2026.08.24 - RFQ 2027.02 ITS86 Questions and Answers Response Document.pdf

Massachusetts Office of the Inspector General RFQ 2027.02 ITS86, Category (1) – Q&As August 24, 2026

Current System Environment

1. Is the OIG currently using an existing customer support or ticketing platform?

a. No, the OIG is currently utilizing Time Matters and Outlook to track public inquiries and document outcomes for calls and emails.

2. Is workload balanced manually?

a. Yes, current workloads are balanced manually. The OIG would like the new software system to provide a way for supervisors to assign staff to inquiries within the system, notifying them when a new assignment comes up.

3. Is the OIG seeking a stand-alone ticketing solution, or a platform that can expand into case management, enterprise service management, knowledge management, and workflow automation in future phases?

a. Stand-alone ticketing solution.

4. Does the OIG envision expanding the solution beyond inquiry management for the Learning & Development Division into public-sector case management or other use cases for the OIG?

a. No.

5. Would the OIG benefit from workflow automation for training registration, payment inquiries, student account management, and procurement support requests?

a. No, these are not features the OIG is interested in for this procurement.

6. The RFQ lists “phone” and “mobile” as separate channels. Does the OIG currently have a dedicated mobile app for customer inquiries? If so, could you describe how users currently access it so we can confirm how our solution would need to support that channel?

a. The OIG does not currently have a dedicated mobile app for customer inquiries. The public either calls the OIG Technical Support line (not a live call center) and leaves a voicemail or sends an email. However, the system should have the ability to let customers submit inquiries via their mobile phone browser.

Data Migration

7. Is data migration expected as part of this implementation?

a. Yes, data migration is part of the implementation. The data that will be migrated mostly consists of database data entries. The OIG is still determining the data migration scope and strategy.

8. Approximately how much historical data is expected to be migrated?

a. The OIG is still determining the data migration scope and strategy.

9. Are there current ticket repositories to convert?

10. How much data must be retained?

a. All data must be retained.

Avaya Integrations

11. Could you provide additional details regarding the existing Microsoft Office environment (Microsoft 365, Outlook, Azure AD, etc.) and Avaya phone system version?

a. Avaya Workplace, Version 3.35.0.167 and EOTSS M65 Tenant.

12. Regarding the requirement to integrate with OIG’s existing Avaya telephone system with transcription capabilities, does the OIG intend to retain Avaya as the underlying telephone system, or whether OIG is considering alternative telephone solutions that meet the same functional requirements?

a. The OIG’s intent is to retain Avaya as the underlying telephone system.

13. Is call recording already enabled?

a. The Procurement Support Helpdesk and OIG Academy inboxes do not take live calls but the OIG team does record the voicemail box.

14. Is transcription for voicemails received expected to:

a. Create tickets automatically?

i. Yes.

b. Populate ticket notes?

i. Yes.

c. Be searchable?

i. Yes.

15. Are call analytics required?

a. Yes.

16. Do citizens expect callbacks from support staff?

17. Is customer journey visibility currently available across channels?

18. Can a citizen start in one channel and continue in another today?

a. Yes. However, the OIG’s current system does not automatically track when an inquiry switches from one channel to another; this is currently done manually by OIG staff.

19. The RFQ calls out web, phone, email, mobile, and future AI.

a. Are live chat capabilities desired?

i. No.

b. Is SMS communication with citizens under consideration?

i. No.

c. Are social channels expected in the future?

i. The OIG has not determined this at this time.

20. Are proactive system notifications required for OIG Staff?

a. Yes, the OIG requires internal system notifications for staff that would be sent to staff via email so they know when they have a notification.

21. Would the OIG like a single queue regardless of channel source?

a. Yes the procurement support line, OIG-Training & Ask will each have its own queue that contains its inquiries from email, web, phone.

22. Which Avaya deployment/model is currently in use, and what capabilities are expected at launch - or example, call logging, call controls, call recording, voicemail capture, transcription, or automatic ticket creation?

a. The OIG plans to continue using its current Avaya system and integrate with the customer service software system to ensure voicemail capture, transcription, automation ticket creation, call logging, and call controls.

23. Besides Power BI and the Learning Management System, are there any additional third-party systems that should be considered for integration during Phase 1?

a. Yes, integration with the AWS Bedrock OIG Chatbot to provide a seamless experience for staff.

API Requirements

24. Is chatbot implementation expected as part of the initial deployment or planned for a future phase?

a. It is expected as part of initial deployment.

25. For the requirement of “direct access to the underlying database via API for data queries,” could OIG confirm whether this would be satisfied by full REST API access to ticket and reporting data, or whether literal database-level access is required?

a. Full REST API access is sufficient.

26. Will API documentation and technical support be provided for Avaya, the OIG website, and other systems requiring integration?

Licensing, Users & Commercial Scope

27. The OIG has mentioned approximately 100 employees with 2 primary administrators and 25 users regularly. Should the vendors provide licensing for all 100 employees inclusive of the 2 admin users?

a. No, the OIG only needs licensing for 25 users and two primary administrators. This system will only be utilized by a specific division, not all staff.

28. Should vendors include scalable licensing options for future growth?

a. No. Pricing should be based on the current estimated usage.

29. Should implementation, training, support, software licensing, and optional renewal pricing be quoted as separate line items?

a. Yes, pricing should be quoted as separate line items.

30. Are there any preferred licensing models (named users, concurrent users, enterprise licensing, etc.)?

31. What are the anticipated administrator responsibilities?

a. Administrators should at a minimum, have the ability to audit the system, add and remove users, assign roles, and assist with basic user issues.

Additionally, administrations should be able to make configuration updates to the system as needed (creating new fields, adding options to drop down menus, etc).

32. Who owns platform governance?

a. OIG.

33. Who will approve workflow changes?

a. The two primary administrators.

34. What escalation paths should be built?

a. The OIG is still determining the needs and specific use cases for escalation paths and will work for the awarded vendor to determine the scope.

35. Are there priority classifications?

a. Yes, at times the OIG has urgent and time-sensitive inquiries related to procurement support and for the Academy. The system must provide a way for OIG staff to categorize different levels of priority for answering inquiries in the queue.

Implementation Timeline & Support

36. Is there a target go-live date or desired implementation timeline beyond "as soon as possible"?

a. The OIG does not have a specific target date or implementation timeline; it seeks a “go live” date based on best practices and the selected vendor’s implementation plan.

37. Is post-implementation support or warranty support expected as part of the initial implementation?

38. Are there any expected Service Level Agreements (SLAs) for implementation, training, or ongoing support that vendors should include in their proposals?

a. Vendors should propose standard response times for critical, high, medium, and low-severity issues as part of their service-level offering. The OIG expects industry-standard response times, such as immediate response for critical issues and tiered response times for lower-severity items.

39. What is the expected platform availability SLA?

a. Industry standard of 99.9% uptime.

40. Are after-hours inquiries supported?

a. The OIG does not take live calls to the Procurement Support Helpdesk or the OIG Academy inboxes. The solution must accept after-hours inquiries to be stored until the following work day.

41. Does the OIG have any preferred or required technology standards that vendors should consider for the proposed solution and integrations?

a. The solution should be able to integrate with the OIG’s existing AWS-hosted chatbot back end through a REST API. The back end uses Amazon Bedrock and the vendors system will provide interaction through a UI. The vendor will work with the OIG to determine the appropriate security and authentication requirements for the integration.

42. Does the OIG anticipate or prefer a single or multi-phased implementation? If so, please identify the desired phases and priorities

a. The OIG prefers a single implementation process.

43. What deliverables are required for acceptance?

a. The OIG will work with the awarded vendor to create a Statement of Work

(SOW) which will detail all deliverables, acceptance criteria and applicable deadlines.

44. What acceptance testing criteria will be used?

a. Acceptance testing criteria will be determined with the awarded vendor.

45. How will requested enhancements after go-live be handled?

a. The OIG will determine the process for any requested enhancements with the awarded vendor.

Identity and Access Management

46. What identity provider is currently used?

a. Microsoft Entra ID

47. Are external users expected to authenticate or submit anonymously?

a. External users do not need to authenticate, however the OIG does want to collect users names and contact information so it will not be fully anonymous.

48. Are there requirements for B2B guest users, public accounts, student accounts, or vendor accounts?

Website and System Integrations

49. Will the awarded vendor have access to modify website code?

50. For the requirement that the customer service form “fully integrates” with the OIG website and “auto-populates the intake form responses,” could OIG provide an example of the expected auto-population behavior or the specific information that should be populated? This will help us better understand the intended functionality.

a. The Technical Support Form currently on the OIG Website (and hosted on Formstack) will need to fully integrate with the customer support software, allowing fields in the user submissions to auto populate corresponding fields in the system. The current form is available on the OIG website here:

https://maoig.gov/procurement-support/request-technical-support/.

51. Does the OIG expect the selected vendor to design and develop the public-facing portal/forms and embed them within the OIG website, or will OIG/web-team resources handle website configuration and placement? Please also confirm whether the current website platform/CMS has any technical constraints or preferred integration method.

a. Yes, the awarded vendor is expected to design the public facing portal and embed it within the OIG website The current website platform has no current known technical constraints.

52. Should forms be embedded, redirect to a portal or utilize APIs?

a. The OIG defers to vendor expertise and industry best practices.

53. Are there accessibility requirements beyond standard WCAG compliance?

54. Are multilingual forms required?

55. For the Learning Management System integration requirement, does OIG have a specific LMS currently in use that the solution would need to integrate with, or is this intended as a forward-looking capability requirement?

a. The OIG uses the Blackboard LMS. Integration would not be part of the immediate implementation plan and intended as a forward-looking capability.

https://maoig.gov/procurement-support/request-technical-support/

AI and BYOM Requirements

56. For the “Bring Your Own Model” AI chatbot requirement, could OIG clarify the intended scope and use case? Specifically, is the goal for OIG’s existing chatbot to call the vendor’s API to retrieve ticket and knowledge base information (i.e., a read/retrieval integration), or does OIG require the ability to embed or swap in a proprietary model within the vendor’s platform itself? Will the OIG develop and manage the AI chatbot?

a. The OIG maintains a generative AI tool used internally by the procurement support team. The tool uses AWS Bedrock and an OIG-managed document store. The front-end and back-end of the tool communicate through an Application Programming Interface (API). For the solution, the front end should include a user interface for asking questions, receiving responses, and viewing chat history. The OIG will continue to maintain the document store and other back-end components.

As part of this procurement, the OIG seeks to deploy the front-end of the chatbot within the ticketing system. This could be accomplished one of several ways:

1. The ticketing system provides a button or link that opens the chatbot in a separate browser or tab and supports single sign-on so the user doesn’t need to authenticate again.

2. The vendor provides a chat UI within their system and calls the API to facilitate communication between the ticketing system and the OIG-managed back-end. Minimum requirements: must authenticate to the API and maintain conversation and session information.

3. The system securely embeds the OIGs current front-end directly within the ticketing system rather than in a separate environment. The solution should be able to securely identify and authenticate users.

The OIG requests vendors to include relevant pricing based on the above three options in their response.

57. Are there data residency restrictions for AI processing?

58. Will the chatbot interact with citizens directly?

i. No.

b. Will voice interactions eventually be included?

i. No.

Reporting and Data Architecture

59. What reports are currently produced manually?

a. A monthly report is produced which tracks turnaround time and number of calls. The OIG will be exploring additional types of reports to produce and will collaborate with awarded vendor for support and expertise.

60. What KPIs determine success?

a. Current KPIs include 1) resolution of matter in a timely manner, 2) overall support from interaction, speed of response 3) clarity of guidance, helpfulness of guidance 4) professionalism of staff 5) whether the caller would recommend the service. However, the OIG may expand upon these KPIs during this process and will discuss with the awarded vendor.

61. Are there executive dashboards required?

a. Yes

62. Is a reporting data warehouse anticipated?

a. The OIG has its own data warehouse, and anticipates the need to run call the API to ingest data from the customer service system on an as needed basis.

63. What level of API volume is expected for external reporting systems?

a. The OIG expects to run an API call to update open records and ingest new records on a weekly basis and more often as needed.

64. Are call center metrics currently captured?

a. No, The OIG does not host a traditional live call center at this time. People call the technical support line and leave a voicemail. The OIG does not handle calls live and are not looking for a service to do that.

65. Is omnichannel reporting required?

66. Does the OIG want cross-channel journey analytics?

Security & Compliance Questions

67. Must the solution comply with Commonwealth of Massachusetts security standards?

68. Is FedRAMP authorization required or preferred?

a. Required.

69. Is CJIS compliance required?

70. What security assessment process will be required?

a. At a minimum, the vendor should be able to produce the following on request:

i. A list of data elements

ii. Architecture diagrams

iii. Data flow diagrams

iv. Hosting environment information

v. Written information-security policy

vi. Incident response plan

vii. Summary of Intrusion protection/prevention controls

71. Will penetration testing be required?

a. No, however the vendor is expected to perform security testing consistent with accepted industry practices and to mitigate identified vulnerabilities

72. Are there cybersecurity insurance requirements?

a. Please refer to the RFR and Terms & Conditions of the master OSD contract.

73. What are the incident notification requirements?

a. Notification should occur no less than 24 hours after initial discovery.

Specific requirements will be included in the statement of work.

74. Are there restrictions regarding data hosting locations?

75. Must all data remain in U.S.-based facilities?

a. Yes, data must reside in US and align with all data protection requirements.

76. What audit log retention period is required?

a. Audit logs must comply with EOTSS policy, CJIS policy and other security requirements standard for PII FTI.

Knowledge Management

77. How many knowledge articles currently exist?

a. The OIG is currently building our knowledge articles database. The final number will be shared with the selected vendor.

78. Will public self-service knowledge be required?

79. Who owns content approval?

a. The OIG.

80. Is knowledge analytics required?

a. Yes. The OIG wants the ability to pull analytics regarding how knowledge article data is used by staff.

Training

81. What level of admin training is expected?

a. Admins should be able to understand how to complete the administrative tasks within the system. The OIG will defer to the awarded vendors expertise and best practices for how this training will be done.

82. Is train-the-trainer preferred?

a. No preference

83. Will job aids be required?

84. Is ongoing adoption support expected?

Contractual Questions

85. Should pricing include ServiceNow subscription fees or implementation services only?

a. Pricing should include all fees and pricing, as well as a detailed breakdown of those fees and pricing.

86. Will additional divisions potentially be added?

87. Are external portal users unlimited?

Contract Structure

88. Will the Commonwealth utilize its standard contractual terms?

a. Yes. The Statement of Work agreement between the awarded vendor and agency will be applicable to the standard contract form and RFR Commonwealth Terms and Conditions for ITS86.

89. What information security addenda are required?

a. Please refer to the RFR and Terms & Conditions of the master OSD contract.

90. Are data processing agreements required?

a. Please refer to the RFR and Terms & Conditions of the master OSD contract.

91. What indemnification requirements apply?

a. The contract will be governed by indemnification provision in the Commonwealth Terms and Conditions, which has been agreed upon between the vendors and Operational Service Division (OSD) for ITS86.

92. What termination-for-convenience provisions will apply?

a. The right of the Commonwealth to terminate the contract is provided in the

Commonwealth Terms and Conditions.

93. Are price increases allowed during renewal periods?

a. Prices are negotiated at the time of the award.

94. Is there a formal change-order process?

a. All change orders must be executed in writing and approved by both parties.

Customer References:

95. In the event that three references specifically from public sector or similar government agencies cannot be provided, would OIG accept references from customers in other industries that use the same solution for comparable business requirement.

a. Yes. However, the OIG strongly encourages use of public sector references, as comparability of the solution used in other industries may be limited and insufficient. The OIG reserves the right to deem a reference source insufficiently comparable and disregard it.