High-Risk Solicitations and Contracts

In accordance with § 2.2-4303.01 of the Code of Virginia, the Office of the Attorney General (OAG) and the Virginia Information Technologies Agency (VITA) must, for all state public bodies,  review all solicitations and contracts that meet the definition of “high-risk” and are for goods and services related to information technology.

Code of Virginia § 2.2-4303.01 defines a high-risk contract as any public contract with a state public body for the procurement of goods, services, insurance or construction that is anticipated to either

• Cost in excess of $10 million over the initial term of the contract or
• Cost in excess of $5 million over the initial term of the contract and meets at least one of the following criteria:
• the goods, services, insurance, or construction that is the subject of the contract is being procured by two or more state public bodies;
• the anticipated term of the initial contract, excluding renewals, is greater than five years; or
• the state public body procuring the goods, services, insurance, or construction has not procured similar goods, services, insurance, or construction within the last five years.

Contact VITA’s procurement (supply chain management) group: scminfo@vita.virginia.gov, for the most current version of VITA’s solicitation and contract templates, and for assistance in determining which template is the correct one to use for your procurement. If your procurement is cloud-based, in whole or in part, please make sure to mention this so you receive the correct template. VITA updates our templates at least quarterly, and in response to changes to Virginia procurement law and policy. Therefore, it is important for agencies to request the latest version of our templates when drafting a new IT solicitation or contract. Doing so will ensure that your agency’s IT solicitations and contracts have the most up-to-date terms and conditions, and ultimately, will create a stronger agreement that is more aligned with VITA’s procurement policies, standards and guidelines, as well as Virginia state law and policy.

Contacting VITA procurement will also give your agency the opportunity to ask questions about using the templates. VITA has more than one template and will help your agency determine which is the correct one to use for any given solicitation or contract. We encourage your agency to seek consulting services from our team for assistance and training on the use of VITA templates.

If your agency is using VITA’s solicitation and contract templates, VITA recommends that you not incorporate Division of Purchasing and Supply (DPS) language into VITA templates. VITA’s solicitation and contract templates are created specifically for IT procurements and incorporating DPS language could potentially create confusion for your suppliers/vendors. As an example, a reference to the vendor’s manual in your IT solicitation could create an issue since this manual sets forth the purchasing rules and regulations for general goods and services procurements from a vendor’s perspective and is not applicable to IT procurements.

To begin the IT high-risk review process, after the procurement governance request (PGR) has been approved, have your agency’s IT resource (AITR) submit the request for review of a high-risk IT solicitation or contract through the Commonwealth’s technology portfolio management tool, Planview Enterprise 1. Please have your AITR submit all documents that make up the IT solicitation or contract package. VITA’s project management division (PMD) will receive the request and send the high-risk IT solicitation or contract document package to VITA supply chain management (SCM); security and enterprise architecture; IT investment management; and to enterprise cloud oversight service (ECOS), if applicable.

Your agency’s procurement officer will submit your high-risk IT solicitation or contract review request to the OAG. The following form should be filled out and sent, along with the high- risk IT solicitation or contract package, to your agency’s attorney in the OAG:  https://www.oag.state.va.us/files/HighRiskContract-Review-Request-Secured.pdf

The procurement officer should complete the matrix called “Minimum Requirements for Major IT Procurements, High-Risk Procurements and Delegated Procurements” and provide it to their agency AITR to submit, along with the high-risk IT solicitation or contract document package, in Planview Enterprise 1. The matrix helps your agency ensure that your high-risk solicitations and contracts meet high-risk requirements and assists VITA in its review. A copy of the matrix is available on VITA’s website and can be accessed by visiting the Procurement Forms page.

Yes. Please contact your agency’s IT resource (AITR) to ensure the procurement governance request (PGR) was submitted and approved by the chief information officer (CIO) of the Commonwealth of Virginia prior to submitting your high-risk solicitation or contract for VITA review.

If any component of your high-risk IT solicitation is for cloud services, you will need to obtain an enterprise cloud oversight service (ECOS) assessment form, which you can access on the VITA service portal: https://vccc.vita.virginia.gov/vita.

Search for “Cloud Service Assessment” and then scroll to the bottom of the page to “Attachment for 1-1003 – Appendix A” and download the form. The ECOS assessment must be included as an attachment to your high-risk IT solicitation, and completed by offerors per the instructions in your request for proposal (RFP).

Contact scminfo@vita.virginia.gov for access to the appropriate cloud terms and conditions.

Assistance is available to agencies on high-risk solicitations and contracts. VITA procurement (supply chain management) offers training on the development of IT solicitations and contracts, IT contract terms, associated risks, statements of work, performance measures and service level agreements, project milestones and deliverables tables, negotiations and contract management. If there is interest in these topics, please email VITA procurement at scminfo@vita.virginia.gov.

VITA procurement recommends you ensure strong performance measures are included in your IT solicitation and contract. Performance measures are quantifiable metrics of expected service levels, and are the backbone of a successful contract. Performance measures should be tailored to provide accurate and reliable data on the supplier's performance against agreed upon service provisions. The metrics chosen should be able to correctly identify how well, and to what extent, the supplier regularly meets the expected levels of service outlined in your contract. Visit Chapter 30.3.1 Performance Measures of our IT Procurement Manual for additional guidance and examples.

Each performance measure should be tied to a corresponding enforcement provision. Strong enforcement provisions will incentivize the supplier to consistently meet the performance measures set out in the contract. Visit Chapter 30.3.2 Enforcement Provisions and Remedies of VITA’s IT Procurement Manual and the Performance Metrics Tool tool for additional guidance and examples. Also, see the performance measures training video.

Contractual remedies are a means to hold the supplier accountable in a tangible way for failing to meet required performance measures. They incentivize the supplier to consistently meet or exceed the contractually required performance measures. The remedies can be in the form of monetary penalties, or exercising contractual options such as termination or seeking neglected services from another supplier. Visit Chapter 30.3.2 Enforcement Provisions and Remedies of our IT Procurement Manual and the Performance Metrics Tool for additional guidance and examples.

VITA recommends that agencies include a project milestones and deliverables table in their solicitations and contracts. Please download the Project Milestones and Deliverables Template and follow instructions found in the word document.