4-RFI-2606AM Invitation Requirements.pdf

RFI-2606AM

Performance Evaluation System Invitation & Requirements

Gwinnett County Public Schools (GCPS) Human Resource Department is soliciting a Request for Information (RFI) from interested service providers for a Performance Evaluation System. GCPS is looking to implement a new employee evaluation system for the 2027-2028 school year that complies with the Georgia State laws as it relates to teacher evaluations. The system must also be flexible enough to allow for the evaluation of all other team members using different metrics and evaluations forms. Gwinnett County Public Schools employs approximately 25,000 employees that will require evaluations. Overall, it is likely we will need approximately 10 to 15 different evaluation templates. Finalists will be expected to demonstrate their system onsite once finalists are determined. This RFI is issued solely for information and planning purposes. This RFI is NOT a solicitation and does NOT commit any organization to procure any goods or services.

RFI submissions will be received digitally until June 8, 2026 at 10:00AM EST, through Euna Procurement (located at https://gwinnett.bonfirehub.com or by visiting the GCPS Purchasing website at https://www.gcpsk12.org. Questions regarding this RFI must be received in Euna Procurement under the “Message Center” section no later than May 26, 2026 at 10:00AM EST to allow for appropriate and timely responses.

Addenda & Opening of Submissions It is the ultimate responsibility of the supplier to ensure that they have all applicable addenda prior to submitting a response. Addenda will be posted on Euna Procurement: www.gwinnett.bonfirehub.com or by visiting the GCPS Purchasing website at https://www.gcpsk12.org/about-us/divisions-and-teams/business-and-finance/bids-purchasing-opportunities. The opening of this request will be conducted electronically through Euna Procurement.

Requirements Please submit your RFI response by addressing each section in the order specified below.

General Information

1. Provide a brief description of your company’s history, number of employees, and years in operation.

2. Identify the primary location(s) that will provide support for the requested tool.

3. Describe your experience working with K–12 and/or higher education organizations. Provide examples of large organizations served (including non-K–12 clients) with 15,000+ employees.

Account Service

1. Describe how this account will be serviced. Will any services require outsourcing? If so, which types of services?

2. Outline your escalation process for service issues both during implementation and after implementation.

3. Describe how administrative and technical issues are resolved with the system. Include the metrics used for resolving concerns.

4. Describe the Service Level Agreement (SLA) offered by your company as it relates to service response time.

5. If selected, describe how you would aid in the transition of services.

6. How does your system ensure ongoing compliance with Georgia evaluation requirements for teachers?

As an example, if Georgia updates or replaces GTES with Georgia LEADS. Describe your change management process for regulatory updates, including customer support and implementation timelines.

7. Identify who is responsible for implementation. Is it outsourced?

8. How difficult is it to enable features that are initially disabled at the time of implementation?

9. Describe how system maintenance and updates are scheduled.

http://www.gcpsk12.org/Page/24587 http://www.gwinnett.bonfirehub.com/ https://www.gcpsk12.org/about-us/divisions-and-teams/business-and-finance/bids-purchasing-opportunities https://www.gcpsk12.org/about-us/divisions-and-teams/business-and-finance/bids-purchasing-opportunities

Overall System

1. Describe your platform.

2. Include an implementation timeline along with the customer resources typically required for the implementation.

3. Describe the training provided to the Gwinnett team.

4. Describe the roles and scope of account support.

System Features (ATTACHMENT A)

1. Attachment A lists the desired features for the performance evaluation system. For each feature, indicate whether it exists in your current version or is not available. If the feature exists, indicate whether the system requires Configuration or Customization.

Configuration - GCPS can set the feature up using internal resources with delivered functionality.

Customization - Vendor development or modification to the base delivered model is required.

2. Describe how the feature works within your system.

Architecture Review Board (ARB) Questions

1. System Architecture & Design

1. Provide a high-level architecture diagram of your solution, including major components, integrations, data flow, and hosting environment.

2. Is the solution cloud-hosted, on-premises, or hybrid? If cloud-hosted, state which platform (Azure, AWS, GCP).

3. Describe your system’s multi-tenant architecture and how customer data is isolated.

4. What programming languages, frameworks, and technology stack does your product use?

5. Provide details on system redundancy, failover design, and disaster recovery architecture.

2. Integration & Interoperability

1. What APIs (REST, SOAP, GraphQL) are available for integration with HRIS, SIS, identity systems, or analytics platforms?

2. Describe pre-built integrations your tool supports (e.g., Workday, Oracle, SAP, PeopleSoft).

3. Does the system support SFTP batch ingestion or event-driven integration?

4. Provide details on webhook or real-time event capabilities.

5. How does your product ensure backward compatibility with API version updates?

3. Data Management & Governance

1. Describe your data model, including key entities for employees, goals, evaluations, competencies, and workflows.

2. How does your product support data retention policies and configurable retention schedules?

3. Provide your documented data dictionary or schema definitions.

4. Explain how customers can export all data in open, non-proprietary formats.

5. Describe data backup frequency, encryption, and recovery processes.

4. Security & Compliance

1. List your security certifications (SOC 2, ISO 27001, FedRAMP, etc.).

2. Describe all methods used to encrypt data in transit and at rest.

3. What authentication methods are supported? (SAML, OAuth, OpenID Connect)

4. Does your product support MFA enforcement via identity provider?

5. Provide details on security logging, audit trails, and anomaly detection.

6. Describe your secure development lifecycle (SDLC) practices.

7. Detail how you handle vulnerabilities, patching, and third-party library management.

8. Provide your incident response plan, including customer notification timelines.

5. Identity & Access Management

1. How are users provisioned?

2. Describe your role-based access control (RBAC) model.

a. Can roles be mapped to enterprise roles or directory groups?

b. How are permissions defined, assigned, and maintained?

c. Does the model support enforcement of least-privilege access?

d. Can access be scoped using attributes such as location, job code, or department?

e. Can privileged access be integrated with enterprise tools such as CyberArk?

3. Does the system support dynamic or attribute-based permissions (ABAC)?

4. Does the application integrate with enterprise directory services (e.g., Active Directory or Entra ID)?

5. Does the application integrate with enterprise IGA solutions (e.g., SailPoint)?

6. Can permission be delegated at school, department, or supervisory levels?

7. How is privilege escalation prevented and monitored?

8. How is user access reviewed and governed?

(e.g., access certifications, attestation campaigns, periodic reviews)

9. What is the authentication fallback strategy if SSO is unavailable?

6. Scalability & Performance

1. Provide your system’s performance SLAs (latency, uptime, transaction limits).

2. What load can the system handle during peak performance evaluation cycles?

3. Describe how the system scales (horizontal/vertical auto-scaling).

4. Provide recent results of stress testing or load testing activities.

7. Configuration, Customization & Extensibility

1. Which elements are customer-configurable (workflows, forms, competencies, rating scales)?

2. Describe customization capabilities without vendor involvement.

3. Do configurations persist across product upgrades?

4. Does the system support extension via scripts, plugins, or custom fields?

8. Logging, Monitoring & Analytics

1. Describe your system logging capabilities (app logs, access logs, admin logs).

2. What monitoring tools and dashboards are available to customers?

3. Can logs be exported to SIEM tools (Splunk, Sentinel, etc.)?

4. Provide examples of built-in analytics or performance dashboards.

9. Deployment, Updates & Change Management

1. Describe your release cycle (monthly, quarterly, continuous).

2. How are patches and updates deployed?

3. Do updates require downtime?

4. How is customer notification handled for planned changes?

5. Describe your environment model (production, sandbox, test).

10. Privacy, Legal & Compliance

1. Describe compliance with laws such as FERPA, COPPA, HIPAA (if applicable).

2. Provide details on your data processing agreement (DPA).

3. Is customer data ever used for model training, analytics, or product development?

4. Describe how right-to-be-forgotten or data deletion requests are handled.

11. Vendor Support & Operational Readiness

1. Describe standard support tiers, SLAs, and response times.

2. Provide details on customer onboarding and implementation methodology.

3. Outline your escalation process and communication framework.

4. Provide documentation lifecycle details (frequency of updates, access method).

12. Roadmap & Product Vision

1. Provide a 1–3-year product roadmap.

2. Describe upcoming features related to analytics, AI, and workflow automation.

3. How does customer feedback influence your development roadmap?

Data Privacy and Security Questions

1. Is PII data collected? For students? For staff?

2. How will the data be shared?

3. How is the data transferred?

4. Where is the data sent (a secure website, email address, etc.)?

5. Describe encryption of data at rest and in transit.

6. Provide information about data storage.

7. Explain how customers can export all data in open, non-proprietary formats.

8. Data security & privacy certifications (if applicable).

9. Describe role-based access controls.

• Describe capability of importing staff roster data, and historical (conversion) data.

10. Review the GCPS Data Privacy and Security terms in the addendum and provide any comments.

Fees Provide a proposal of the costs for the system based on the information outlined above as our desired outcomes.

Include both implementation and ongoing costs. The expectation is that these fees will be within 1% of the final costs. Include specifics regarding the implementation support as well as the ongoing support provided by your company.