24-RQ278596-NM IFB BRAND SPECIFIC 9.17.26.pdf

OFFER AND ACCEPTANCE

The State seeks offers for the software and software support described in this solicitation. The State’s acceptance of any offer must be demonstrated by execution of the acceptance found below and any subsequent Request for Best and Final Offer, if issued. Acceptance shall create a contract having an order of precedence as follows: In cases of conflict between documents comprising the contract, the order of precedence shall be (1) Best and Final Offers, if any, (2) special terms and conditions specific to this solicitation, (3) specifications, (4) Department of Information Technology Terms and Conditions of this solicitation, and (5) the agreed portions of the awarded Vendor’s offer. No contract shall be binding on the State until an encumbrance of funds has been made for payment of the sums due under the contract.

EXECUTION

In compliance with this solicitation and subject to all the conditions herein, the undersigned offers and agrees to furnish any or all Services or goods upon which prices are offered, at the price(s) offered herein, within the time specified herein. By executing this offer, I certify that this offer is submitted competitively and without collusion.

Failure to execute/sign offer prior to submittal shall render offer invalid. Late offers are not acceptable.

OFFEROR:

STREET ADDRESS: P.O. BOX: ZIP:

CITY, STATE & ZIP: PHONE:

NAME & TITLE OF PERSON SIGNING: E-MAIL:

AUTHORIZED SIGNATURE: DATE:

Offer valid for sixty (60) days from date of offer opening unless otherwise stated here: ____ days

ACCEPTANCE OF OFFER

If any or all parts of this solicitation are accepted, an authorized representative of Department of Public Instruction shall affix their signature hereto. A copy of this acceptance will be forwarded to the successful vendor(s).

STATE OF NORTH CAROLINA INVITATION FOR BIDS NO. 24-RQ278596-NM

DEPARTMENT OF PUBLIC INSTRUCTION

Office of Technology Services Offers will be publicly opened: September 30, 2026 at 10:00 AM ET

Issue Date: September 17, 2026

Refer ALL inquiries regarding this IFB shall be submitted via the Ariba Sourcing Tool Messages.

Procurement Lead:

Nicole Mathis procurement@dpi.nc.gov

Commodity Number: 811122

Description: Atlassian software subscription

Using Agency: Department of Public Instruction

See page 4 for submission instructions. Requisition No.: RQ278596

IFB Number: 24-RQ278596-NM

Page 2 of 33 Aug 5, 2026

FOR DEPARTMENT OF PUBLIC INSTRUCTION USE ONLY

Offer accepted and contract awarded (Effective Date) ______________________.

By: _________________________________ Maurice “Mo” Green, Superintendent of Public Instruction (Authorized representative of NC Department of Public Instruction) By: __________________________________ Alexis Schauss, Chief Financial Officer of Public Instruction (Authorized representative of NC Department of Public Instruction)

Page 3 of 33 Aug 5, 2026

TABLE OF CONTENTS

1.0 INTENT, USE, DURATION AND SCOPE

2.0 GENERAL INFORMATION

2.1 VENDOR QUESTIONS

2.2 ADDENDUM TO SOLICITATION

2.3 ELECTRONIC OFFER SUBMITTAL ARIBA SOURCING MODULE

2.4 BASIS FOR REJECTION

2.5 LATE OFFERS

2.6 NON-RESPONSIVE OFFERS

2.7 NOTICE TO VENDOR(S)

2.8 E-PROCUREMENT SYSTEM

2.9 DISTRIBUTORS AND RESELLERS

2.10 POSSESSION AND REVIEW

2.11 BEST AND FINAL OFFERS (BAFO)

2.12 AWARD

2.13 POINTS OF CONTACT

3.0 SPECIFICATIONS

3.1 VENDOR STANDARD AGREEMENT(S)

3.2 VENDOR UTILIZATION OF WORKERS OUTSIDE U.S. – DISCLOSURE STATEMENT

3.3 E-VERIFY

3.4 BRAND SPECIFIC PRODUCT

3.5 SECURITY SPECIFICATIONS

3.6 ENTERPRISE ARCHITECTURE SPECIFICATIONS

3.7 SPECIFICATIONS

3.8 DELIVERY

3.9 CONTRACT TERM

4.0 FURNISH AND DELIVER

5.0 DEPARTMENT OF INFORMATION TECHNOLOGY INSTRUCTIONS TO VENDORS

6.0 DEPARTMENT OF INFORMATION TECHNOLOGY TERMS AND CONDITIONS

General Terms and Conditions Applicable to Software as a Service (SaaS)

Page 4 of 33 Aug 5, 2026

1.0 INTENT, USE, DURATION AND SCOPE

The purpose of this IFB is to obtain pricing for and procure Atlassian software subscriptions for the NC Department of Public Instruction (NC DPI). Products and Services will be provided in accordance with the terms and conditions of this IFB and the Atlassian-NC DIT Master agreement (ATL-001498147).

This contract is funded through receipts.

2.0 GENERAL INFORMATION

2.1 VENDOR QUESTIONS

All inquiries regarding the solicitation specifications or requirements must be addressed to the contact person listed on Page One of this solicitation via the Ariba Sourcing Tool’s message board. Vendor contact regarding this Solicitation with anyone other than the contact person listed on Page One of this Solicitation may be grounds for rejection of said Vendor’s offer.

Written questions concerning this Solicitation will be received until September 22, 2026 at 10:00 AM ET. They must be submitted to the contact person listed on Page One of this Solicitation via the Ariba Sourcing Tool. Please enter “Questions Solicitation XXXX” as the subject for the message. Questions should be submitted in the following format:

REFERENCE VENDOR QUESTION

Solicitation Section, Page Number

2.2 ADDENDUM TO SOLICITATION

The Agency will issue an Addendum to provide a response to all questions received in accordance with Section 2.1-VENDOR QUESTIONS, above.

The Agency may issue additional Addenda as needed to modify the specifications, requirements, terms and conditions, etc. Critical information may be included in these Addenda. It is important for Vendors to periodically check the website for any and all Addenda that may be issued prior to the bid opening date.

All Addenda will be posted on the electronic Vendor Portal (eVP) website at https://evp.nc.gov and will become Addenda to this solicitation.

2.3 ELECTRONIC OFFER SUBMITTAL ARIBA SOURCING MODULE

Sealed offers, subject to the conditions made a part hereof, will be received by the time and date specified above and then opened for furnishing and delivering the commodity as described herein.

It is the Vendor’s sole responsibility to submit its offer by the specified time and date of opening.

The Vendor shall bear the risk for late electronic submission due to unintended or unanticipated delay including, but not limited to, internet issues, network issues, local power outages, or application issues. No offers are able to be uploaded in Ariba after the deadline/bid opening date and time.

a) Submit one (1) signed, original electronic offer via the Ariba Sourcing Module. The Vendor to include the Execution Page 1 WITH the remaining pages of the solicitation in one PDF.

The Execution Page 1 must be signed and dated by an official authorized to bind the Vendor’s firm. Failure to return a signed offer shall result in disqualification.

b) File names should identify the Vendor, solicitation, and document in that order (Vendor Name – Solicitation Number – Offer, etc.).

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fevp.nc.gov%2F&data=05%7C02%7Candrea.pacyna%40nc.gov%7C018d5d0a9c674f32cc4e08dee88fcd46%7C7a7681dcb9d0449a85c3ecc26cd7ed19%7C0%7C0%7C639203901504717360%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=WkoU%2B%2BBgXOaqIbsooR06hUlVLkGgHwNopOnDeIFRcE8%3D&reserved=0

Page 5 of 33 Aug 5, 2026

c) Files must not be password protected. They must be in .PDF, .JPEG, .DOC or .XLS format and capable of being copied to other sources. The Vendor’s offer may be deemed non-responsive if the Agency is unable to open the file(s).

d) If the offer contains any confidential information (as defined in the NCDIT Terms and Conditions, “CONFIDENTIALITY” Section), the Vendor must provide one (1) redacted electronic copy in addition to the original copy.

Action Responsibility Date and Time Issue IFB NCDPI September 17, 2026 Deadline to Submit Written Questions Vendors September 22, 2026 by 10:00 AM ET

Provide Responses to Questions NCDPI September 25, 2026

Submit Bids (Bid Deadline) Vendors September 30, 2026 by 10:00 AM ET

Public Bid Opening NCDPI September 30, 2026 at 10:00 AM ET

See MS Teams Link Below under Public Bid Opening Information

Award Contracts NCDPI TBD

2.3.1 PUBLIC BID OPENING INFORMATION

Microsoft Teams meeting

Join: https://teams.microsoft.com/meet/217973928174202?p=ed999FzvuK9EyNBTtp Meeting ID: 217 973 928 174 202 Passcode: kC7Hr6jG Need help? | System reference

Dial in by phone +1 323-484-5095,,468821241# United States, Los Angeles Find a local number Phone conference ID: 468 821 241# For organizers: Meeting options | Reset dial-in PIN

2.4 BASIS FOR REJECTION

Pursuant to 9 NCAC 06B.0401, the State reserves the right to reject any and all offers, in whole or in part; by deeming the offer unsatisfactory as to quality or quantity, delivery, price or service offered;

non-compliance with the specifications or intent of this solicitation; lack of competitiveness; error(s) in specifications or indications that revision would be advantageous to the State; cancellation or other changes in the intended project, or other determination that the proposed requirement is no longer needed; limitation or lack of available funds; circumstances that prevent determination of the best offer; or any other determination that rejection would be in the best interest of the State. Vendor contact regarding this IFB with anyone other than Nicole Mathis may be grounds for rejection of said Vendor’s offer.

2.5 LATE OFFERS

Regardless of cause, late offers will not be accepted and will automatically be disqualified from further consideration. It shall be the Vendor’s sole risk to ensure delivery at the designated office by https://teams.microsoft.com/meet/217973928174202?p=ed999FzvuK9EyNBTtp https://aka.ms/JoinTeamsMeeting?omkt=en-US https://teams.microsoft.com/l/meetup-join/19%3ameeting_Nzg4ODA0ZjItNDUwNS00YTMzLWI0N2ItZDQxYzE0ZTFhODY4%40thread.v2/0?context=%7b%22Tid%22%3a%22849e9c61-f0bb-4d83-ba5f-4b5337664cf7%22%2c%22Oid%22%3a%22ed189b1b-e632-41fa-9672-7943a6f70b10%22%7d tel:+13234845095,,468821241%23 https://dialin.teams.cloud.microsoft/5349f5a5-3431-4360-9428-3c6876460abe?id=468821241 https://teams.microsoft.com/meetingOptions/?organizerId=ed189b1b-e632-41fa-9672-7943a6f70b10&tenantId=849e9c61-f0bb-4d83-ba5f-4b5337664cf7&threadId=19_meeting_Nzg4ODA0ZjItNDUwNS00YTMzLWI0N2ItZDQxYzE0ZTFhODY4@thread.v2&messageId=0&language=en-US https://dialin.teams.cloud.microsoft/usp/pstnconferencing

Page 6 of 33 Aug 5, 2026 the designated time. Late offers will not be opened and may be returned to the Vendor at the expense of the Vendor or destroyed if requested.

2.6 NON-RESPONSIVE OFFERS

Vendor offers will be deemed non-responsive by the State and will be rejected without further consideration or evaluation if statements such as the following are included:

• “This offer does not constitute a binding offer”,

• “This offer will be valid only if this offer is selected as a finalist or in the competitive range”,

• “Vendor does not commit or bind itself to any terms and conditions by this submission”,

• “This document and all associated documents are non-binding and shall be used for discussion purposes only”,

• “This offer will not be binding on either party until incorporated in a definitive agreement signed by authorized representatives of both parties”, or

• A statement of similar intent.

2.7 NOTICE TO VENDOR(S)

The State objects to and will not be required to evaluate or consider any additional terms and conditions not previously agreed to by the State and submitted with an Offeror’s response.

This applies to any language appearing in or attached to the document as part of the Offeror’s response. By execution and delivery of this IFB and response(s), the Offeror agrees that any additional terms and conditions, whether submitted purposely or inadvertently, shall have no force or effect.

2.8 E-PROCUREMENT SYSTEM

The State utilizes the NC eProcurement (NCEP) system to process requisitions and issue purchase orders. See http://eprocurement.nc.gov/ and General Terms and Conditions, Electronic Procurement for more information.

a) It is the Vendor’s responsibility to read these provisions carefully and to consider them in preparing the response. By signature, the Vendor acknowledges acceptance of all provisions related to NCEP.

b) The transaction fee addressed in General Terms and Condition, Electronic Payment (currently at 1.75%) applies to the purchase of goods only. It does not apply to Vendor Hosted Solutions, IaaS, PaaS, SaaS, software maintenance/support services, or any other type of services.

c) If not already registered in NCEP, the Vendor must register within two (2) days after notification of contract award.

d) The Vendor must be current on all NCEP fees prior to submitting a response. Otherwise, the State may disqualify the Vendor from participating in this solicitation.

2.9 DISTRIBUTORS AND RESELLERS

“Resellers” as used herein, refers to businesses that routinely sell or distribute Vendor’s Products, and may include “Distributors”, “Value Added Resellers” (VARs), “Original Equipment Manufacturers” (OEMs), Channel Partners, or such other designations. These businesses must be approved by the State prior to placement of any orders. Any contract established will be subject to this solicitation and any resulting Agreement(s), and to the terms and conditions of the State’s competitive bidding process.

The Agency acknowledges that the Reseller has merely purchased the Third-Party Items for resale or license to the Agency, and that the proprietary and intellectual property rights to the Third-Party Items are owned by parties other than the Reseller (“Third Parties”). The Agency further http://eprocurement.nc.gov/

Page 7 of 33 Aug 5, 2026 acknowledges that except for the payment to the Reseller for the Third-Party Items, all of its rights and obligations with respect thereto flow from and to the Third Parties. The Reseller shall provide the Agency with copies of all documentation and warranties for the Third-Party Items which are provided to the Reseller. The Reseller shall assign all applicable third-party warranties for Deliverables to the Agency.

Failure to attach the manufacturer's authority to resell may result in the offer being deemed non-responsive and the offer may not be evaluated further.

For Vendor Completion:

1. Vendor is the: ☐ Manufacturer ☐ Dealer ☐ Reseller ☐ Distributor

2. Vendor is an Authorized Reseller?: ☐ Yes ☐ No

3. Attached Manufacturer’s Authority to resell? : ☐ Yes ☐ No

2.10 POSSESSION AND REVIEW

During the evaluation period and prior to award, possession of the bids and accompanying information is limited to personnel of the issuing agency, and to the committee responsible for participating in the evaluation. Vendors who attempt to gain this privileged information, or to influence the evaluation process (i.e. assist in evaluation) will be in violation of purchasing rules and their offer will not be further evaluated or considered.

After award of contract the complete bid file will be available to any interested persons with the exception of trade secrets, test information or similar proprietary information as provided by statute and rule. Any proprietary or confidential information which conforms to exclusions from public records as provided by N.C.G.S. §132-1.2 must be clearly marked as such in the offer when submitted.

2.11 BEST AND FINAL OFFERS (BAFO)

The State may establish a competitive range based upon evaluations of offers, and request BAFOs from the Vendor(s) within this range, e.g. “Finalist Vendor(s)”. If negotiations or subsequent offers are solicited, the Vendor(s) shall provide BAFO(s) in response. Failure to deliver a BAFO when requested shall disqualify the non-responsive Vendor from further consideration. The State will evaluate BAFO(s), oral presentations, and product demonstrations as part of the Vendors’ respective offers to determine the final rankings.

2.12 AWARD

It is the general intent to award this contract to one (1) Vendor. As provided by statute, award will be based on Best Value Analysis, Lowest Price Technically Acceptable Source Selection Method in accordance with 09 NCAC 06B. 0302 Information Technology Procurement.

2.13 POINTS OF CONTACT

Contact by the Offeror with the persons shown below for contractual and technical matters related to this IFB is only permitted if expressly agreed to by the purchasing lead named on page 4, or upon award of contract:

Page 8 of 33 Aug 5, 2026

For Vendor completion:

Vendor Contractual Point of Contact Vendor Technical Point of Contact Name of Vendor: ______________________

Street: _______________________________

City, State, Zip: ________________________

Attn: ________________________________

Email: _______________________________

Name of Vendor: ______________________

Street: _______________________________

City, State, Zip: ________________________

Attn: ________________________________

Email: _______________________________

3.0 SPECIFICATIONS

3.1 VENDOR STANDARD AGREEMENT(S)

The terms and conditions of Vendor’s standard license, maintenance or other agreement(s) applicable to Software and other Products acquired under this Agreement may apply to the extent such terms and conditions do not materially change the terms and conditions of this Agreement. In the event of any conflict between the terms and conditions of this Agreement and the Vendor’s standard agreement(s), the terms and conditions of this Agreement relating to audit and records, jurisdiction, choice of law, the State’s electronic procurement application of law or administrative rules, the remedy for intellectual property infringement and the exclusive remedies and limitation of liability in the Terms and Conditions herein shall apply in all cases and supersede any provisions contained in Vendor’s relevant standard agreement or any other agreement. The State shall not be obligated under any standard license and/or maintenance or other Vendor agreement(s) to indemnify or hold harmless the Vendor, its licensors, successors or assigns; nor arbitrate any dispute, nor pay late fees, legal fees or other similar costs.

Master agreement (ATL-001498147) is currently in place between Atlassian-Pty Ltd and NC Department of Information Technology (NC DIT) and will be applicable to this IFB.

3.2 VENDOR UTILIZATION OF WORKERS OUTSIDE U.S. – DISCLOSURE STATEMENT

In accordance with the Statewide Information Security Manual (SISM), the State restricts the location of information systems that receive, process, store, or transmit State and Federal data to the United States which includes the following areas: US States, US Territories, US Embassies, and US Military installations (stateside or overseas). This restriction applies to the Vendor and to any subcontractors engaged to provide Services under this Agreement or with access to State Data.

The Vendor must ensure that its subcontractor agreements contain the same restrictions and will be responsible for monitoring and enforcing subcontractor compliance at all times.

Pursuant to N.C.G.S. §143B-1361(b), the Vendor must complete and return this Disclosure Statement herein with its solicitation response. The Vendor may attach additional pages to its response if needed. The State of North Carolina will evaluate Disclosure Statement Information for additional risks, costs, and other factors associated with its service prior to making an award for any such Vendor’s offer. The Vendor must provide the following information in its bid response:

Vendor to complete a.-e. in their offer:

Page 9 of 33 Aug 5, 2026

a. The location of work performed under a state contract by the Vendor, any subcontractors, employees, or other persons performing the contract and whether any of this work will be performed outside the United States.

Vendor to enter text here to answer this disclosure question:

b. The corporate structure and location of corporate employees and activities of the Vendor, its affiliates or any other subcontractors.

Vendor to enter text here to answer this disclosure question:

c. Vendor agrees to provide notice of the relocation of the Vendor, employees of the Vendor, subcontractors of the Vendor, or other persons performing Services under a state contract outside of the United States in the event such relocation occurs during the contract term.

Does Vendor agree to provide notice as defined above? YES NO

d. Vendor agrees that any Vendor or subcontractor providing call or contact center Services to the State of North Carolina shall disclose to inbound callers the location from which the call or contact center Services are being provided.

Does Vendor agree to provide disclosure as defined above? YES NO

e. Will any work under this contract be performed outside the United States? YES NO The use of resources or workers located outside the United States is a critical security exception that must be escalated to the State Chief Information Officer for review pursuant to N.C.G.S. §143B- 1376(c) and §143B-1320(c). These critical security exceptions are approved only in rare and extenuating circumstances. Vendor should account for this when preparing its response.

3.3 E-VERIFY

Pursuant to N.C.G.S. § 143B-1350(k), the State shall not enter into a contract unless the awarded Vendor and each of its subcontractors comply with the E-Verify requirements of N.C.G.S. Chapter 64, Article 2. Vendors are directed to review the foregoing laws. Any awarded Vendor must submit a certification of compliance with E-Verify to the awarding agency, and on a periodic basis thereafter as may be required by the State.

3.4 BRAND SPECIFIC PRODUCT

Manufacturer(s) name and product descriptions used in this solicitation are product specific. The items offered in response to this solicitation must be the manufacturer and type specified. Failure to comply with this requirement will result in rejection of offer.

3.5 SECURITY SPECIFICATIONS

3.5.1 SOLUTIONS HOSTED ON STATE INFRASTRUCTURE - RESERVED

3.5.2 SOLUTIONS NOT HOSTED ON STATE INFRASTRUCTURE

The Agency (named on page one (1)) has designated this solicitation to receive and securely manage data that is classified as:

Page 10 of 33 Aug 5, 2026

Restricted - Restricted data represents the highest risk to the State, State Agencies, and constituents if it is disclosed or compromised. This information is likely to be regulated by State or Federal law, and access to it is restricted to a limited audience (e.g., State and Federal Tax Information [FTI], Payment Card data, Protected Health Information [PHI], Criminal Justice Information [CJI], Social Security Administration provided information, etc.)

Confidential - Includes information that is limited to a small audience with a need-to-know or legitimate business case (e.g., State employee personnel records, trade secrets, student records, sensitive public security information, etc.). If exposed to unauthorized parties, data from this category will cause high impact consequences such as regulatory fines, inability to recruit talent, loss of confidence, and/or damage to vendor relationships. This is not a complete list and is subject to legislative changes.

Internal - This is information typically used within the agency and not for public sharing. Most documents are classified as Internal within the organization, and most State employees would have access. This type of data, if exposed to unauthorized parties, would have a very limited impact on an agency’s reputation, compliance requirements or ability to achieve strategic goals.

Internally classified data does not contain direct identifiers. Often, the effects of the loss of data can be recognized in very subtle ways and may not lead to clear negative consequences causing confusion due to lack of context or minor reputational harm.

Public - Data that is open to public inspection according to state and federal law, or readily available through public sources.

Refer to the North Carolina Statewide Data Classification and Handling policy for more information regarding data classification. The policy is located at the following website:

https://it.nc.gov/document/statewide-data-classification-and-handling-policy.

To comply with the State’s Security Standards and Policies, State agencies are required to perform annual security/risk assessments on their information systems using NIST 800-53 controls.

This requirement additionally applies to all Vendor-provided, agency-managed Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) solutions which will handle data classified as Internal, Confidential, or Restricted.

(a) To comply with the State’s Security Standards and Policies, cloud products are required to comply with applicable FedRAMP or GovRAMP security requirements, including but not limited to, continuous monitoring, incident response, and data classification as outlined in GovRAMP documentation.

(b) To streamline and standardize this requirement the State has adopted GovRAMP which is a Risk and Authorization Management Program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. GovRAMP’s security verification model is based on NIST 800-53 Rev. 5 (or current).

(c) The required GovRAMP verified status will depend on the sensitivity of the data and processes supported by the solution as defined in the Statewide Data Classification and Handling Policy.

(d) For purposes of this solicitation, in accordance with the North Carolina Department of Information Technology Statewide Information Security Manual, a GovRAMP verified status of MEDIUM is required. At offer submission, if the protected system does not currently hold a validated GovRAMP status, the Vendor will be required to provide their GovRAMP Security Snapshot Score and upon request, the complete Snapshot Matrix. If awarded the contract, Vendor shall have an interim period from the effective date of the contract to achieve the verified GovRAMP status outlined above. The interim time periods for each data classification that requires a verified status are further described below. The Vendor https://it.nc.gov/document/statewide-data-classification-and-handling-policy

Page 11 of 33 Aug 5, 2026 shall provision access to the State to their continuous monitoring packages at a [standard] or [elevated] access level within fourteen (14) days of contract award, and seven (7) days of any subsequent GovRAMP status changes. If a non-disclosure agreement (NDA) is required by the Vendor, a copy of the NDA must be uploaded with the response and executed by the Vendor and the State at the time of contract award.

a. Public - For third-party cloud services where the highest category of information to be processed is Public data, the Vendor must submit an updated score for the product annually throughout the contract duration that meets or exceeds the original score at time of contract award. Products with GovRAMP Core, Ready, Authorized or Provisionally Authorized statuses or FedRAMP Rev. 5 authorization also satisfy the security requirement.

b. Internal - For third-party cloud services where the highest category of information to be processed is Internal data, the Vendor must either achieve the status of GovRAMP Core prior to award, or agree to achieve GovRAMP Core status within an interim time period, no later than twelve (12) months from the effective date of the contract.

c. Confidential - For third-party cloud services where the highest category of information to be processed is Confidential data, the Vendor must either achieve a status of GovRAMP Ready, or agree to achieve GovRAMP Ready status no later than fifteen

(15) months from the effective date of the contract.

d. Restricted - For third-party cloud services where the highest category of information to be processed is Restricted Data, the Vendor must either achieve a status of GovRAMP Authorized, or agree to achieve GovRAMP Authorized status no later than twenty-one

(21) months from the effective date of the contract.

Upon contract award, Vendor’s who submitted a GovRAMP Security Snapshot Score will be required to enroll in the GovRAMP Progressing Snapshot program prior to any data being transferred, stored or processed. The Vendor must complete their first Progressing Snapshot within ninety (90) days of award, with the expectation that progress will be made on a quarterly basis and access to progress reports must be provisioned to the State.

Products must maintain their participation in the Progressing Snapshot program and continued access to progress reports must be provisioned to the State until such time that they have achieved the minimum verified status outlined above. The State will review the Vendor’s progress on a quarterly basis and, in its sole discretion, may determine that the Vendor is not making satisfactory progress in the Progressing Snapshot program.

Satisfactory progress shall be a material requirement of the contract.

(e) If the Vendor holds a FedRAMP Rev. 5 authorization at time of award, this authorization can be accepted in lieu of a GovRAMP authorization. Authorizations obtained via the FedRAMP 20x Pilot Program will not be permitted.

If the Vendor’s cloud product currently holds a FedRAMP Authorized designation, at the time of award, the State may require the Vendor to initiate and actively pursue, within thirty

(30) days of award, the GovRAMP Fast Track Process, to achieve a GovRAMP Provisionally Authorized or Authorized status in order to satisfy Statewide continuous monitoring requirements.

(c) Additional Security Documentation. Prior to contract award, the State may in its discretion require the Vendor to provide additional security documentation, including but not limited to, vulnerability assessment reports and penetration test reports. The awarded Vendor shall provide additional security documentation upon request by the State during the term of the contract.

Refer to: https://it.nc.gov/documents/statewide-glossary-information-technology-terms for descriptions of the Application Criticality categories.

https://it.nc.gov/documents/statewide-glossary-information-technology-terms

Page 12 of 33 Aug 5, 2026

Refer to: http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf for descriptions of NIST system confidentiality, integrity, and availability categories.

3.6 ENTERPRISE ARCHITECTURE SPECIFICATIONS

3.6.1 ARCHITECTURE DIAGRAMS - RESERVED

The State utilizes architectural diagrams to better understand the design and technologies of a proposed solution. The two diagrams are Network Architecture and Technology Stack. Details on these diagrams can be found at the following link: https://it.nc.gov/resources/statewide-it-procurement/vendor-engagement-resources#Tab-Architecture-1192

The provision of these two diagrams is preferred at offer submission. If they are not supplied at that time, the State will formally request this information from the Vendor and if it is not supplied within one (1) calendar week, the offer will be considered non-responsive and will not be evaluated.

There may be additional architectural diagrams requested of the vendor after contract award. This will be communicated to the vendor by the agency as needed during the project.

3.6.2 SOLUTION ROADMAP - RESERVED

A Solution Roadmap defines the vision and strategic elements of the solution. The Solution Roadmap is a plan of action for how a Solution will evolve over time. The minimum content should include:

• Vision for the solution

• High-level functionality expected for each solution release into production environment

• High-level timeline

• Description of how customer feedback is collected and incorporated into solution enhancements

Describe the solution roadmap for your product. Include content on release strategies for functionality, roadmap for technical architecture, how scalability of solution is planned.

3.6.3 IDENTITY AND ACCESS MANAGEMENT - RESERVED

The proposed solution must externalize identity and access management. The protocols describing the State’s Identity and Access Management can be found at the following link:

https://it.nc.gov/services/vendor-engagement-resources#Tab-IdentityAccessManagement-1241 Describe how your solution supports the above protocols, as well as making them available for application integration/consumption.

3.6.4 INTEGRATION APPROACH - RESERVED

Describe proposed solution capabilities to interoperate with other solutions. Identify the standards supported, integrations platforms, adaptors, APIs, and the like.

3.6.5 DISASTER RECOVERY AND BUSINESS CONTINUITY - RESERVED

Describe the proposed solution capabilities related to the following areas:

Disaster Recovery Plan (DRP) – describe how proposed solution supports Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO) metrics.

System Backup – describe backup plan capabilities.

Disaster Recovery Testing – describe the frequency and test procedures for end-to-end disaster recovery testing. Business Continuity Plan (BCP) – describe capabilities proposed solution can provide in support of agency’s continuity of operations and incident responses.

3.6.6 DATA MIGRATION - RESERVED

http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf https://it.nc.gov/resources/statewide-it-procurement/vendor-engagement-resources#Tab-Architecture-1192 https://it.nc.gov/resources/statewide-it-procurement/vendor-engagement-resources#Tab-Architecture-1192 https://it.nc.gov/services/vendor-engagement-resources#Tab-IdentityAccessManagement-1241

Page 13 of 33 Aug 5, 2026

Describe approaches available for data conversion and/or data migration to load current data into proposed solution.

3.6.7 APPLICATION MANAGEMENT - RESERVED

Describe how the proposed solution monitors and reports the metrics on system performance.

Describe how the proposed solution manages user administration.

Describe the audit capabilities of proposed solution related to management of the application.

3.6.8 ACCESSIBILITY - RESERVED

Describe how the proposed solution complies with industry accessibility standards.

Provide product documentation that demonstrates how the proposed solution is digitally accessible or if not fully accessible, provide the roadmap with timeline for remediation.

Standards include:

• State of North Carolina Digital Accessibility & Usability Standard

• W3C Web Accessibility Initiative - Web Content Accessibility Guidelines (WCAG) 2.1:

https://www.w3.org/TR/WCAG21/

• Section 508: https://www.section508.gov/

• Voluntary Product Accessibility Template (VPAT®):

https://www.itic.org/policy/accessibility/vpat

ENTERPRISE, SERVICES, AND STANDARDS

Agencies and vendors should refer to the Vendor Resources Page for information on North Carolina Department of Information Technology regarding architecture, security, strategy, data, digital, identity and access management and other general information on doing business with state IT process.

The Vendor Resources Page found at the following link: https://it.nc.gov/vendor-engagement-resources. This site provides vendors with statewide information and links referenced throughout the RFP document. Agencies may request additional information.

3.7 SPECIFICATIONS

SEE SECTION 4.0

3.8 DELIVERY

Successful Vendor will complete supply of the scope of work within ten (10) days after receipt of purchase order to the following location(s): Kevin Violette kevin.violette@dpi.nc.gov or other legitimate contacts they may designate.

If circumstances beyond the control of the contractor result in a late delivery, it is the responsibility and obligation of the contractor to notify the Purchasing Agent listed on the purchase order, in writing, immediately upon determining delay of delivery. The written notification should indicate the anticipated delivery date.

3.9 CONTRACT TERM

A contract awarded pursuant to this IFB shall be one (1) year from the date of contract execution (“Effective Date”).

4.0 FURNISH AND DELIVER

COVERAGE PERIOD: ONE YEAR FROM DATE OF CONTRACT AWARD, 12 MONTHS

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fit.nc.gov%2Fdocuments%2Fdigital-accessibility-usability-standard%2Fopen&data=05%7C02%7Candrea.pacyna%40nc.gov%7C6ff711c554904ca4fefe08dea07c8d50%7C7a7681dcb9d0449a85c3ecc26cd7ed19%7C0%7C0%7C639124653982102920%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=HoeiBL%2FHUIvvm3mFXH37dt6au5cZMhXaQn2%2FRa7cq3k%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fit.nc.gov%2Fdocuments%2Fdigital-accessibility-usability-standard%2Fopen&data=05%7C02%7Candrea.pacyna%40nc.gov%7C6ff711c554904ca4fefe08dea07c8d50%7C7a7681dcb9d0449a85c3ecc26cd7ed19%7C0%7C0%7C639124653982129428%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=oeGml%2FBan%2FQSTWo8MqssmpzMBvwzpHSpw6av66p4rIA%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.w3.org%2FTR%2FWCAG21%2F&data=05%7C02%7Cstarr.christen%40nc.gov%7C3737b44528934d4e45f508dc3a2fddad%7C7a7681dcb9d0449a85c3ecc26cd7ed19%7C0%7C0%7C638449224463390497%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=e02p3b8aB5KB1xe2s6LB3ksZyRtoo09MCHTXDzO5E6Q%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.section508.gov%2F&data=05%7C02%7Cstarr.christen%40nc.gov%7C3737b44528934d4e45f508dc3a2fddad%7C7a7681dcb9d0449a85c3ecc26cd7ed19%7C0%7C0%7C638449224463398992%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=pzgUTV7chyDcngdl6SvQJ3tAIz7RLJvSY02jf8A4SRg%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.itic.org%2Fpolicy%2Faccessibility%2Fvpat&data=05%7C02%7Cstarr.christen%40nc.gov%7C3737b44528934d4e45f508dc3a2fddad%7C7a7681dcb9d0449a85c3ecc26cd7ed19%7C0%7C0%7C638449224463405831%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=5PxuYxDYvzebQ0oJ4qLv%2BXmBS25YhqJa3ms9L3r8c8c%3D&reserved=0 https://it.nc.gov/vendor-engagement-resources https://it.nc.gov/vendor-engagement-resources mailto:kevin.violette@dpi.nc.gov

Page 14 of 33 Aug 5, 2026

ITEM QTY PART NUMBER DESCRIPTION EXTENDED COST

1 1 ATL-CCLPR-100-2-1 Confluence Premium (Cloud Annual), 100 Users, subscription term license, 100 users per instance.

2 1 ATL-GUARD-100 Atlassian Guard Premium Annual, up to 100 users.

3 1 ATL-JSWPR-100 Jira Premium Annual, up to 100 users.

4 1 ATL-SERVCOLPR-100 Service Collection Premium Annual, up to 100 agents. $_____________

5 1 N/A Service Implementation Per Section 4.1 Atlassian Platform Implementation and Initial

Configuration Services

TOTAL EXTENDED COST (ITEMS 1-5) $_____________

4.1 Atlassian Platform Implementation and Initial Configuration Services

The Vendor shall provide the following services:

Environment and Organization Setup

• Establish and configure the Atlassian organization and initial production environment.

• Configure administrative roles and appropriate separation of administrative responsibilities.

• Validate licensing and connectivity across Jira, Jira Service Management, Confluence, and

Atlassian Guard.

Identity and Access Integration

• Integrate Atlassian with the agency's Microsoft Entra ID environment.

• Configure SAML/OIDC SSO as supported.

• Configure SCIM-based user and group provisioning/deprovisioning.

• Configure initial administrative, user, service-management, and privileged-access groups.

• Establish an emergency/break-glass administrative access approach.

Atlassian Guard Baseline

• Enable and configure Guard Premium capabilities applicable to the subscribed products.

• Establish baseline security policies, audit logging, authentication controls, and data-security settings.

• Review recommended security configuration with agency technical/security personnel.

Jira Initial Configuration

• Configure a basic Jira environment suitable for initial project/work management use.

• Establish a reusable baseline project configuration, workflow, issue types, permissions, notifications, and basic automation.

• Configure DEV/UAT or sandbox capabilities that are applicable within the subscription as appropriate for future controlled configuration changes.

Jira Service Management Initial Configuration

Page 15 of 33 Aug 5, 2026

• Configure one operational service project as an initial implementation.

• Establish a basic service/request portal, request types, queues, workflow, SLAs, notifications, and approval capability.

• Establish baseline incident, service request, and change-management functionality.

• Configure an initial Assets/CMDB structure sufficient to demonstrate and support future expansion.

Confluence Initial Configuration

• Configure the Confluence environment and initial space structure.

• Integrate Confluence appropriately with Jira and Jira Service Management for knowledge management and operational documentation.

Administration and Governance Baseline

• Define initial administrator roles and responsibilities.

• Document recommended configuration-management practices for production changes.

• Identify major configuration decisions, dependencies, risks, and recommended next steps.

• Avoid customizations where standard Atlassian capabilities will meet the requirement.

Knowledge Transfer and Documentation

• Conduct administrator orientation/knowledge-transfer sessions covering the implemented configuration.

• Provide configuration documentation sufficient for agency personnel to administer and extend the environment.

• Provide a final implementation/configuration summary and prioritized recommendations for subsequent phases.

5.0 DEPARTMENT OF INFORMATION TECHNOLOGY INSTRUCTIONS TO VENDORS

1) READ, REVIEW AND COMPLY: It shall be the Vendor’s responsibility to read this entire document, review all enclosures and attachments, and comply with all requirements specified herein.

2) DEFINITIONS:

• NCDIT: The North Carolina Department of Information Technology, formerly Office of Information

Technology Services

• NCDIT CONVENIENCE CONTRACT: A contract that is used for the procurement of IT goods or

Services. These contracts are in place for the convenience of the state and use of them is optional.

• OPEN MARKET CONTRACT: A contract for the purchase of goods or Services not covered by a term, technical, or convenience contract.

• TERM CONTRACT: A contract in which a source of supply is established for a specified period of time for specified Services or supplies; usually characterized by an estimated or definite minimum quantity, with the possibility of additional requirements beyond the minimum, all at a predetermined unit price

• THE STATE: Is the state of North Carolina and its agencies.

• VENDOR: Company, firm, corporation, partnership, individual, etc., submitting a response to a solicitation.

3) PROMPT PAYMENT DISCOUNTS: Vendors are urged to compute all discounts into the price offered. If a prompt payment discount is offered, it will not be considered in the award of the contract except as a factor to aid in resolving cases of identical prices.

4) CLARIFICATIONS/INTERPRETATIONS: Any and all questions regarding this document must be addressed to the purchaser named on the cover sheet of this document. Do not contact the user directly. Any and all revisions to this document shall be made only by written addendum from NCDIT.

Page 16 of 33 Aug 5, 2026

The Vendor is cautioned that the requirements of this IFB can be altered only by written addendum and that verbal communications from whatever source are of no effect.

5) ACCEPTANCE AND REJECTION: The State reserves the right to reject any and all offers, to waive any informality in offers and, unless otherwise specified by the Vendor, to accept any item in the offer.

If either a unit price or an extended price is obviously in error and the other is obviously correct, the incorrect price will be disregarded.

6) AWARD OF CONTRACT: Responsive offers will be evaluated and acceptance may be made in accordance with Best Value procurement practices as defined by N.C.G.S. §143-135.9. Unless otherwise specified by the State or the Vendor, the State reserves the right to accept any item or group of items on a multi-item offer. In addition, on agency specific or term contracts, NCDIT reserves the right to make partial, progressive or multiple awards: where it is advantageous to award separately by items; or where more than one supplier is needed to provide the contemplated requirements as to quantity, quality, delivery, service, geographical areas; other factors deemed by NCDIT to be pertinent or peculiar to the purchase in question.

7) MISCELLANEOUS: Masculine pronouns shall be read to include feminine pronouns and the singular of any word or phrase shall be read to include the plural and vice versa.

8) PROTEST PROCEDURES: When an offeror wants to protest a contract awarded pursuant to this solicitation that is over $25,000 they must submit a written request to the issuing agency at the address given in this document. This request must be received in this office within fifteen (15) calendar days from the date of the contract award, and must contain specific sound reasons and any supporting documentation for the protest. Note: Contract award notices are sent only to those actually awarded contracts, and not to every person or firm responding to this solicitation. IFB status and Award notices are posted on the Internet at https://evp.nc.gov. All protests will be governed by NCAC Title 9, Department of Information Technology (formerly Office of Information Technology Services), Subchapter 06B Sections .1101 - .1121.

9) VENDOR REGISTRATION AND SOLICITATION NOTIFICATION SYSTEM The electronic Vendor Portal (eVP) allows Vendors to electronically register with the State to receive electronic notification of current procurement opportunities for goods and services available on the eVP at the following web site: https://evp.nc.gov.

10) DIGITAL IMAGING: The State will digitize the Vendor’s response if not received electronically, and any awarded contract together with associated contract documents. This electronic copy shall be a preservation record, and serve as the official record of this solicitation with the same force and effect as the original written documents comprising such record. Any printout or other output readable by sight shown to reflect such record accurately is an "original."

https://evp.nc.gov/ https://evp.nc.gov/

Page 17 of 33 Aug 5, 2026

6.0 DEPARTMENT OF INFORMATION TECHNOLOGY TERMS AND CONDITIONS

General Terms and Conditions Applicable to Software as a Service (SaaS)

1) DEFINITIONS

a) “Data” means information, formulae, algorithms, or other content that the State, the State’s employees, agents and end users upload, create or modify using the Services pursuant to this Agreement. Data also includes user identification information and metadata which may contain Data or from which the State’s Data may be ascertainable.

b) “Deliverable/Product Warranties” shall mean and include the warranties provided for products or deliverables licensed to the State as included in Paragraph 7) c) of these Terms and Conditions unless superseded by the Vendor’s Warranties pursuant to the Vendor’s License or Support Agreements.

c) “Services” shall mean the duties and tasks undertaken by the Vendor to fulfill the requirements and specifications of this solicitation including, without limitation, providing web browser access by authorized users to certain Vendor online software applications identified herein and to related services such as Vendor hosted Computer storage, databases, Support, documentation, and other functionalities, all as a Software as a Service (“SaaS”) solution.

d) “State” shall mean the State of North Carolina, the NC Department of Information Technology as an agency, or the agency identified in this solicitation as the Purchasing State Agency and Award Authority.

e) “Support” includes provision of ongoing updates and maintenance for Vendor online software applications and, as may be specified herein, consulting, training and other support Services as provided by the Vendor for SaaS tenants receiving similar SaaS Services.

2) ACCESS AND USE OF SAAS SERVICES

a) The Vendor grants the State a personal non-transferable and non-exclusive right to use and access, all Services and other functionalities or services provided, furnished or accessible under this Agreement. The State may utilize the Services as agreed herein and in accordance with any mutually agreed Acceptable Use Policy. The State is authorized to access State Data and any Vendor-provided data as specified herein and to transmit revisions, updates, deletions, enhancements, or modifications to the State Data. This shall include the right of the State to, and access to, Support without the Vendor requiring a separate maintenance or support agreement. Subject to an agreed limitation on the number of users, the State may use the Services with any computer, computer system, server, or desktop workstation owned or utilized by the State or other authorized users. User access to the Services shall be routinely provided by the Vendor and may be subject to a more specific Service Level Agreement (SLA) agreed to in writing by the parties. The State shall notify the Vendor of any unauthorized use of any password or account, or any other known or suspected breach of security access. The State also agrees to refrain from taking any steps such as reverse engineering, reverse assembly or reverse compilation to derive a source code equivalent to the Services or any portion thereof. Use of the Services to perform services for commercial third parties (so-called “service bureau” uses) is not permitted but

Page 18 of 33 Aug 5, 2026 the State may utilize the Services to perform its governmental functions. If the Services fees are based upon the number of Users and/or hosted instances, the number of Users/hosted instances available may be adjusted at any time (subject to the restrictions on the maximum number of Users specified in the Furnish and Deliver Table herein) by mutual agreement and State Procurement approval.