– Federal Worker Loan Program – IT and Customer Support Services

The Maryland Department of Labor (MD Labor) is procuring services under a Software as a Service (SaaS) model from a Contractor.

This Request for Proposals (RFP) is issued to procure the goods or services, as specified in this Section 2, from a contract between the selected offeror(s) and the State of Maryland ("State"). This solicitation is being procured to build and maintain an individual management software solution to provide financial assistance to eligible current and former federal employees under the Protect Our Federal Workers Act of 2025 (the Act).

Because the Contractor will provide MD Labor with services under a SaaS model, MD Labor will work with the Contractor to configure and extend the Contractor's standard product features to meet MD Labor's emergency response needs. These configuration tasks are described in detail in this solicitation and the Scope of Work (SoW).

The Contractor is responsible for the acquisition and operation of all hardware, software and network support related to the services being provided.

• Cloud based applications shall be accessible from various client devices including through modern desktop and mobile Web browsers.
• The Contractor shall prepare releases and stage each release in the system testing environment for the State's validation.
• The Contractor may operate in the production environment in accordance with the State's Cybersecurity policies and best practices and upon authorization to operate (ATO) from the State.

Maintenance

Maintenance includes all changes, modifications, updates, patching, bug fixes, vulnerability fixes, and enhancements applicable to all system components licensed without further charge to the State under this contract.

Service Level Agreement

The Contractor shall maintain 99.9% uptime for all application system features, including reporting tools, used by MD Labor.

Response time for critical incidents (complete interruption of program application processing) shall be one (1) hour or less. Response time for non-critical incidents (disruptions contributing to delays in program application processing) shall be four (4) hours or less.

Backup

• Perform backups of the web, application, and data on a regular basis. This shall include daily incremental backups and full weekly backups of all end-user data;
• Retain daily backups for one (1) month and weekly backups shall be retained for two (2) years if not subject to other data retention and privacy constraints as outlined in the SOW or as directed by the State;

Disaster Recovery

The Contractor shall furnish a DR site. The DR site shall be at least 100 miles from the primary operations site, and have the capacity to take over complete production volume in case the primary site becomes unresponsive.

**Notice type:** RFP: Double Envelope Proposal

Any terms of use or other agreement applicable to the Bidder's/Offeror's proposed services must be contained in the Bidder's/Offeror's Technical Proposal.

The Contractor shall provide the Security Plan to the State for its review with solicitation response. [...] The Contractor shall maintain American Institute of Certified Professional Accountants (AICPA) SOC 2 Type 2 certification.

For every deliverable, the Contractor shall submit to the Contract Monitor, by email, an Agency Deliverable Product Acceptance Form (DPAF) or an email documenting submission and product acceptance or rejection.

The Contractor shall submit a proper invoice in accordance with the procedures in Section 3.3 of the RFP. The invoice must be accompanied by a copy of the executed DPAF or payment may be withheld.

A SOC 2 Type 2 Audit Report is required for this Contract.