such an emergency situation, including performing work at the Site(s), or directing another contractor to perform work at the Site(s). How is an “emergency” defined?

(Pg. 1145 of PDF) 18 of 123


Method and Times of Payment

Contractor is required to submit three separate invoices to each agency. How will submitted invoices be paid? Will it be three individual payments from each agency or one single payment from the Authority? If there is an issue with an individual invoice, does this issue hold up payment from the other two agencies?

There will be three separate payments based on three monthly invoices submitted to the Authorities. An issue with one invoice that is specific only to that Authority will not hold-up payment of invoices by the other Authorities.

(Pg. 1227 of PDF) 100 of 123 (Pg. 1248-1249 of PDF) 121 and 122 of 123

Section 4, Chapter 113, Appendix D Item H Section 4, Chapter 14 Article 14.17

MBE/WBE MTA allows 100% credit for MBE/WBE suppliers, while PANYNJ only allows 60% for MBE/WBE suppliers. How should total MBE/WBE credit for suppliers be calculated?

Proposers should refer to Section 1.14.2.8 for a description of how to divide the Project by the assumed Contract percent for each Authority and resulting Contract dollar value totals for each Authority. Once the Proposer has established the estimated total for each Authority, the Proposer should then apply the specific rules for MBE/WBE for the applicable Authority. In other words, there will be three separate totals for MBE/WBE compliance in the Proposal and not a single total for MBE/WBE compliance. The Authority specific guidelines for each Authority stated in Section 4, Chapters 11-13 will then apply.




NYCSC System RFP


(Pg.,1245-1246 of PDF) 118 of 123


Prevailing Wage There are multiple references to prevailing wage in the contract, but there is no schedule attached. Does prevailing wage apply to the scope of work of this project?

The authorities are governed by New York State Labor Law, Article 8 and Article 9. It is the Proposers’ responsibility to make determinations as to compliance.

Pg., 247 of 350 (Page 342 of PDF)

Section 3 Volume I Section: 10.2

Self Service Mobile Application (Optional)

Are bidders required to submit a price for the Self Service Mobile Application Option? If so, where in the Excel price file should a bidder enter the price for this option?

No, the Self Service Mobile Application functionality shall be provided as a part of the base Price Proposal and is not an option. The Requirements have been updated to show this as base functionality. Also, the dashboard for the TBTA OCR is not a separate option but shall be included as part of the OCR option. The Requirements have been clarified to show this. Please refer to Part B for the addendum items.

Pg. 152 of 350 (Page 247 of PDF) Volume 1

Section 3 Volume I Section: 4.1 Req #1007

The Contractor shall provide the capability to send fully created notification items for printing and distribution, for example, in Adobe PDF or XML format.

Does the Contractor need to provide MS Office and Adobe for managers, supervisors and CSR’s? If so, can the Authority provide quantities? Additionally, does the Contractor need to provide e-mail addresses for all Operations Contractor employees? If so, can the Authority provide the quantities?

The Contractor shall provide the following minimum capabilities:

• For all Supervisor/Manager seats: MS Word, MS Excel and MS PowerPoint

• For all CSR seats: MS Word or at a minimum, equivalent access and capability to edit all pre-developed correspondence templates for all channels, capability to create correspondence and reply to customers through all channels; advanced spell check and grammar check for all correspondence (including edits to templates and creation of original correspondence through all channels).

The price shall be included in the respective price per seat for these the Supervisor/Manager and CSRs. The quantities provided shall equal the assumed seat quantities for these positions in Form F-9 Price Proposal, Sheet 2-1 Back-Up Implementation Cost Subject to Adjustment.




NYCSC System RFP


The Contractor shall provide NYCSC email addresses for all seats and up to 20 additional email addresses for specific correspondence, and provide a logical scheme with differing domain names and addresses according to correspondence type and agency, for example: [email protected] [email protected] [email protected] Please refer to Part B for the Addendum items.

1 of 1 (Page 925 of PDF) Appendix F

Section 3 Appendices Appendix F Network Topology Diagram

Walk-in Center connectivity

The note at the bottom of this diagram states: Note: Unlike the current contract, walk-in center connectivity is not required as part of this procurement. However, in Section 3, Volume 1, subsection 1.1.11 Network requirement #82 last bullet states: all other connectivity required to implement and Maintain the System and perform the Work in all Project Phases. This seems to be contradictory to the note refereneced above on the Network Topology Diagram. Can the Authority clarify who is responsible for the network connectivity for the walk-in centers? Additionally, can the Authroity provide staffing headcount at each of the three walk-in locations including CSR’s, Supervisors and managers? Also, please

There are no walk- in centers for this project. We do not understand where the language is contradictory. There is no place in the requirements where walk-in centers are mentioned or required, (other than being included in Attachment A, for the current Operations, for completeness). The note in Appendix F was intended to indicate that the walk-in center connectivity required for the current network will not be required under this procurement.

mailto:[email protected]:[email protected]:[email protected]




NYCSC System RFP


confirm if the headcount provided in the pricing sheets already include the walk-in center staffing?

7 of 123 (Page 1134 of PDF) 9 of 112 (Page 459 of PDF)

Section 4 Terms & Conditions Section 3 System Requirements Volume II

Article 2.11 Schedule and Submittals 1.1.8. Project Implementation Schedule and CDRL Req #2237

Paragraph f) states “Within ten (10) days of the Notice to Proceed Contractor shall submit a baseline Project Implementation Schedule” Requirement 2237 states “2237 The Project Implementation Schedule shall be submitted no more than thirty (30) Calendar Days after NTP”

• The above requirements conflict.

Please clarify the Project Implementation Schedule deliverable due date.

Please refer to the response to question 46.

11 of 18 (Page 71 of PDF 7 of 18 (Page 67 of PDF) 90 of 112 (Page 540 of PDF) 54 of 112 (Page 504

Section 2 Definitions and Acronyms Section 2 Definitions and Acronyms Section 3 Volume II Section 3 Volume II

7.1. General Performance Requirements Req #2650 2.2.8. System Acceptance Testing Req #2447

The definition for System Acceptance states “Upon System Acceptance, the Maintenance Phase begins.” The definition for Maintenance Phase states “The Project Phase which begins at the earlier of Acceptance or sixty (60) days after Go-Live.” Requirement 2650 states “Maintenance invoice adjustments shall not begin until thirty (30) Days following Acceptance when the Maintenance Phase has commenced.”

All Maintenance payments shall begin at Go-Live. Maintenance invoice adjustments shall also begin upon Go-Live. The definitions for System Acceptance and Maintenance Phase will be updated accordingly. Please refer to Part B for the Addendum items. The Project Implementation Schedule reflects that first quarter is the period between January 1 and March 31, 2021, which would allow for System Acceptance to occur in this time period if Go-Live takes place in September 2020. The planned System Acceptance Testing period shown in the schedule includes the Post Go-Live Monitoring period. So, in terms of a planned minimum possible time period for Acceptance, Post-Go-Live monitoring would take place in September and October 2020; Acceptance




NYCSC System RFP


of PDF)

Requirement 2447 states “The earliest point at which System Acceptance testing can be Approved shall be five (5) months after System Go-Live (two (2) months for the Post Go-Live Monitoring and Tuning Period + two (2) months of System Acceptance testing + one (1) month for the Authorities to review and Approve the System Acceptance testing results).” Please clarify the start date of the Maintenance Phase, as System Acceptance (Q1 2021) is 3 months after Go Live (September 2020) based on the Section 6 Project Implementation Schedule.

testing would take place in November and December 2020, and then review and Approval of Acceptance Test would occur in January-February 2021. These dates are approximate, depending upon factors including when in the month Go-Live occurs and how well the System performs in operations monitoring and Acceptance Testing.

(Pages 1636-1642 of PDF) Sheets 3-2 and 3-3

Section 7 Form A-9 Price Proposal-Pricing Sheet

Based on NYCSC Authorities’ response to Question 2 above, please advise: Will payment for the maintenance unit price items (printing, lockbox, skip trace, ROV) begin at Go-Live? If not, where should the cost for these items be entered for the period between Go-Live and the start of the Maintenance Phase? If the cost is to be included in the implementation price will the Authority please provide the last 12 months of printing, lockbox, skip trace, and ROV data so that the cost can be accurately estimated?

See the response to Question 91. Payments for unit priced items will begin at Go-Live.

11 (Page 964

Section 3 Appendices

3.5 Non-Disclosure and Confidentiality Agreements

Cloud Service Provider (CSP) and its employees will not have direct access to

There is no change to Appendix J. The Authorities will evaluate which Contractor staff must sign NDAs




NYCSC System RFP


of PDF) Appendix J The Port Authority of New York and New Jersey Information Security Handbook

(NDAs) Employees, consultants, third-party contractors, tenants, or other individual or entities, including governmental agencies where appropriate, will be required to sign NDAs or an Acknowledgment of an existing NDA, or be subject to an NDI, as a condition of being granted access to Confidential Privileged Information and, where appropriate, Confidential Information. Employees, consultants, third-party contractors, or other agency personnel who refuse to sign a NDA, in situations where it is required, will be denied access to Confidential and/or Confidential Privileged Information, except in the case of certain Port Authority employees and third parties where a NDI may be utilized in instructing and advising the Port Authority employee and/or third party of the obligations and the requirements for handling Confidential Information. In certain circumstances, a Memorandum of Understanding or

Authorities' data. To protect against access through the application, CSP employees don't have access at the application level for any of its customers. CSP’s personnel, as a condition of their employment, are required to sign an NDA, that covers all customer data and any other information and documents supplied by the customer, not specifically the data belonging to a single tenant of the system. CSP can provide contractual assurance to its customers that the data hosted in the CSP Services will be kept confidential and not accessed by CSP employees except as necessary to provide the services. Permitted access to the production environment infrastructure is restricted to a very limited number of full-time CSP employees required to manage the service. These CSP employees do not have login access to customer's instances (org), and because of CSP's multi-tenant infrastructure, they do not see customer data in an assembled manner. In addition, the CSP end user licensing agreement includes a confidentiality clause. CSP will access the Authorities' org only with prior approval from the Authorities and subject to the confidentiality provisions of the licensing agreement. We believe that the confidentiality language that is incorporated as part of the overall cloud SaaS/PaaS subscription agreement

upon review of Contractor’s solution and staffing plan, prior to or upon Contract execution.




NYCSC System RFP


Memorandum of Agreement containing approved non-disclosure and confidentiality requirements may be utilized, in which cases approvals are required from the CISO and the General Counsel, or their respective designees. The DISO is responsible for determining whether a NDA/NDI is required as a condition to being granted access privileges to certain Protected Information, other than Confidential Privileged Information. If an individual refuses to execute an individual Acknowledgment, PA Employee NDA or to receive the NDI, if it is deem required by the DISO, CISO or OIG, access to the certain Protected Information must be denied. The SIM is also responsible for keeping proper documentation for employees and individuals subject to NDIs, including the date when the individual was given the NDI and by whom. A copy of all executed agreements and acknowledgements are to be provided to the PA DISO and Third Party SIM. Original

together with the restricted access to the data (except under narrow circumstances and with permission of the customer) and the confidentiality provisions signed by employees as a condition of their employment will meet this requirement. Our interpretation is that this applies only to the System Integration personnel (its employees and subcontractors) that will directly performing the solution implementation services for the Authorities, but not the Cloud Service Provider’s personnel. We request that the Authorities adjust this requirement accordingly.




NYCSC System RFP


executed NDAs shall be forwarded to the CISO, by the DISO, for filing in the official Port Authority records repository, with a copy to Law Department DISO.

132 (Page 965 of PDF)

Section 3 Appendices Appendix J The Port Authority of New York and New Jersey Information Security Handbook

3.8 Background Screening In order to determine if any individual poses a potential security threat to the Port Authority or its Facilities, the Port Authority requires background screening to verify the personal identity of, and determine the criminal history of, all contactors and consultants working in secure areas at Port Authority facilities or handling security related Protected Information. As such, employees of third party contractors/consultants requiring access to certain Protected Information relating to security on a specific project must obtain clearance through a background check prior to being provided access to information unless otherwise waived in writing by the CISO or OIG. This includes all individuals working on the

CSP is not providing assigned personnel to the Authorities' solution implementation project. All CSP employees are subject to a background check at time of hire. CSP engages the services of a background screening vendor to conduct background checks on employees at the time of hire in the U.S. The scope of these checks is subject to local laws in the jurisdictions in which the employee is hired and includes:- Address check: using the applicant’s social security, all residential addresses for the past 7 years are verified- Criminal background check: state, federal, and national searches are performed to identify felony and misdemeanor convictions within the last 7 years- Global sanctions and enforcement check- Federal debarment check- Healthcare sanctions check- Education verification- Employment history: queries up to three of the applicant’s most recent places of employment in the past 7 years CSP and its employees will not have direct access to the Authorities' data. To protect against access through the application, CSP employees don't have access at the

No change will be made to Appendix J, as the Authorities require a single Contractor that provides the solution implementation project.




NYCSC System RFP


project, including administrative and back-up staff that have access to and/or are handling Confidential or Confidential Privileged Information. All background checks for third parties required under the Policy should normally be conducted through the ―Secure Worker Access Consortium" (SWAC), which is presently the only Port Authority approved service provider of a background screening checks, except as otherwise required by federal law and or regulation. The Office of Emergency Management administers this provider. S.W.A.C. is accessed by an online application (http://www.secureworker.com) that enables the secure collection, processing, maintenance and real-time positive identity verification (PIV) of individuals. The S.W.A.C. background check is not a replacement for any federal agency (DHS, TSA, etc.) required background screening. S.W.A.C. membership is valid for three years, at the end of which the

application level for any of its customers. CSP can provide contractual assurance to its customers that the data hosted in the CSP Services will be kept confidential and not accessed by CSP employees except as necessary to provide the services. Permitted access to the production environment infrastructure is restricted to a very limited number of full-time CSP employees required to manage the service. These CSP employees do not have login access to customer's instances (org), and because of CSP’s multi-tenant infrastructure, they do not see customer data in an assembled manner. We believe this only applies to the project personnel that are performing the solution implementation services and not the Cloud Service Provider’s personnel that are hosting the solution. We request that the Authorities adjust this requirement accordingly.




NYCSC System RFP


member must renew the online application. In addition, certain employees, such as those in the Public Safety Department, will have their criminal history background checked through the electronic databases maintained by federal and/or state law enforcement agencies when required as a condition of employment, or when required by federal or state laws, rules, and/or regulations, or, in certain cases, where it is legally permitted and is deemed appropriate by the CSO or OIG. The DISO/SIM has authority to obtain the background check information from S.W.A.C. Additional information about S.W.A.C., corporate enrollment and online applications can be found at http://www.secureworker.com, or it may be contacted at (877) 522-7922.The S.W.A.C. application process is described in Appendix "E." In some cases TSA’s Transportation Workers Identifications Credentials (TWIC) or Security




NYCSC System RFP


Identification Display Area (SIDA) background screening and credential may be used in lieu of the SWAC process with approval by the DISO.

15 (Page 968 of PDF)

Section 3 Appendices Appendix J The Port Authority of New York and New Jersey Information Security Handbook

Section 3.11 Procurement Strategies ( c ) Risk Exposure and Business Risk Strategy (xii) Audit. Include provisions to allow the Port Authority to conduct audits for compliance with Protected Information procedures, protocols and practices, which may include, but not be limited to, verification of background check status, confirmation of completion of specified training, and/or a site visit to view material storage locations and protocols.

CSP does not typically offer a Right to Audit clause as part of the base service offering. CSP is a multi-tenant cloud service. Annual site visits can be negotiated, but in consideration of our other customers, random access cannot be permitted. As a multi-tenant service, compartmentalization is virtual, not physical. CSP contracts with third party auditors to inspect and review our security. The results of these audits can be provided to the Authorities as desired and under NDA.CSP has comprehensive privacy and security assessments and certifications performed by multiple third parties, including ISO 27001, SSAE 16 SOC 1, SOC 2, SOC 3, PCI-DSS, and FedRAMP. Third party auditors test the effectiveness of CSP's security controls as it relates to each of the compliance frameworks mentioned above. CSP provides contractual assurance to its customers that the Customer Data hosted in CSP’s services will be kept confidential. Therefore, please adjust this requirement to allow third-party audits to meet this requirement.

No change will be made to Appendix J.

31 (Page 984

Section 3 Appendices

CHAPTER 7 – INFORMATION SECURITY EDUCATION AND

We believe that this only applies to contractor personnel that are





NYCSC System RFP


of PDF) Appendix J The Port Authority of New York and New Jersey Information Security Handbook

AWARENESS TRAINING Section 7.1 Purpose Information Security Education and Awareness training ensures that all personnel requiring access to Protected Information, regardless of position or grade level, have an appropriate understanding of the need to adhere to security procedures in order to secure Protected Information. The goal of the training program is basically to provide that all such employees, consultants, third party contractors, other individuals, entities and/or, where appropriate, third parties develop essential security habits and thereby ensure that all personnel accessing Protected Information understand and carry out the proper handling protocols for those materials.

performing the solution implementation services and not CSP personnel that are hosting the solution. For example, CSP adheres to FedRAMP requirements without tenant specific training. CSP’s process requires employees to sign and acknowledge receipt of the Employee Handbook, the Code of Conduct, and the Employee Proprietary Information and Rights Agreement. Employees also take code of conduct and legal compliance training. Initial and annual Security Awareness Training includes security best practices, threat recognition, compliance and policy requirements, and reporting obligations. Follow-up security awareness training is presented to all personnel. We request that the Authorities adjust this requirement accordingly.

20 of 48 (Page 31 of PDF)

Section 1 – Background, Overview and Proposal Instructions Section 1.12.3

The Authorities require that all System infrastructure be dedicated to the NYCSC.

The CSP does not offer a dedicated infrastructure, but rather a multi-tenant architecture. CSP’s PaaS/SaaS multi-tenant architecture and secure logical controls address separation of customer data. CSP has configurable security features that allow customers to





NYCSC System RFP


Location Considerations

customize security based on the sensitivity of data customers store in the application consistent with the requirements in NIST SP 800-53 Rev. 4 for moderate impact systems. Our rationale is also in alignment with FedRAMP requirements using virtual isolation between related entities. We request that the Authorities adjust this requirement accordingly.


Section 3 Appendices Appendix J PANYNJ Cloud Computing Framework Item 12 Audit Control Requirements g Application Controls #4

Data should be stored in the database encrypted and blocked from user views in the application unless it is authorized.

We are proposing an encryption solution to meet the Authorities' encryption requirements. CSP's encryption solution allows the the Authorities to encrypt its own data in its designated environment. CSP is a multi-tenant cloud service, which means that multiple customers share a database. Therefore, whole database encryption is not supported however the Authorities can encrypt its own data stored in the database. CSP's encryption solution offers native platform encryption and key management features. The Authorities' data is encrypted at rest using a hardware security module-based key derivation system. These features allow the Authorities to protect data at a more granular level while still giving users the ability to perform necessary tasks. The Authorities can: - Encrypt files and attachments (including email attachments).- Encrypt certain standard and custom fields.- Encrypt Knowledge





NYCSC System RFP


article fields and attachments- Use an advanced key management system. CSP built a key management framework that scales to our multi-tenant model and gives the Authorities complete control over the key management lifecycle. Since the encryption service is built natively into the CSP's Platform, the encryption keys must reside in the CSP environment. Adhering to the principle that customers should have complete control over the key lifecycle, we built key management functionality into the Setup UI and API such that customers decide when to generate, rotate, import, export, and destroy keys. Customers also determine who is responsible for performing these tasks. As with all administration tasks, everything is audited. We request that the Authorities adjust this requirement accordingly.


Section 3 Appendices Appendix J PANYNJ Cloud Computing Framework Item 12 Audit Control Requirements j Contingency Planning, Disaster

Tape maintenance should include: a. Periodically testing integrity of tape

This requirement is not applicable to CSP's solution. The CSP backs up to raid-based systems (hard drives), as opposed to tape drives, which circumvents the need for explicit integrity testing of the backup media. The CSP also monitors for failed full/incremental backup jobs. We request that the Authorities adjust this re