34570-41027_RFP_AMD_3_Assistive_Technology.pdf

PDF 276 KB Posted

Attached to
Assistive Technology - UPDATED
Solicitation number
RFP 34570-41027
Issued by
Tennessee

About this file

This is Amendment #3 to a Request for Proposals issued by the Tennessee Department of Human Services for Assistive Technology Services (RFP #34570-41027). The amendment updates the RFP schedule and provides state responses to 43 questions and comments submitted by potential respondents. The RFP seeks assistive technology services including assessments, training, equipment delivery and installation, and service coordination and technical support for vocational rehabilitation customers. A pre-response conference was held on June 4, 2026, with a notice of intent to respond deadline of June 8, 2026, written questions deadline of June 18, 2026, and proposal response deadline of July 15, 2026 at 2:00 p.m. Central Time. The state will complete technical evaluations by July 23, 2026, open and score cost proposals on July 24, 2026, conduct negotiations on July 27, 2026, and release the notice of intent to award on July 28, 2026. The protest period ends August 4, 2026, with contract signature deadline of August 6, 2026. The contract term runs from October 1, 2026 through September 30, 2031, representing a five-year period.

Respondents must propose rates for all five contract years and may adjust rates annually to account for staffing, insurance, travel, and inflationary increases. All proposed service rates must be all-inclusive, encompassing travel, mileage, report writing, documentation, equipment storage, and all other costs without separate line items or reimbursement. The RFP explicitly states no minimum quantity guarantees. Regarding information security, respondents hosting or storing state data must obtain one of the following certifications or audits prior to contract effectiveness: SOC 2 Type II, NIST 800-53, ISO 27001, HITRUST, FedRAMP, or GovRAMP. The state will not accept alternative security measures in lieu of formal third-party audits or certifications. All background checks and security compliance documentation must be completed before the contract effective date. A no-cost transition and mobilization period will occur after award, with participants expected to attend quarterly meetings and provide quarterly trainings to vocational rehabilitation staff without separate compensation.

View the file

Other files

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

RFP # 34570-41027 – Amendment # 3 Page 1 of 14

STATE OF TENNESSEE

Tennessee Department of Human Services

REQUEST FOR PROPOSALS # 34570-41027

AMENDMENT # 3

ASSISTIVE TECHNOLOGY SERVICES

DATE: 7/8/2026

RFP # 34570-41027 IS AMENDED AS FOLLOWS:

1. This RFP Schedule of Events updates and confirms scheduled RFP dates. Any event, time, or date containing revised or new text is highlighted.

EVENT

TIME

(central time zone)

DATE

1. RFP Issued May 29, 2026

2. Disability Accommodation Request Deadline

4:00 p.m.

June 3, 2026

3. Pre-response Conference 11:00 a.m. June 4, 2026

4. Notice of Intent to Respond Deadline

4:00 p.m.

June 8, 2026

5. Written “Questions & Comments” Deadline

4:00 p.m.

June 18, 2026

6. State Response to Written “Questions & Comments”

July 8, 2026

7. Response Deadline 2:00 p.m. July 15, 2026

8. State Completion of Technical Response Evaluations

July 23, 2026

9. State Opening & Scoring of Cost Proposals

2:00 p.m.

July 24, 2026

10. Negotiations July 27, 2026

11. State Notice of Intent to Award Released and RFP Files Opened for Public Inspection

2:00 p.m.

July 28, 2026

12. End of Protest Period August 4, 2026

13. State sends contract to Contractor for signature

August 5, 2026

RFP # 34570-41027 – Amendment # 3 Page 2 of 14

14. Contractor Signature Deadline 2:00 p.m. August 6, 2026

2. State responses to questions and comments in the table below amend and clarify this RFP.

Any restatement of RFP text in the Question/Comment column shall NOT be construed as a change in the actual wording of the RFP document.

RFP

SECTION

PAGE

QUESTION / COMMENT STATE RESPONSE

1. Could you please clarify the information security requirements? The RFP references SOC 2 Type II, NIST 800- 53 audits, ISO 27001, HITRUST, GovRAMP, and Fed RAMP. For assistive technology service providers that primarily perform assessments, training, and equipment-related services, what specifically is required and at what stage of the procurement process?

Are Respondents expected to already have one of these certifications or audits in place when proposals are submitted, or would compliance be required only after award?

See the State’s response to Question #41 below

Please also see amended language to RFP Attachment 6.2. – Section A – Item A.9. under Item 3 below.

2. Several pages appear to reference

RFS#34570-41026 while the cover page, communications section, and other sections reference RFP #34570-41027 (pages 6, 7, 12, 16, 20, 23, and 26.

Please confirm that the correct solicitation number for all submissions, file names, email subject lines, cost proposals, and official communications is RFP#34570-41027.

The correct solicitation number is 34570-41027.

Please see amended language to RFP # 34570-41027 for Assistive Technology – Release 2 below.

3. For an email submission, may a Respondent submit one Technical Response PDF and separate Cost Proposal files for each Service Area in separate cost proposal emails, or must all Service Area Cost Proposals be included in one Cost Proposal email?

A respondent may submit multiple cost proposals in one email, as long as that email is a separate email from the technical response

4. When services are provided at a Customer's residence, job site, school, or other requested location, should the Respondent include all travel, mileage, lodging, scheduling, and staff time in the proposed service rates, or will any travel-related reimbursement be available separately?

See RFP ATTACHMENT 6.6. RFP #

34570-41027 PRO FORMA

CONTRACT - Section C.4.

Services are expected to be delivered in the most appropriate location for the customer, based on their needs and circumstances. Proposed rates must fully encompass all aspects of service delivery, including any travel required. No separate reimbursement for travel or travel-related expenses will be made.

RFP # 34570-41027 – Amendment # 3 Page 3 of 14

PAGE

QUESTION / COMMENT STATE RESPONSE

5. Please provide any available historical utilization data by Service Area and by service category, including breakdown by disability, if available, number of assessments, training hours, delivery/installation events, and technical support requests. The current table provides estimated annual cost and estimated number of customers but does not break demand down by compensable service unit. This is necessary to accurately determine cost.

Estimates provided in RFP Section 1 Table 1 are based on available historical data.

6. The proforma contract requires the Contractor to contact the Customer within five business days after referral, schedule the assessment within ten business days after referral, and complete the assessment within thirty calendar days after receipt of referral unless otherwise directed in writing. If the Contractor is unable to reach the Customer after documented attempts, will the timeline pause, reset, or remain active?

Please see amended language to

RFP # 34570-41027 for Assistive

Technology – Release 2, Attachment

6.6., Pro Forma Contract, Section A.3.

below.

If the Contractor has been unable to reach the Customer within 5 business days, it is the Contractor's responsibility to notify the appropriate VR contact so the outreach efforts and inability to establish contact can be documented.

7. What information will be included in the State's referral or work order, and will it include the Customer's IPE, disability-related information, employment goal, preferred communication method, authorized service type, and billing authorization?

The State's referral includes the necessary customer demographic information and the specific service(s) requested. The referral also includes the reason for the referral, with a request to note the Customer's goal and any additional relevant comments. Relevant disability-related information and the Individualized Plan for Employment (IPE) can be made available when appropriate to support service delivery.

8. Will referrals be transmitted through a State system, secure email, or another platform?

Please identify the expected referral management process, including any required Respondent portal.

Referrals will be transmitted in the manner designated by the State. At this time, referrals are transmitted via secure email from the appropriate VR staff members.

There is no Respondent portal.

9. The Cost Proposal uses one "Assistive Technology Assessment & Assessment Report" unit. Please clarify whether this unit includes all assessment time, demonstrations, documentation review, consultation with the Rehabilitation Counselor, report writing, report revisions, and

The Assistive Technology

Assessment & Report component includes all activities necessary to complete both the assessment and the written report. This includes, but is not limited to, preparation, direct assessment time involving customer

RFP # 34570-41027 – Amendment # 3 Page 4 of 14

PAGE

QUESTION / COMMENT STATE RESPONSE

follow-up questions after submission engagement with appropriate assistive technology, relevant discussion, research, report development, revisions, and submission of the final report.

Payment for this service cannot be made until the completed report is submitted to VR.

Assistive Technology Training refers to the instruction on the use of recommended assistive technology to increase the customer's knowledge and skills. The reported unit for this service is based on number of training hours provided.

Delivery & Installation includes the delivery of recommended equipment to the customer at the location requested by the customer and necessary installation.

Installation includes all labor required to assemble, deliver, set-up, install, or otherwise make the assistive technology operable. To the greatest extent possible, the

Contractor shall complete preliminary installation of all hardware and software prior to delivery to the Customer. The reported unit for this service is based on the delivery of all assistive technology to the customer in a visit, not per piece of equipment delivered. It is the intent for all equipment to be delivered in one visit unless there are extenuating circumstances.

Service Coordination & Technical

Support may be used to account for the service coordination, communication, and other support activities necessary to facilitate services for customers.

10. If a Customer requires assessment across multiple functional areas, such as blind /low vision access, computer access, ergonomic access, communication access, and workplace accommodations, will that be considered one assessment unit or multiple assessment units?

Because customers often have needs across multiple functional areas, the activities required to complete the overall assessment needed to prepare for competitive integrated employment are considered a single assessment when they occur as part of the same assessment process.

RFP # 34570-41027 – Amendment # 3 Page 5 of 14

PAGE

QUESTION / COMMENT STATE RESPONSE

11. If an assessment must occur over more than one appointment due to disability-related stamina, equipment availability, technology complexity, or worksite scheduling, will it still be billoo as one assessment unit?

If an assessment occurs across multiple appointments, it is still billed as a single assessment. The Assistive Technology Assessment & Assessment Report service is not considered complete and therefore cannot be billed-until the final report has been submitted to VR.

12. Will the State provide a required assessment report template before the Contract Effective Date, and may Respondents include sample reports in the proposal appendix to demonstrate quality and clinical approach?

The State will provide expectations of what must be included in any assessment report such as essential demographic information, assessment date and location, customer goal, purpose of the assessment, assessment details including assistive technology trials/ discussion, assistive technology recommendations, any necessary quotes, and training recommendations.

Please see RFP ATTACHMENT 6.2.

Section C.10 As referenced, a sample assessment report is expected with the submission.

13. The RFP requires training status reports upon completion of each training segment or monthly, whichever occurs first, and additional written approval before further training may begin. Please define "segment of training" and clarify whether segments will be established by the Rehabilitation Counselor, the Contractor, the purchase order, or the assessment report recommendation. Also, what timeframe will the Rehabilitation Counselor have to confirm/deny the additional approval for services?

At minimum, a monthly training report is required. Segments of training refer to any training completed that does not encompass a full month of service. Some customers may require only a small amount of training that can be fully completed in less than a month, while others may have a shorter segment of training near the end of a longer overall training timeline.

Although these segments do not constitute a full month of training, a training report is still required at the conclusion of those training activities, even if no additional training is being requested.

The timeframe for confirmation of approval or denial of additional training will follow VR's standard authorization process. VR will review requests in a timely manner and communicate the approval decision or any need for additional information as quickly as possible.

Respondents should ensure that requests for additional training include sufficient detail to support

RFP # 34570-41027 – Amendment # 3 Page 6 of 14

PAGE

QUESTION / COMMENT STATE RESPONSE

VR's decision making and to avoid delays in authorization.

14. May Assistive Technology training be delivered remotely when appropriate for the Customer's needs, technology platform, and employment goal, or is in-person training expected as the default method?

Virtual assistive technology training may be provided when it is appropriate for the customer, it aligns with their preferences, supports the technology being used, and is consistent with their employment goals.

Please see RFP ATTACHMENT 6.2.

- Section C.14 which requests the

Respondent provide factors that will be used to determine the

Respondent's ability to utilize virtual training.

15. What is the billing increment for Assistive Technology Training: one hour, quarter-hour, half-hour, or another increment?

What is the minimum allotted timeframe of the assistive technology training to take place?

Please see amended language to

RFP # 34570-41027 for Assistive

Technology – Release 2, Attachment

6.6., Pro Forma Contract, Section A.5.

below.

Billing increments (applicable only to Assistive Technology Training) occur at minimum for 1 hour with additional time beyond the first hour billed at half-hour increments. A minimum of one hour per training session is expected. Typical training sessions range from 1.5 to

2 hours, depending on the customer's needs and abilities, to ensure consistent and timely support that helps them develop the proficiency required to meet their employment goals.

16. If a training appointment is cancelled late, missed by the Customer, or interrupted due to technology failure outside the Contractor's control, may any portion of the scheduled time be billed? If not, will the State establish a cancellation or no-show policy?

If a training session does not occur-whether due to a late cancellation, no-show or technology interruption during virtual or in-person, or any other reason - no portion of that session is billable.

VR does not have an enforceable cancellation or no-show policy that can be applied to customers. If concerns arise related to repeated missed sessions, the Respondent may communicate with the VR Counselor to document the occurrences and collaborate on a plan or strategy for moving forward with training.

RFP # 34570-41027 – Amendment # 3 Page 7 of 14

PAGE

QUESTION / COMMENT STATE RESPONSE

17. May training occur before the Customer receives final equipment when the training can be provided using trial equipment, built-in accessibility tools, or comparal:of software, provided that the Rehabilitation Counselor approves in advance?

Circumstances may occur when it is appropriate to begin training on recommended assistive technology tools prior to the ordering and receipt of a customer's personal equipment.

The Vocational Rehabilitation

Counselor can approve such training if in alignment with their employment goals and reflected on their IPE.

18. The Cost Proposal includes "Service Coordination & Technical Support" as a monthly compensable increment.

Please define the monthly unit. Is it billed once per awarded Service Area per month, once per active Customer per month, once per contractor location per month, or only in months when a qualifying technical support event occurs?

The Service Coordination & Technical Support is the proposed flat rate billed monthly for the service area. This is not dependent on the specific number of customers, technical support inquiries, or any other numeric measure. This Cost Item is intended to account for elements of service coordination, which may include tasks such as communication with counselors or customers, as well as technical support that are not otherwise directly reported within another Cost Item.

19. Please identify the minimum deliverables required to bill the monthly Service Coordination & Technical Support rate, in duding whether it covers scheduling, case coordination, communication with VR staff, troubleshooting, documentation, and technical support.

Service Coordination & Technical

Support includes all of the services outlined in the question. This cost item is not tracked by individual occurrences and therefore does not have a minimum deliverable requirement. It is expected to be billed monthly, as these activities are essential to fulfilling contract expectations and ensuring ongoing service continuity.

While no individualized reporting is required for billing, Respondents are expected to maintain documentation within their case management systems that supports the occurrence of these services.

20. The proforma contract requires troubleshooting services to be initiated no later than one business day after Customer contact. Please define "initiate." Does this mean acknowledging receipt, attempting remote troubleshooting, scheduling an appointment, or resolving the issue?

Initiation of troubleshooting services within one business day requires, at minimum, an attempted contact with the customer, gathering information about the issue, and providing preliminary remote technical assistance when possible. It is understood that more complex situations may not be resolved during the initial contact. In such cases, follow up remote support or scheduling of an in-person visit

RFP # 34570-41027 – Amendment # 3 Page 8 of 14

PAGE

QUESTION / COMMENT STATE RESPONSE

should occur at the earliest feasible time to ensure continued access for the customer.

21. If troubleshooting identifies the need for additional training, equipment replacement, software repair, or a new assessment, what authorization is required before the Contractor proceeds?

If troubleshooting identifies the need for additional training, equipment replacement / software upgrades/repairs, or a new assessment, services must be requested by the Vocational Rehabilitation Counselor to initiate additional services.

22. The RFP requires delivery and installation no later than ten business days after the Contractor receives all Assistive Technology items. If installation is delayed because a Customer is unavailable, a worksite is inaccessible, credentials or software licenses are pending, or equipment arrives incomplete or defective, will the deadline be extended based on documentation?

No, if any of those occur, all assistive technology would be deemed to have ‘not arrived’ and the delivery timeframe would not begin until such issues were resolved. Prompt communication with Vocational Rehabilitation

Counselor would be necessary to address the issues.

If installation is delayed due to reasons such as customer availability access to the customer's worksite, understanding would be given for the 10-day deadline not being met. The Respondent is expected to communicate with the

Vocational Rehabilitation Counselor to document the reason for the delay and provide updates regarding the delivery status.

23. For staff who do not hold ATP certification, a university Assistive Technology certificate, or the named visual impairment credential, or they are in the process of obtaining certification, a university Assistive Technology certificate or visual impairment credential, what is the expected approval process, timeline, and minimum documentation required before the individual may provide services?

Please see RFP ATTACHMENT

6.6. RFP # 34570-41027 PRO

FORMA CONTRACT Section

A.10. for minimum documentation required for individuals not possessing the identified certifications or credentials.

If noted as key personnel under RFP

Attachment 6.2. - B.13., the resume should be submitted with the proposal.

24. Will the State provide all required service report, assessment report, training status report, training outcome report, invoice support, inventory, and quarterly summary templates during the transition and mobilization period?

The State will provide the invoice and associated monthly report template required for billing.

Contractors are responsible for operating and maintaining a reliable case management system/ process that facilitates the generation of reports to complete necessary information for billing. Services must be reported for each customer and the quantity of

RFP # 34570-41027 – Amendment # 3 Page 9 of 14

PAGE

QUESTION / COMMENT STATE RESPONSE

services received for the report.

The Contractor(s) are responsible for providing their own inventory, maintaining, and tracking accordingly. No inventory items, funds, or tracking will be provided by the State.

Contractors must also have a mechanism to track equipment received for customers.

Contractors are responsible for creating and providing their own assessment reports, training reports, training outcome reports and any other necessary documents in an accessible format.

If the State creates forms internally during the life of the contract, appropriate notifications will be provided.

All forms and requirements will be discussed in greater detail with all contractor(s) after awarding of the contract(s) during the transition period.

25. Please clarify whether reports must be submitted through a State system, by secure email, or through another approved method. If a State system is required, will training and access be provided before the Effective Date?

The current methodology for submitting individual customer reports is via secure email.

Invoices and associated monthly reports documenting all billable services are currently submitted through an electronic submission system. Minimal access is necessary to submit. Access may not be provided in advance of the effective date but will be provided by the end of the month of service.

26. Attachment 6.2 asks Respondents to identify third-party information security certifications, authorizations, examinations, assessments, or audits.

Please clarify whether ISO/IEC 27001, Fed RAMP, GovRAMP, or similar third-party certifications are mandatory for all Respondents, or only required when the Contractor hosts, stores, or processes State Data in the Contractor's own system.

Please see State’s response to Question #1.

27. If the Contractor uses State-approved Please see State’s response to

RFP # 34570-41027 – Amendment # 3 Page 10 of 14

PAGE

QUESTION / COMMENT STATE RESPONSE

systems, encrypted email, or State-provided templates rather than hosting State Data in a separate contractor platform, what information security documentation is sufficient for a responsive proposal?

Question #1.

28. Please identify the specific background check requirements under Tennessee Department of Human Services Chapter 1240-08-03-.05, including whether checks must be completed before the Effective Date, before direct Customer contact, or before staff are placed on the approved roster.

Please see Department of Human Services Tenn. Comp. R. & Regs Chapter 1240-08-03-.05 Section 6 - Contract Vocational Rehabilitation Workers. All requirements must be completed before the effective date of the contract.

29. The transition and mobilization period is no-cost to the State. Please clarify the expected transition activities, estimated meeting frequency, required Respondent training time, and any pre-effective-date documentation that must be completed by the Contractor.

Please see RFP ATTACHMENT 6.6.

RFP # 34570-41027 PRO FORMA

CONTRACT Section A.18.

30. Will the State provide reasonable access to incumbent transition information, open referrals, reporting templates, Respondent training materials, and State policies during the transition and mobilization period?

Please see RFP ATTACHMENT

6.6. RFP # 34570-41027 PRO

FORMA CONTRACT Section

A.18. No access to State Data will be available during transition and mobilization period.

31. The Cost Proposal requires rates for each contract year from October 1, 2026through September 30, 2031. May Respondents propose different rates by year to account for staffing, insurance, travel, technology, and inflationary cost increases?

Yes, please see RFP ATTACHMENT

6.3.

32. Because the payment methodology states that rates include all applicable taxes, fees, overhead, and direct and indirect costs, please confirm that Respondents should not include separate line items for travel, administrative time, software, report writing, equipment storage, or mileage unless those costs are incorporated into the listed service rates.

Yes, the State confirms. The only

Cost Items billable for payment are

Assistive Technology Assessment

& Training, Assistive Technology

Training, Delivery and Installation, and Service Coordination &

Technical Support. Respondents cannot include additional line items for other expenses. Proposed rates for set services must include coverage for all service needs.

Please see RFP ATTACHMENT 6.6.

RFP # 34570-41027 PROFORMA

CONTRACT - Section C.4.

33. Please clarify whether "Service Coordination & Technical Support" is included in the cost evaluation factor of 12 as twelve months per contract year, twelve months total, or another

The evaluation factor of 12 for "Service Coordination & Technical Support" represents 12 times per year, indicating the proposed amount is

RFP # 34570-41027 – Amendment # 3 Page 11 of 14

PAGE

QUESTION / COMMENT STATE RESPONSE

assumed utilization figure. billable monthly (12x/year).

34. The RFP states that the State does not guarantee any minimum quantity of goods or services. Will the State provide historical annual counts by service category to support realistic pricing and staffing projections?

Please see State’s response to Question #5.

35. The proforma contract requires quarterly meetings and quarterly training to VR employees.

Are quarterly meetings and VR staff trainings included in the monthly Service Coordination & Technical Sup port rate, or will they be separately authorized and compensated?

Participation in quarterly meetings and quarterly trainings with VR staff are not compensated separately as a billable service.

Participation is expected to ensure communication and education for staff to yield positive outcomes for customers. Any projected incurred expenses must be incorporated into rates for billable services, which may include "Service

Coordination & Technical Support".

36. Will quarterly VR staff trainings be required separately for each awarded Service Area, or may a Contractor awarded multiple Service Areas provide one combined regional or statewide virtual training when approved by the State?

Quarterly VR staff trainings are currently expected to be conducted separately for each awarded service area, as quarterly gatherings of staff virtually or in-person typically occur by regions aligning with service areas. Training of multiple service areas may be considered and approved on an individual basis if in alignment with regional activities or other State requested activities.

37. Please clarify whether VR staff training materials must be submitted for State approval before delivery and whether the State will identify required quarterly training topics.

Currently VR staff training materials are not submitted for approval by the State in advance of delivery.

However, requirements could change based on internal guidance during the life of the contract.

38. Because Assistive Technology service delivery often requires disability-specific expertise, Respondent recommends that the State clarify that a qualified interdisciplinary team or approved subcontractor model is acceptable when the prime contractor maintains responsibility for coordination, quality assurance, reporting, and compliance.

Please see RFP Section 4.4.2. and RFP Attachment 6.2., Section B, General Qualifications & Experience Item B.14. The Respondent can include detail on use of subcontractors.

39. Respondent recommends that the

State clarify remote and hybrid service delivery expectations because remote troubleshooting and training can imp rove

The narrative response to C.8 provides an opportunity to describe the variety of locations where services may be delivered, including

RFP # 34570-41027 – Amendment # 3 Page 12 of 14

PAGE

QUESTION / COMMENT STATE RESPONSE

timeliness, reduce travel burden, and support Customers in rural counties when clinically appropriate.

the use of virtual environments when appropriate.

Similarly, the narrative for C.14 allows Respondents to outline a more comprehensive approach to training. This may include virtual training strategies, as long as they support effective learning and align with the overall training model.

It is reasonable to expect that some virtual troubleshooting and training will occur. However, these methods should be used only when they are truly appropriate for the customer's needs, not as a means to reduce the cost of providing services. Ensuring quality services that support successful outcomes remains the priority.

40. Respondent recommends that the State define the Service Coordination & Technical Support monthly unit in an amendment because this item materially affects pricing and may be interpreted differently by Respondents.

Cost proposals for Service

Coordination and Technical

Assistance across all service areas are assigned an evaluation factor of 12.

Evaluation factors represent the number of service units expected per year. In this case, a factor of 12 indicates that the established flat rate for this service will be billed monthly.

This flat monthly rate is not tied to the number of individual customers served in any given month. Instead, it reflects the ongoing availability and provision of Service Coordination and Technical Assistance across the year, regardless of fluctuations in customer volume.

41. The security requirements referenced in the RFP appear to align with standards more commonly associated with large IT service providers and may present a significant barrier for small disability service organizations that do not routinely manage enterprise-level information systems.

Can the State clarify whether alternative security measures may be accepted in lieu of a formal third-party audit or certification requirement?

No, the State is not accepting alternative security measures.

All Contractors receiving customer referrals from the State with customer Personally Identifiable Information (also known as State Data) is considered as hosting State Data. The transmission and storage of an email referral and its associated information whether on Respondent’s on-premises server or on a third-party cloud server is hosting State Data. Therefore, Respondents will be required to meet

RFP # 34570-41027 – Amendment # 3 Page 13 of 14

PAGE

QUESTION / COMMENT STATE RESPONSE

Examples of altemative safeguards may include:

• Written information security policies and procedures

• Annual cybersecurity awareness training for staff

• Multi-factor authentication (MFA)

• Encrypted storage and transmission of client information

• Secure cloud-based systems (Microsoft 365, Google Workspace, etc.)

• Cyber liability insurance coverage

• Background checks for staff with access to customer information

• Compliance with applicable HIPAA, ADA, VR, and state confidentiality requirements

• Completion of a security self-assessment and attestation

Given the nature of Assistive Technology services under this contract, would the State consider alternative security documentation or risk-based security controls that would allow qualified small businesses to compete while still ensuring the protection of customer information?

one of the certificates, examinations, standards, or audits prior to any awarded Contract being effective.

42. As a small assistive technology services provider, we perform evaluations, training equipment delivery, and related rehabilitation services, but we do not host State applications, cloud environments, or technology platforms on behalf of the State.

Could the State please clarify whether the requirements related to SOC 2

Question #41 above.

RFP # 34570-41027 – Amendment # 3 Page 14 of 14

PAGE

QUESTION / COMMENT STATE RESPONSE

Type II, NIST 800-53 audits, ISO 27001, HITRUST, FedRAMP, or GovRAMP apply to all respondents, or only to Respondents maintaining State Data environments or hosting State systems?

If these requirements apply to all Respondents, would the State consider alternative methods of demonstrating information security compliance for small service based providers that do not host State systems, such as documented security policies, encryption practices, multi-factor authentication, staff confidentiality agreements, and other administrative safeguards?

43. Could you please clarify the information security requirements? The RFP references SOC 2 Type 11, NIST 800-53 audits, ISO

27001, HITRUST,

GovRAMP, and FedRAMP.

For assistive technology service providers that primarily perform assessments, training, and equipment-related services, what specifically is required and at what stage of the procurement process?

Are Respondents expected to already have one of these certifications or audits in place when proposals are submitted, or would compliance be required only after award?

Question #1.

3. Delete RFP # 34570-41027, in its entirety, and replace it with RFP # 34570-41027, Release # 2, attached to this amendment. Revisions of the original RFP document are emphasized within the new release. Any sentence or paragraph containing revised or new text is highlighted.

4. RFP Amendment Effective Date. The revisions set forth herein shall be effective upon release. All other terms and conditions of this RFP not expressly amended herein shall remain in full force and effect.

File details come from the government source that posted it. Updated .