RFQ 27-05307 for Project Health Assessments, Project Management and Strategic Consulting Services

The solicitation seeks bids from existing ITS81 vendors for Project Health Assessments, Project Management and Strategic Consulting Services, and Application Development Services under a state contract managed by the Executive Office of Technology Services and Security of Massachusetts. The work is to be performed primarily in Boston, MA, with all meetings and performance activities required on-site unless otherwise agreed. The contract is governed by a Statement of Work framework that establishes deliverables, task orders, and acceptance procedures tied to compliance with stringent data security standards, including IRS Publication 1075, FBI CJIS Security Policy v5.9.2, HIPAA, M.G.L. c. 66A and c. 93H, PCI, and EOTSS Enterprise Information Security Policies. Contractor personnel handling sensitive data such as Federal Tax Information, Protected Health Information, or Criminal Offender Record Information must undergo background checks, receive formal warnings about criminal liability for misuse, and adhere to strict access controls, including unique user IDs and immediate credential revocation upon changes. Subcontractors are fully bound by the same obligations as the prime contractor and require prior written approval for access to protected data, with the prime contractor maintaining full liability for all third-party compliance. The contract allows for amendments to address evolving regulatory requirements, and all data protection obligations survive termination until protected information is securely returned or destroyed. Evaluation of proposals will consider quality of product functionality, proposed approach, resource qualifications, understanding of engagement, and ability to meet timelines, with both technical merit and cost likely influencing award decisions, though specific weights or the exact basis of award are not defined. Invoices must be submitted electronically to ITDInvoices@mass.gov and accompanied by a signed Deliverable Acceptance Form, with no formal Contracting Officer’s Representative or Procurement Contracting Officer named—responsibility rests with Agency Project Managers. The solicitation requires responses via the COMMBUYS portal, with a deadline of July 20, 2026, and restricts submissions to 30 pages for the business and technical response, excluding resumes and technical diagrams. No contract value is specified, as pricing tables remain populated with placeholders, and while small business preference is noted for contracts under $250,000, there is no formal socioeconomic certification requirement included in the submission format. Compliance with federal and state data handling standards is non-negotiable and enforced with potential civil and criminal penalties, including fines up to $5,000 and imprisonment, for unauthorized disclosures.