20252004_A2_IT Service Management Platform_Addendum 3.pdf

Date: April 3rd, 2025 To: All Potential Proposers From: Drew Pryor, Purchasing Analyst Subject: RFI 20252004 IT Service Management Platform

ADDENDUM NO. 1

The solicitation referenced above is amended as follows.

Responses received to questions and requests for more information from potential proposers are below:

• Is the City interested in a phased, Minimally Viable Product approach that would begin with Core ITSM and expand to include integrations like SCCM and Intune?

a. If so, which integrations would need to be included in the MVP? Which could be implemented in a later phase?

No, we will move forward using a formal integration/deployment.

• Is the City interested in adding non-IT product suites, like

a. Field Service Management (FSM) – Optimize field service costs, process efficiency, and operations to accelerate productivity. Not interested

b. Human Resources Service Delivery (HRSD) – Improve productivity by streamlining the employee service experience. Not interested

c. Public Sector Digital Services (PSDS) – Empower government employees to provide the public with intuitive, frictionless, accessible service. Not interested

d. Strategic Portfolio Management (SPM) – Connect strategy with delivery to provide 360º visibility and speed time to value. Not Interested

• On how many sub-nets does the City expect to discover devices for ingestion into the

CMDB?

~10

• Can the City provide more granular asset and asset model information?

a. Servers

b. End User Computing Devices

c. Network Devices

d. Mobile Devices

e. Monitors

f. Unclassified Hardware

g. Printers https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fd10wfq04.na1.hs-sales-engage.com%2FCtc%2FZU%2B23284%2Fd10WFq04%2FJll2-6qcW7Y8-PT6lZ3p7N77zDYpcbbMkW1m9GmY7xC2PYVjjNcR5mfgDhVWg2GS19l8zZW71GqkT5YHSq_N8Bh-zkS4V6cW1LG_L85Blr5QW6N8vtc131gp_W8PqSRB8YRr0nW8byQcM3PDJzyW8V_MB63mQV9BW123pBv2HJgtTW91t4bM295Gr8W6Cv-Xz2W-JPnW6k-ZJP1WNY3PW2pxdr68BfDQfW1ZK5-b6Jnbt8W2pzYW13c2tMlW3wMlWB37z6vpW4YDfL-6DKFycW3z2Vwr7kVSXJW70Wxhx7pqTTKW4vl19g6jpf7BW7sjhw82DFl-QW89Tc6D7r_PGtW7Z4Knn5Zt2Dhf1fSkg004&data=05%7C02%7CKBrouwer%40eugene-or.gov%7C02d8bb611099467f349d08dd707a6834%7C0c0d3453aa1d41bc8aa35c843d4ca0e8%7C0%7C0%7C638790393207168953%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=9Iflw0Ap9bFdZC1EwtK2WbyaRrelhmyE1NaA2uxT9CA%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fd10wfq04.na1.hs-sales-engage.com%2FCtc%2FZU%2B23284%2Fd10WFq04%2FJl22-6qcW7lCdLW6lZ3mzW2Ns4qk256rkNW55F67Y8-hcBgVWDjg23fmTCrW2PQqzl4hkQPpW52ZynX7dD_CjVXxRVf8VNppdW7TtgmP11GMKQW3FMqJJ6wgDY6MgZGv2h7MvKW8FzLHH1mkmB2W8tLYDW8vfzl8W2FdRYJ2Zk9J2W36nryY9m1M6fW7PqqFL5BQk39N2byR5nT8Mw7W26rfg77H0ZQ2W4Hj-xd2l3QHnW74w-zN30qRMtW5yLkR075JtnPW3kQ_5879kpZfW51Dw7Q15lnwXW8SFhz34VWCh0W37-8M43bL3bjW5sKJrl7bPS57f88zpv004&data=05%7C02%7CKBrouwer%40eugene-or.gov%7C02d8bb611099467f349d08dd707a6834%7C0c0d3453aa1d41bc8aa35c843d4ca0e8%7C0%7C0%7C638790393207181894%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=n82q3uE2Ya%2BTOmb39WJfglBpFaGqvdgwILKMQm9I3rY%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fd10wfq04.na1.hs-sales-engage.com%2FCtc%2FZU%2B23284%2Fd10WFq04%2FJll2-6qcW7Y8-PT6lZ3lrN94Tr-HTN7-GVB_5WC8XTwm7N7g3xzJCwbFsW6HMYt61jF4kbW5Dwy_C1cSD3CW9h72J17cj5smW1JQ6hK9c7xsSW8WgKMK4j02T7W7k2MHK8gwTk_W3qwhGX7YVsghN2QLXDyBDG_FW7mCCRR1MN6LRW5CHsXT783f60W65b5YM5-WBY0W3kpNXS7Chtz7W91zgqN6hK19cW9dYw2W946ppGW6w83dX26ksDTW91ZG-F6jFk1bW3VjRKD5XlsH7W8lW_Dj3zwYtCW2457825WVrW5M25dpmXf15MVTZ94533RV8qW5637x47qSXT4W5VVLHt28KvCxdBKmxR04&data=05%7C02%7CKBrouwer%40eugene-or.gov%7C02d8bb611099467f349d08dd707a6834%7C0c0d3453aa1d41bc8aa35c843d4ca0e8%7C0%7C0%7C638790393207194093%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=zHukK6lpE5%2FGm7LBeGh%2B8Zkd%2FexhK9MyrVhuTKJKgiI%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fd10wfq04.na1.hs-sales-engage.com%2FCtc%2FZU%2B23284%2Fd10WFq04%2FJll2-6qcW7Y8-PT6lZ3nwW89qF9t4MsscGW2GlmPd7pBf2LW7Hjqds1DvlQYW6zLypR2_DxLqW3XmL7g8PL8DlW1fcGlF2K_qwbN29JZRP16LjvW7CjqTT86LhNTW58gLgx39SRnvW8SxSdz7vJKKbW3bnmv_774S6MW4TCTSW17ndGxW2BKnhK8Ps6N5VT196y39nv8zW6rGK5m8VY3XBW3K51pN2l-4pFW2p8Wwq2x0YQtW4n4yKG79V8rqW4ZR87V29Hn3rW5MPSD122WQrJV1SlxQ6hwRzcW7C8fnd9bjjPrW1FkpnY22dRJxW7fjN-R5VXP10N5TvGYZtLgLGW8ND62T1VL1TQf1K2Qhv04&data=05%7C02%7CKBrouwer%40eugene-or.gov%7C02d8bb611099467f349d08dd707a6834%7C0c0d3453aa1d41bc8aa35c843d4ca0e8%7C0%7C0%7C638790393207210166%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=xT%2Fa1XnZEgn8eS7ZhDgJwkWsNRMlO94KIMYYe9cOuqA%3D&reserved=0

h. Storages

• Can the City share how it plans to handle training for the new platform? Would offerors be expected to provide train-the-trainer training, training to end-users, or will the City manage training? Train the Trainer

a. If offeror provided, what are the expected outputs (quantity of live or recorded sessions, attendance/audience, etc.)

Unknown at this time.

• How many SLA definitions will the City require?

1-2

• For data to be migrated, will any need to be leveraged by the new system, or can the data be available in a semi-archived, read-only format?

Needs to be live

• Can the City clarify how many users meet each of the below definitions?

a. Fulfiller – creates, updates, assigns, or resolves records 75

b. Requestor – submits their own requests and incidents through the self-service portal or mobile app 1500

c. Approver – views and approves their tasks 250

d. Business Stakeholder – view dashboards and reports, approve tasks, and comment on records and may be able to act on behalf of others 50

• Does the City have a desired budget for annual licensing costs? Does the City have a desired budget for implementation costs?

N/A, we are cost sensitive but want to understand your capabilities first.

• InvGate is HIPAA compliant but the use cases for our solution does not require the processing of PHI, and therefore we do not recommend using InvGate to process PHI. We can sign a BAA. We are SOC2 compliant, ISO 9001, and GDPR compliant. Is this acceptable for the City of Eugene?

This would be enough for consideration.

• Is project management in scope?

We are currently evaluating PM tools. If you have a solution or integration with MS tools we would be interested in hearing about that.

• Do you currently manage projects in your ITSM system?

We have tried, but do not find our current system flexible enough to do so.

• What would you consider a project that you would like to manage in your ITSM, could you please provide a few examples?

PeopleSoft version upgrade Network Hardware upgrade or new construction with IT hardware deployment Update of CJIS policies and procedures

• What other project tools do you use in house that you may want to integrate with?

MS Project

• Who are your 75 concurrent users?

We have uses in Service Desk, NetOps, Finance, Project Management, HR, and Leaders who need reporting

• Does this mean you have 75 individual technicians/agents logging in currently, or are there more?

We hold a 75 concurrent user pool which is a browser page count. We average below that but at times need greater capacity.

• Roughly how many are "daily agents" and logging in daily?

55 daily licenses consumed.

• Is OCR for documents a must have requirement? Do you have this now?

OCR is not widely used at the moment.

• What departments are answering requests in the tool currently? What about moving forward?

See response in question 6.

• What is your evaluation process and timeline? After the RFI, are there demos, short list demos afterwards, a trial/POC period, etc We will rank responses then proceed to short list demos.

• Is there a stakeholder in the project I could have a quick call with to discuss these open topics?

Not before the response is submitted.

• Just to confirm OREGONBUYS is to review the Solicitation but our response should be emailed to your attention on or before the due date, correct?

Please submit your information according to the instructions in the solicitation document itself.

• What ITSM practice areas (Incident, Service Request, Change, Problem, etc.) are you currently running?

Incident, Service Request, Change, Configuration Management, Knowledge, Asset Management, Service Level, Continual Improvement, and Service Catalog Management

• For the scope of work for the new technology please confirm the following modules:

Incident, Service Catalog, Change, Knowledge, CMDB/Asset and SLA. Any other areas?

These are correct. If there is a module for Project Management or integration for MS Project please inform.

• You intend to migrate 30 GB from Easy Vista, do you know approximate # of records, open closed tickets, etc.

This is what we have now. We may choose to reduce the historical data that moves to the new platform. I do not have record information to share.

• How do you obtain your Asset/CMDB data? Do you use online asset discovery tools?

If yes, please describe or list. Also if yes, do you plan to retain your existing discovery tools or replace them? Please confirm for Asset Discovery, you want pricing on 1,800 endpoints and 350 servers.

We have bulk imported and manually updated the majority. We are exploring NetBox for network devices and use sync with SCCM or Intune for endpoint data. Hardware counts are in the ballpark of actual.

• You state you have 75 concurrent users, are they all in IT or are there other departments Facilities, Risk Management, HR, Finance)?

We are licensed for 75 concurrent users. We average 55 daily and move up and down based on demand. Departments with regular usage are Service Desk, NetOps, Finance, Project Management, HR, and Leadership.

• How are you currently identifying assets that cannot run agents or cannot be scanned with traditional scanning and discovery tools (e.g. IoT, OT, and building systems like HVAC, badge readers, cameras, and traffic controllers)?

Not tracked at the moment. If a new subset of hardware that cannot be scanned is added to the list, it would be manually entered using a bulk process then manually managed.

• What percentage of your current asset inventory is likely invisible to agent-based tools like ServiceNow Discovery or SCCM?

SCCM sync records ~2500 items with a total asset count of ~7500 items.

• How does the city currently account for assets that have never checked in with the CMDB or AD? These could be rogue/unauthorized devices, transient assets, or shadow IT, for example.

We are working to centralize and improve in this area. The organization has been operating in a decentralized manner and proliferation is an opportunity.

• Is this project intended to unify asset data across all IT, OT, and IoT environments to create a single, centralized, and accurate CMDB?

Identifying a solution that is capable for this task is important. There is not a single project that is currently started that will achieve this.

• How do you currently reconcile conflicting or incomplete asset records between your CMDB, EDR, MDM, NAC, and network infrastructure?

Manual audit schedule.

• Which regulatory compliance frameworks (e.g., HIPAA, PCI, CJIS, NIST CSF, State of

Oregon IT Governance) must your ITSM and CMDB initiatives support today?

(This was only partially answered in previous Q&A) CJIS, NIST are primary.

• Does your strategy include automated, continuous compliance reporting for all asset types?

We would like to move to automated from manual scheduled audits.

• How are unmanaged assets incorporated into vulnerability assessments and incident response workflows?

This is part of our desire for a platform that can bring things together. This is a human-based departmental process right now.

• How many duplicate efforts currently exist across departments to track or manage assets separately in spreadsheets or isolated systems? Are you expecting this project to consolidate siloed asset management processes into a single operational capability?

We expect to use a new platform and its capabilities to help centralize asset lifecycle management with the value proposition of automation.

• What is your strategy for ingesting data from security tools, firewalls, switches, MDM, or cloud APIs to enrich CMDB records?

We currently pull from Defender and Palo Altos. We are working to consolidate MDM as well as exploring NetBox as a source of data for ingestion.

• Is the goal of this RFP to merely manage IT service tickets—or to build a foundation for full attack surface visibility and operational risk reduction across your city’s critical infrastructure?

The latter. This is a larger scale change management project that will be phased as the organization moves to a more centralized organizational form. The platform should enable and help drive the change.

*nb this is an RFI

• Has the City assessed how implementing a broader and thoughtful strategy around continuous and complete asset visibility could reduce your tool sprawl and cost of compliance across departments?

Yes

• Will this project create the basis for AI-powered threat detection and exposure prioritization across all enterprise and field operations?

Though the city does not have an AI policy in place we would like to understand what capability there is to improve on our security investments.

• Does the City envision this project will enable policy-driven automation and enforcement, using existing network and security infrastructure investments to drive automated outcomes like tooling gap assessments, rogue device management, and automated regulatory compliance actions?

Yes. We are moving to policy-driven governance.

All other specifications, terms and conditions remain unchanged.