Page 1 Rev. 03/07/2016

NORTH CAROLINA

DEPARTMENT OF REVENUE

Solicitation Addendum

Solicitation Number: 45-RQ255223

Solicitation Description: BeyondTrust Privileged Access Management

Solicitation Opening Date and Time: July 8, 2026 @ 10:00 AM EST

Addendum Number: 1

Addendum Date: July 8, 2026

Purchasing Agent: Justin Stringfield, Contract Specialist Justin.stringfield@ncdor.gov, 919.215.5229

1. Return one properly executed copy of this addendum with bid response or prior to the Bid Opening Date/Time listed above.

2. The bid opening date has been extended from July 8, 2026 at 10am eastern time to July 20, 2026 at 10am eastern time

3. Following are questions received about the solicitation and the State’s answers to the questions.

Question Citation Vendor Question 1 REFERENCE: Page 11 Can you please confirm if this is for renewal or if this is a new request?

State’s Response

New Request

2 General Question Can you please confirm if this is a RENEWAL or a NET NEW?

See response to Question 1 above.

3 Section 3.9.1 and Section 4.0

In Section 3.9.1, the RFP references “Cloud, On-premises, or Hybrid Deployment”, while Section 4.0 lists cloud licenses. Can you please confirm whether you intend to deploy the BeyondTrust PRA SaaS solution?

State’s Response

Initial deployment will be in the Azure cloud with on premise later. Yes, we intend to deploy PRA SaaS.

4 Section 3.9 – Requirements

Please elaborate on the user groups expected to leverage BeyondTrust PRA, including whether access will be limited to internal personnel or extended to third-party vendors.

Users will be both internal and external third-party contractors.

Solicitation Number: Page 2 Addendum Number:

5 Section 3.9 –

Requirements How many end-users do you anticipate onboarding within the scope of this RFP?

6 Section 3.9.2 – Technical Specifications

The RFP identifies 100 assets in scope for PRA. Could you provide a breakdown of these assets by type (e.g., Windows servers, Linux servers, Oracle databases, network devices)?

State’s Response

The 100 assets identified in the RFP refer to on-prem assets. The cloud-first assets consists of approximately 15 Windows servers and 16 Linux servers in Azure.

7 N/A – General Question

Do you currently have BeyondTrust Password Safe (PS) deployed?

a. If yes, are the PRA-in-scope assets already integrated with PS?

b. Ig yes, are you expecting PRA to integrate with PS to support automatic credential injection during PRA sessions?

No, NCDOR does not currently have BeyondTrust Password Safe (PS) deployed.

8 Section 3.9.2 – Technical

Specifications

BeyondTrust SaaS provides a default 90‑day retention period for session recordings. Do you require a longer retention period, and if so, what is NCDOR’s mandated retention requirement?

State’s Response

No, NCDOR does not require a longer retention period.

9 Section 3.9.2 – Technical

Specifications

Is Single Sign-On (SSO) required for PRA user authentication, and which identity provider do you plan to use?

State’s Response

Yes. Entra is the planned identity provider.

10 Can you confirm the SIEM integration requirements? Is QRadar your current SIEM platform?

Please note that BeyondTrust typically requires an additional SIEM plugin license for this integration. Will you procure such license (beyond the parts/SKUs listed in Section 4.0)?

Palo Alto XSIAM is the current SIEM platform. Yes, NCDOR will procure any additional SIEM integration license.

11 N/A – General Question

Have you completed any analysis to determine whether Jump Clients will be required? If yes, how many?

Solicitation Number: Page 3

No.

12 N/A – General

Question Have you completed any analysis to determine how many Jump Points are required?

State’s Response

No.

13 2.3 Offer Submittal In the Ariba Sourcing Event, Section 5 – Vendor Response, Item 5.2 instructs vendors to upload file(s) containing the complete offer with all applicable contents as specified in the "Proposal Content and Organization" section of the solicitation. However, the IFB does not appear to contain a section titled "Proposal Content and Organization." Please clarify which document(s) are expected to be uploaded under Item 5.2. Specifically, should vendors upload only the completed and signed solicitation document, or are additional proposal/supporting documents required?

Vendors should follow the instructions for offer submittal outlined in 2.3 Offer Submittal.

14 Attachment A, Should our Statement of Work be submitted with our IFB response or after award.

The Statement of Work is to be submitted with your IFB response.

15 IFB Reference:

Section 2.9 —

Distributors and Resellers / Page

Section 2.9 requires resellers to be approved by the State prior to placement of orders. What is the process and timeline for State approval of an authorized reseller?

Must proof of authorized reseller status from BeyondTrust be included in the bid, and if so, in what form (letter of authorization, partner portal confirmation, other)?

Resellers must be approved by the State prior to placement of orders. NCDOR since approval of resellers is outside of NCDOR’s approval NCDOR cannot provide the timeline for State approval to authorize a reseller.

To be an authorized reseller with the State of NC, a Vendor must be registered with the NC Secretary of State’s office and signed up in eProcurement.

Authorization does not need to be presented at bid submission but it will need to be completed before Award can be made.

16 IFB Reference:

Section 2.11 — Best and Final Offer / Page 6

If NCDOR elects to establish a competitive range and request a Best and Final Offer (BAFO), how much lead time will vendors receive between the BAFO request and the BAFO submission deadline? The IFB does not specify a minimum response period for BAFO submissions.

Solicitation Number: Page 4

NCDOR is unable to give a predetermined minimum response period without seeing proposals first.

17 FB Reference:

Section 2.12 — Contract Award

/ Page 6

The IFB states award will be based on Lowest Price Technically Acceptable (LPTA) in accordance with 09 NCAC 06B.0302. Please confirm: (1) Is technical acceptability a pass/fail determination made solely on compliance with the specifications in Section 3.9, or will NCDOR conduct a comparative technical evaluation among compliant offers? (2) Will NCDOR contact vendors for clarification of technically non-compliant elements before determining non-responsiveness, or will offers with any deficiency be rejected without further consideration?

State’s Response

Technical acceptability is a pass/fail determination made solely on compliance with the specifications in 3.9. NCDOR will seek clarification on elements that are not clear, but will not contact vendors for non-compliant elements.

18 IFB Reference:

Section 3.2 —

Vendor Utilization of

Workers Outside U.S. /

Does NCDOR require each named subcontractor (including project management firms) to submit the Section 3.2 foreign workers disclosure independently within the prime vendor's offer, or does a single consolidated disclosure by the prime vendor covering all named subcontractors satisfy the requirement?

State’s Response

A single consolidated disclosure by the prime vendor covering all named foreign subcontractors is required.

19 IFB Reference:

Section 3.3 — E-Verify / Page

For subcontractors with fewer than 25 employees — the threshold at which E- Verify compliance is mandated under N.C.G.S. Chapter 64, Article 2 — does NCDOR require formal E-Verify enrollment and a certification number, or is a written attestation that the subcontractor falls below the statutory threshold sufficient to demonstrate compliance?

State’s Response

For subcontractors with fewer than 25 employees a written attestation that the subcontractor falls below the statutory threshold is sufficient to demonstrate compliance.

20 IFB Reference:

Section 3.4 — Brand Specific Product / Page

Section 4.0 identifies specific part numbers (PRA-CLOUD-FEDRAMP-WEB, PRAA- CLOUD-FEDRAMP, BTU-PRA-ADMIN-SUB-FR). If BeyondTrust releases updated or successor part numbers for any of the specified items between the issue date and bid opening, will NCDOR accept the successor part numbers at equivalent or better specification, or must the vendor price exactly the part numbers as listed?

State’s Response

Yes. DOR will accept the equivalent or better specification.

21 IFB Reference:

Section 3.5(b)

— Third-Party

Security Assessment /

BeyondTrust Privileged Remote Access Cloud holds an active FedRAMP Authorization. Does this FedRAMP Authorization satisfy the 'preferred independent third-party assessment report' requirement under Section 3.5(b)(i) in full — including coverage of the SaaS layer — such that no additional SOC 2 Type 2 or ISO 27001 report is required?

Solicitation Number: Page 5

No

22 IFB Reference:

Section 3.5(c)

— Additional

Security Documentation

/ Page 8

Will NCDOR exercise its discretion to require vulnerability assessment reports or penetration test reports as a condition of award for this procurement? If so, what is the maximum acceptable age (recency) of such reports, and must they be submitted prior to award notification or only upon request?

Yes, reports must be submitted upon request.

23 IFB Reference:

Section 3.8 —

Contract Term /

The initial contract term is three years, invoiced annually. For the renewal option years (Years 4 and 5), are the optional-cost line items in Section 4.0 (Items 6–8) binding prices that NCDOR may exercise at its discretion, or are they indicative prices subject to renegotiation at the time of each renewal? Additionally, must the renewal year prices be flat or may they reflect the ≤5% allowable increase?

They are binding prices that NCDOR may exercise at its discretion. The prices do not have to be flat.

24 IFB Reference:

Section 3.9.2(b)

— Integration / NCID / Page 10

The IFB requires a 'native connector for NCID.' Please clarify: (1) Is NCID integration expected to be accomplished through SAML 2.0 federation (in which case BeyondTrust's existing SAML connector satisfies this requirement), or does NCDOR require a proprietary NCID-specific connector? (2) Will NCDOR provide NCID configuration documentation and test credentials during the implementation planning phase?

State’s Response

For (1) we anticipate the use of federation through SAML with EntraID.

(2) Yes

25 IFB Reference:

Section 3.9.2(e)

— Vulnerability Management /

Section 3.9.2(e) states 'Remediation of Critical CVSS ≥ vulnerability within seven

(7) calendar days' but appears to contain a typographical omission — the CVSS score threshold is missing. Please confirm: Is the intended threshold CVSS ≥ 9.0 (Critical severity), CVSS ≥ 7.0 (High and above), or another value? This threshold is material to the contract's SLA and directly affects BeyondTrust's support commitment.

Confirmed.

Should be CVSS ≥ 9.0 (Critical severity)

Solicitation Number: Page 6

26 IFB Reference:

Section 3.9.3 / Attachment A

§2 — Implementation Services / Pages

10 & 38

Attachment A §2 states 'Vendor shall provide a full-time resource for NCDOR's implementation of BeyondTrust PRA.' Section 3 of Attachment A states services will be performed remotely. Does 'full-time resource' require the resource to be exclusively dedicated to NCDOR during the 90-day implementation window (no other concurrent client assignments), or does it require full-time equivalent availability (i.e., 40 hours per week allocated) with remote delivery?

State’s Response

The resource must have 40 hours per week allocated or as needed to fulfill the 90-day implementation window.

27 IFB Reference:

Section 3.9.4 — Administrator and End User

Training / Page

The IFB requires a minimum of one 8-hour remote admin course and two 4-hour end-user remote training sessions. (1) Must these sessions be delivered as live, instructor-led remote sessions, or may BeyondTrust satisfy the requirement through a combination of live instruction and self-paced recorded modules? (2) Are the three FedRAMP admin training seats (Item 4) distinct from the one 8-hour admin course, or does the 8-hour course fulfill the FedRAMP seat requirement?

(1) Live hands-on training is preferred, but self-paced can be utilized but not for all of the training. (2) They are distinct.

IFB Reference:

Section 4.0 — Furnish and

Deliver / Pricing Table / Page 11

Items 4 (Professional Services) and 5 (Training Services) are listed as per-job line items. Should vendors provide a single lump-sum price for each, or must pricing be broken out by labor category, estimated hours, and rate? Additionally, Section

7.0 Paragraph 9 states all travel expenses must be included in proposed costs and will not be separately reimbursed — please confirm that the intent is for all travel to be embedded in the lump-sum price for Items 4 and 5.

State’s Response

NCDOR is requesting a single lump-sum price for items 4 (Professional Services) and 5 (Training Services). For travel expenses, confirmed: the intent is for all travel to be embedded in the lump-sum price for a vendors offer.

29 IFB Reference:

Section 4.0 — Furnish and

Deliver / Annual Pricing /

The pricing table for license Items 1–3 shows Year 1, Year 2, and Year 3 columns with 'Duration: 36 Months, invoiced annually.' May the annual license fees for Years 1, 2, and 3 be identical (flat rate), or must each year be priced independently? If year-over-year increases are anticipated, is the ≤5% cap in Section 2 (SaaS Terms §15(a)) applicable to the initial 3-year term or only to the optional renewal years?

State’s Response

Vendor are encouraged to submit the most competitive pricing available. Pricing doesn’t have to be flat.

30 IFB Reference:

Section 7.0

Paragraph 47

— NCEP

Transaction Fee / Page 26

Section 7.0 Paragraph 47 imposes a 1.75% transaction fee on purchase orders issued through NC eProcurement. Section 2.8(b) clarifies this fee does not apply to SaaS, software maintenance/support services, or other types of services. For this procurement, which line items in Section 4.0 are subject to the NCEP transaction fee: (a) the FedRAMP cloud licenses (Items 1–3), and (b) the professional services and training (Items 4–5)?

Solicitation Number: Page 7

Everything in the Furnish and Deliver table is classified as a service and does not have a 1.75% transaction fee imposed on those services.

31 IFB Reference:

Attachment B

— Onboarding Requirements /

Attachment B requires a criminal background check with fingerprinting for all contractor staff with logical account access (Level 2). What is the expected processing timeline for NCDOR-conducted background checks, and can any implementation work begin before background checks are completed? A delay in background check processing could materially affect the 90-day implementation window.

State’s Response

All contractor staff with (level 2) access will have to have a completed background check before project start. The processing timeline is outside of NCDOR but usually it doesn't take long.

32 IFB Reference:

Attachment B

— Onboarding / Footnote 4 /

For BeyondTrust implementation engineers who will access NCDOR systems remotely (qualifying as 'Offsite Contractor Staff with Physical Access to NCDOR Data/Systems/Information' under Attachment B), Footnote 4 references the IRS Publication 1075 two-barrier rule. Does remote access to NCDOR NCID-authenticated sessions through the BeyondTrust PRA platform itself satisfy the two-barrier rule for these staff, or is additional NCDOR IT Security approval required beyond standard onboarding?

State’s Response

The contractor staff will have to be onboarded; therefore, additional security approval is required.

Failure to acknowledge receipt of this addendum may result in rejection of the response.

Check ONE of the following options:

☐ Bid has not been submitted. Any changes resulting from this addendum are included in our bid response.

☐ Bid has been submitted. No changes resulted from this addendum.

☐ Bid has been submitted. Changes resulting from this addendum are as follows:

Execute Addendum:

Offeror:

Authorized Signature:

Name and Titled (Typed):

Date: