6106 RFI 29may2025finalposted.pdf

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 1 of 24

STATE OF OREGON

COVER PAGE

Oregon Health Authority, is issuing this Request for Information under

OregonBuys # S-44300-00013891 - OHA #6106 for

Enterprise Data Management Cataloging Solution

Date of Issue and Time: May 29, 2025 Closing Date and Time: June 27, 2025

Single Point of Contact (SPC): Dave Reynolds, Procurement Specialist

Address: 635 Capitol St NE Ste 350 City, State, Zip Salem, OR 97301 Phone (voice) 503-871-4880 Email: david.reynolds@odhsoha.oregon.gov

You can get this document in other languages, large print, braille, or a format you prefer free of charge. Contact the Contract Administrator at the contact information found below. We accept all relay calls.

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 2 of 24

Table of Contents

SECTION 1: GENERAL INFORMATION

1.1 INTRODUCTION…………………………………………………………………… 3

1.2 BACKGROUND……………………………………………………………………. 3

1.3 REQUEST FOR INFORMATION PURPOSE…………………………………… 3

1.4 WHO MAY RESPOND?

1.5 PROJECT OVERVIEW……………………………………………………………. 5

1.6 DUE DATE………………………………………………………………………….. 5

1.7 SINGLE POINT OF CONTACT (SPC)…………………………………………… 6

SECTION 2: SCOPE OF WORK………………………………………………………… 6

2.1 SCOPE……………………………………………………………………………… 6

2.2 RFI RESPONSE QUESTIONS…………………………………………………… 6

SECTION 3: SUBMISSION AND RESPONSE REQUIREMENTS…………………... 11

3.1 SUBMISSION REQUIREMENTS………………………………………………… 11

3.2 OWNERSHIP/PERMISSION TO USE MATERIALS…………………………… 11

3.3 VENDOR PRESENTATION EXPECTATION…………………………………… 12

file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818473 file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818474 file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818475 file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818476 file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818477 file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818478 file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818479 file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818480 file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818481 file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818482 file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818483 file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818495 file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818496 file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818497 file://dhs.sdc.pvt/HSB/CENTRAL.KT/RFP-6000/6106/Draft/6106DRAFT_RFI%20Data%20Management%20%20Cataloging%20Platform%20%20V1.1.docx#_Toc196818498

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 3 of 24

SECTION 1: GENERAL INFORMATION

1.1 INTRODUCTION

The State of Oregon, acting by and through the Oregon Health Authority’s (OHA or Agency) issues this Request for Information (RFI) to solicit information from vendors regarding Enterprise Data Management Cataloging solutions. The purpose of this Request for Information (RFI) is to gather market intelligence on available solutions that can support OHA’s data governance and management needs. This RFI is for information purposes only and does not constitute a solicitation for bids, proposals, or contractual commitments.

Participation in this RFI is voluntary, and no contract will be awarded based on responses submitted. The information gained in this RFI, may be used by the Agency to inform development of a future competitive solicitation process. However, the Agency reserves the right to modify, delay, or cancel any future procurement efforts based on it’s needs and available resources.

Respondents acknowledge and agree that the Agency is not responsible for any expenses or costs incurred by any Respondent in submitting a Response to this RFI. Each Respondent does so solely at the Respondent’s own expense. All costs incurred in preparing and submitting a Response will be the responsibility of the Respondent and will not be reimbursed by Agency.

1.2 BACKGROUND

The OHA serves as Oregon’s single State Medicaid agency, responsible for ensuring equitable access to health services is available to Oregonians. As part of it’s mission, OHA is committed to enhancing data accessibility, governance, and transparency across the agency’s operational framework. The Office of Data Strategy and Operations (ODSO) is responsible for coordinating data management efforts across multiple stakeholders, including behavioral health, Medicaid, policy analysis, and IT services.

OHA currently lacks a unified data catalog, creating challenges for internal and external stakeholders to discover, understand, and manage data assets effectively. OHA maintains a diverse portfolio of over 700 data repositories, many of which contain overlapping, redundant, or inconsistent information. This fragmentation inhibits efficient data utilization and governance. Through this RFI, OHA seeks to identify the necessary capabilities, features and attributes of a comprehensive data catalog solution that enables metadata management, data discovery, data governance, and, where available, data indexing and mastering capabilities.

The information obtained through this RFI will serve as a foundational resource for shaping the Agency’s approach to data catalog implementation and future procurement initiatives.

1.3 REQUEST FOR INFORMATION PURPOSE

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 4 of 24

OHA has initiated this RFI to obtain a better understanding of the marketplace for data management and cataloging solutions. Specifically, OHA seeks information about tools that can enhance our ability to govern, organize, and utilize data effectively across the agency.

This includes, but is not limited to, solutions that provides:

• Robust metadata management;

• Enterprise search and data discovery;

• Data lineage and impact analysis;

• Access control and role-based permissions;

• Governance and stewardship workflows;

• Data indexing and mastering capabilities;

• Data quality profiling and monitoring; and

• Integration with existing data sources and systems.

This RFI is not a Request for Proposal (RFP) and does not constitute a commitment by OHA to procure any solution. Rather, information gathered will inform future decision-making and potential procurement strategies. Responses may contribute to the development of a more detailed RFP, ensuring alignment with current market capabilities, integration feasibility, and lessons learned from similar successful implementations from other state efforts. The Agency reserves the right to modify it's approach based on the information obtained through this RFI.

1.4 WHO MAY RESPOND?

The OHA invites responses from a diverse range of qualified vendors with expertise in data cataloging and broader data management solutions.

The Agency seeks information from Vendors providing:

• Standalone solutions that specialize in data cataloging, metadata management, governance, and data discovery.

• Comprehensive data management platforms that include a data catalog as part of a broader suite of capabilities (e.g. data indexing and mastering, data quality, and data lineage, etc.)..

At a minimum, all respondents must offer a data cataloging solution that includes the following core functionalities:

• Metadata management – Ability to collect, manage, and enrich metadata from various sources.

• Data discovery and search – Intuitive browsing and search capabilities for users to find data assets.

• Data Quality – Assessment and monitoring of data to ensure accuracy, consistency, and reliability. Data lineage & provenance – Tracking and visualization of the data's

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 5 of 24 origins, transformations, and movement across systems.

• Basic governance and stewardship support – Role definitions, glossary management, and visibility into data ownership.

• Integration potential – APIs or other mechanisms that support interoperability within a broader data ecosystem.

Vendors offering broader platforms may also address additional features such as:

• Data mastering & entity resolution

• Master Data Management (MDM)

• Data preparation and transformation tools

• Advanced policy-based access and security controls

• Automation and AI-driven features

OHA welcomes responses from vendors offering either standalone or integrated solutions, including those that support modular or phased implementation. Solutions should be deployable in cloud, on-premises, or hybrid environments, with a preference for platforms compatible with a multi-cloud data ecosystem.

Respondents should highlight any relevant experience in healthcare or government environments, particularly as it pertains to compliance with privacy, security, and regulatory requirements applicable to state and federal data governance standards.

1.5 PROJECT OVERVIEW

OHA is committed to enhancing data governance and accessibility to support informed decision-making, improve service delivery, and foster collaboration across programs. A foundational component of this effort is the implementation of an Enterprise Data Catalog, which will enable OHA to efficiently organize, manage, and discover data assets efficiently, thus improving data transparency, compliance, and usability. This effort is designed to ensure that stakeholders can access reliable data and trust the data they need while maintaining appropriate security and governance controls

OHA is seeking information on data catalog solutions that provide centralized metadata management, facilitate Enterprise search and data discovery, and robust data governance functionalities. The capabilities of the solution should demonstrate the ability to enhance interoperability, integrate with existing platforms, and offer robust search and security features.

This RFI serves as an exploratory step in evaluating available technologies that align with OHA’s long-term data strategy. The insights gathered through this process will inform OHA’s future procurement strategy and investment in data infrastructure.

1.6 DUE DATE

Responses to this RFI will be received until the Closing date and time as referenced on the

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 6 of 24 cover page of this RFI. Responses received after the Closing date and time shall be deemed late and will not be considered.

1.6.1 Definitions Reference

All definitions related to this Request for Information (RFI) are provided in Attachment E.

Respondents should refer to this attachment for clarification of terms used throughout this document.

1.7 SINGLE POINT OF CONTACT (SPC)

The SPC for this RFI is identified on the Cover Page, along with the SPC’s contact information. Respondent shall direct all communications related to any provision of the RFI only to the SPC, whether about the technical requirements of the RFI, the RFI process, or any other provision.

SECTION 2: SCOPE OF WORK

2.1 SCOPE

The Oregon Health Authority (OHA) is seeking information on data catalog solutions designed to support metadata driven data governance and data discovery across the Agency’s complex data ecosystem. Responses to this RFI will guide future procurement strategies and help in defining the capabilities required to enhance enterprise data transparency, accessibility, and stewardship.

This RFI is structured around four key areas of interest, ensuring a comprehensive evaluation of solutions that align with OHA’s long-term data management strategy.

2.2 RFI RESPONSE QUESTIONS

Vendors are asked to respond to the following questions and topic areas.

Responses should clearly indicate whether the solution is a standalone data catalog or part of a broader data management platform.

2.2.1 General Solution Overview (Required)

2.2.1.1.1 Provide a general overview of your solution, including its primary functions, architecture, and deployment options (e.g., on-premises, cloud, hybrid)

2.2.1.1.2 Describe whether your solution is delivered as a standalone product focused on data cataloging, metadata management, governance, and discovery, or as a broader data management platform.

2.2.1.1.3 Outline the typical customer profile for your solution, including industries, organization size, and key use cases.

2.2.1.1.4 Describe your solution’s scalability capabilities in terms of users, datasets, and performance across different environments

2.2.1.1.5 Provide examples of innovation, emerging features, or best practices

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 7 of 24 you offer that may not be widely adopted elsewhere.

2.2.2 Core Data Catalog Capabilities (Required)

2.2.2.1 Metadata Management

2.2.2.1.1 Describe how your solutions collects, manages, and enriches metadata.

Please address all of the following:

2.2.2.1.1.1 Manual Metadata Entry

2.2.2.1.1.2 Automated Metadata Entry

2.2.2.1.1.3 AI-Driven Metadata Enrichment

2.2.2.1.2 What metadata types does your catalog support?

2.2.2.1.3 Please describe supported types, including:

2.2.2.1.3.1 Descriptive, structural, administrative, operational, reference metadata

2.2.2.1.3.2 Support for data models such as conceptual, logical, and physical models

2.2.2.1.4 What automated metadata tagging and classification capabilities does your system provide?

2.2.2.1.5 Does your catalog allow user-defined automation as part of the classification process?

2.2.2.1.6 Does your catalog allow for user-defined metadata attributes and custom tagging?

2.2.2.1.7 Can users create and manage custom metadata attributes or business glossaries?

2.2.2.1.8 Can users browse metadata hierarchically (e.g., by dataset, domain, data owner, source system)?

2.2.2.1.9 Describe the frequency and scheduling capabilities for metadata harvesting (eg., real-time, scheduled batch updates).

2.2.2.1.10 Does your solution support active metadata (real-time change detection)?

2.2.2.1.11 Describe metadata versioning capabilities, including support for rollback, audit trails, and change impact analysis.

2.2.2.2 Data Discovery & Search

2.2.2.2.1 Describe the discovery features supported by your solution, including intelligent search, filtering, and categorization.

2.2.2.2.2 How does your solution support semantic search, natural language search, or AI-assisted discovery?

2.2.2.2.3 How does your solution handle synonyms, acronyms, and common business terminology to improve searchability?

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 8 of 24

2.2.2.2.4 Does your solution provide search analytics capabilities (e.g., tracking popular searches, measuring discovery effectiveness)?

2.2.2.2.5 Are visual navigation aids (e.g., knowledge graphs, relationship maps) available in addition to text-based interfaces?

2.2.2.2.6 Does your solution allow stewards to flag or promote canonical datasets for easier discovery?

2.2.2.3 Data Lineage & Provenance

2.2.2.3.1 Describe how your solution captures and presents data lineage, including source systems, transformations, joins, aggregations, and consumption endpoints.

2.2.2.3.2 Describe how lineage validation across systems is performed.

2.2.2.3.3 How does your platform capture transformations, joins, and aggregations along the data pipeline?

2.2.2.3.4 If this process includes automation, what types of permissions are required to enable this automation?

2.2.2.3.5 Can your solution capture lineage and transformations occurring outside of structured data pipelines, such as in spreadsheets or isolated data repositories?

2.2.2.3.6 Describe lineage access controls, including role-based breakdowns (e.g., read-only, write, system-level).

2.2.2.4 Data Governance & Stewardship

2.2.2.4.1 How has your solution been used to facilitate data governance policy enforcement?

2.2.2.4.2 Does your solution enable the definition of roles, responsibilities, and workflows for data governance?

2.2.2.4.3 Is workflow automation supported for governance tasks such as approvals, escalations, and notifications?

2.2.2.4.4 Can your solution integrate with external tools or systems already in use?

2.2.2.4.5 How does your platform help with data quality monitoring and issue resolution?

2.2.2.5 Data Quality

2.2.2.5.1 Describe how your solution supports data quality assessment and monitoring.

2.2.2.5.2 How are data quality rules authored? (GUI, code-based, policy-driven, etc.)

2.2.2.5.3 Does your solution provide dashboards or reports showing historical

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 9 of 24 data quality trends over time?

2.2.2.5.4 Describe how your solution supports data quality issue identification, notification, and resolution tracking.

2.2.3 Extended Capabilities (Optional)

2.2.3.1 Data Mastering & Entity Resolution

For solutions with data mastering capabilities, please respond to the following:

2.2.3.1.1 How does your solution identify duplicate records and create a "golden record" for entities?

2.2.3.1.2 What matching algorithms or machine learning models does your platform use for record linkage and deduplication?

2.2.3.1.3 How does your system integrate mastered records with the data catalog to enhance searchability and governance?

2.2.3.1.4 Describe a use case where your solution has been used to successfully index and master large-scale datasets.

2.2.3.2 Additional Capabilities

2.2.3.2.1 Describe the additional relevant capabilities beyond the core catalog functions that your solution offers. (e.g. Master data management, Data preparation, Policy enforcement, and Automation & AI driven features, etc.)

2.2.4 Univeral System Capabilities (Required)

2.2.4.1 Security & Access Controls

2.2.4.1.1 Describe the role-based access control (RBAC) features of your solution.

2.2.4.1.2 Does your solution support fine-grained access controls such as Row- Level Security (RLS) for sensitive metadata?

2.2.4.1.3 How does your solution enforce security policies for metadata and cataloged datasets?

2.2.4.1.4 How does your solution meet security standards such as FedRAMP, HIPAA, or others?

2.2.4.1.5 Does your solution support the identification and classification of PHI/PII metadata?

2.2.4.1.6 How can access be restricted based on user roles, organizational hierarchy, and metadata attributes?

2.2.4.1.7 How does your solution integrate with enterprise authentication standards such as SAML, LDAP, OAuth, and Active Directory?

2.2.4.1.8 What mechanisms are available for audit logging, including tracking

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 10 of 24 user interactions with the catalog?

2.2.4.1.9 Does your company certify that it is in full compliance with Oregon's

Statewide Security Standards, as outlined in Attachment D?

2.2.4.2 Integration & Interoperability

2.2.4.2.1 Describe the standard APIs, connectors, or adapters available to integrate your solution with other enterprise systems.

2.2.4.2.2 Does your solution provide RESTful APIs or other mechanisms for programmatic interaction?

2.2.4.2.3 Describe how your platform handles schema evolution and data model changes.

2.2.4.2.4 How does your solution support interoperability across cloud, on-premises, and hybrid environments?

2.2.4.2.5 Are ingestion connectors maintained regularly by your team, and is there support for custom connector development?

2.2.4.2.6 For hybrid environments, does your solution support metadata harvesting across firewalled or on-premises sources?

2.2.4.3 User Experience, Onboarding & Training

2.2.4.3.1 Describe the user interface design principles used and how they support different user personas (e.g., business users, data stewards, technical users).

2.2.4.3.2 What customization options are available for dashboards, search filters, and UI components?

2.2.4.3.3 Does your platform offer accessibility features or other standards?

2.2.4.3.4 What onboarding tools, tutorials, and user assistance mechanisms are available?

2.2.4.3.5 Do you offer customer training programs, certification opportunities, or learning paths?

2.2.4.3.6 Describe any community forums, knowledge bases, or user groups available for peer support.

2.2.4.4 Implementation & Scalability

2.2.4.4.1 Provide typical implementation timelines and key milestones for deploying your solution.

2.2.4.4.2 Describe your approach to scaling across growing user bases, datasets, and organizational units.

2.2.4.4.3 What professional services (e.g., consulting, integration assistance) are available to support implementation?

2.2.4.4.4 What are the main technical and operational challenges customers face when deploying your solution, and how do you address them?

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 11 of 24

2.2.4.4.5 Describe how your platform scales to accommodate increasing data volumes and users.

2.2.4.4.6 What ongoing support, maintenance, and upgrade services do you offer?

2.2.4.4.7 Is your solution offered as a SaaS platform, self-hosted on premises, or hybrid?

2.2.4.4.8 If self-hosted what resources will we need to support the environment?

2.2.4.4.9 If self-hosted on premises what are the infrastructure (hosting) requirements and specifications?

2.2.4.4.10 If self-hosted in a Cloud environment, which cloud environments are supported (Azure, AWS, etc.)?

SECTION 3: SUBMISSION AND RESPONSE REQUIREMENTS

3.1 SUBMISSION REQUIREMENTS

OregonBuys Electronic Response. Respondent must submit its Response electronically through OregonBuys. Respondent must follow the procedures outlined in detailed instructions on how to submit an Response can be found at OregonBuys Vendor Formal Solicitation Response.

Respondents to this RFI must upload one (1) pdf file that includes the following:

Respondents must submit the following documents in PDF format:

1. Attachment A – Respondent Information and Certification Sheet

2. Attachment B – Disclosure Exemption Affidavit (if applicable)

3. Vendor RFI Response - All responses must address the information requested in

Section 2. Please utilitze the question reference numbers within your answers to ensure clarity.

4. Attachment C—Cost Estimate Sheet that includes software, training, maintenance, services, and any other requirements for this project.

3.2 OWNERSHIP/PERMISSION TO USE MATERIALS

All Responses are public record and are subject to public inspection. Application of the Oregon Public Records Law will determine whether any information is actually exempt from disclosure.

All Responses submitted to this RFI become the property of Agency. By submitting a Response to this RFI, Respondent grants the State of Oregon a non-exclusive, perpetual, irrevocable, royalty-free license for the rights to copy, distribute, display, prepare derivative works of and transmit the Response solely for the purpose of reviewing the Response, or as otherwise needed to administer the https://www.oregon.gov/das/ORBuys/Documents/OregonBuys%20Vendor%20Formal%20Solicitation%20Response.pdf https://www.oregon.gov/das/ORBuys/Documents/OregonBuys%20Vendor%20Formal%20Solicitation%20Response.pdf

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 12 of 24

RFI process, and to fulfill obligations under Oregon Public Records Law (ORS

192.410 through 192.505). Responses, including supporting materials, will not be returned to Respondent.

If Respondent believes any of its Response is exempt from disclosure under Oregon Public Records Law (ORS 192.311 through 192.478), Respondent shall complete and submit the Disclosure Exemption Affidavit (Attachment B) and Respondent also shall submit a fully redacted version of its Response, clearly identified as the redacted version.

All inquiries, whether relating to the RFI process, administration, deadline, the intent or technical aspects of the RFI must:

• Be delivered to the SPC via an OregonBuys submission or email;

• Reference the OregonBuys bid number;

• Identify Respondent’s name and contact information;

• Refer to the specific area of the RFI being questioned (i.e. page, section and paragraph number); and

• Be received by June 23, 2025 at 5:00 PM PST.

3.3 VENDOR PRESENTATION EXPECTATION

Selected vendors may be invited to present their solutions. Presentations should focus on key capabilities and demonstrate how the solution meets OHA’s requirements.

Presentation Structure (60–90 minutes total)

1. Solution Overview & Live Demonstration (30 mins)

• Provide a walkthrough of the platform, showcasing user experience for both business and technical users.

• Demonstrate key functionalities, including metadata search, data lineage tracking, and governance workflows.

• Showcase any AI-driven metadata tagging and classification capabilities.

• Illustrate how the solution integrates with existing tools (e.g., Snowflake, Power BI).

• (Optional) If applicable, demonstrate data indexing, duplicate record detection, and golden record creation.

2. Real-World Use Case (15 mins)

• Present a case study relevant to government/public sector organizations.

• Explain how the solution improves data accessibility and governance.

• Highlight integration with common government data sources.

3. Implementation & Security (15 mins)

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 13 of 24

• Outline deployment timelines, common challenges, and best practices.

• Discuss ongoing maintenance, vendor support, and metadata management strategies.

• Explain security features, access controls, and compliance with regulatory frameworks.

4. Q&A Session (15–30 mins)

• Vendors should be prepared to address implementation, security, governance, and roadmap topics.

Additional Requirements

• Format: Presentations will be presented via remote/virtual platform, which may be provided by the Vendor or OHA.

• Submission of Materials: Vendors must submit a copy of their presentation in advance.

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 14 of 24

ATTACHMENT A — RESPONDENT INFORMATION AND CERTIFICATION SHEET

Legal Name:

Address : City, State,Zip:

State of Incorporation:

Entity Type:

Contact Name: Telephone: Email:

Oregon Business Registry Number (if required):

Any individual signing below hereby certifies they are an authorized representative of Respondent and that:

1. No attempt has been made or will be made by the Respondent to induce any other person or organization to submit or not submit a Response.

2. All contents of this Respondent Information and Certification Sheet are truthful and accurate and have been prepared independently from all other Responses, and without collusion, fraud, or other dishonesty.

3. Respondent acknowledges that the Response for any of the services described in this RFI will be used for planning and informational purposes only. Agency may issue a separate procurement in the future or directly negotiate for the services required by Agency.

Authorized Signature Date

(Printed Name and Title)

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 15 of 24

*** THIS PAGE SHOULD BE THE COVER PAGE OF THE RESPONSE ***

ATTACHMENT B — DISCLOSURE EXEMPTION AFFIDAVIT

____________________ (Affiant), being first duly sworn under oath, and representing [insert Proposer Name] (hereafter “Proposer”), hereby deposes and swears or affirms under penalty of perjury that:

I am an employee of the Proposer, I have knowledge of the Request for Proposals referenced herein, and I have full authority from the Proposer to submit this affidavit and accept the responsibilities stated herein.

I am aware that the Proposer has submitted a response to Agency RFI, dated on or about [insert date] (the “Proposal”), to the State of Oregon (State) in response to Request for Information 6106, for Data Catalog, and I am familiar with the contents of the RFI and Proposal.

I have read and am familiar with the provisions of Oregon’s Public Records Law, Oregon Revised Statutes (“ORS”) 192.311 through 192.478, and the Uniform Trade Secrets Act as adopted by the State of Oregon, which is set forth in ORS 646.461 through ORS 646.475. I understand that the Proposal is a public record held by a public body and is subject to disclosure under the Oregon Public Records Law unless specifically exempt from disclosure under that law.

I have reviewed the information contained in the Proposal. The Proposer believes the information listed in Exhibit A is exempt from public disclosure (collectively, the “Exempt Information”), which is incorporated herein by this reference. It is my opinion that the Exempt Information is exempt from disclosure under Oregon’s Public Records Law under the specifically designated sections as set forth in Exhibit A or constitutes “Trade Secrets” under either the Oregon Public Records Law or the Uniform Trade Secrets Act as adopted in Oregon because that information is either:

A formula, plan, pattern, process, tool, mechanism, compound, procedure, production data, or compilation of information that:

is not patented, is known only to certain individuals within the Proposer’s organization and that is used in a business the Proposer conducts, has actual or potential commercial value, and gives its user an opportunity to obtain a business advantage over competitors who do not know or use it.

or

Information, including a drawing, cost data, customer list, formula, pattern, compilation, program, device, method, technique or process that:

DAS Procurement Services, Version 4.0 – March 25, 2018 Page 16 of 24

Derives independent economic value, actual or potential, from not being generally known to the public or to other persons who can obtain economic value from its disclosure or use; and

Is the subject of efforts by the Proposer that are reasonable under the circumstances to maintain its secrecy.

I understand that disclosure of the information referenced in Exhibit A may depend on official or judicial determinations made in accordance with the Public Records Law.

Affiant’s Signature

State of ___________)

) ss:

County of ________)

Signed and sworn to before me on ___________ (date) by ______________________ (Affiant’s name).

Notary Public for the State of _________________

My Commission Expires: _________

RFI – OB # S-44300-00013891 OHA #6106 Page 17 of 24

EXHIBIT A TO ATTACHMENT B

Proposer identifies the following information as exempt from public disclosure under the following designated exemption(s):

RFI – OB # S-44300-00013891 OHA #6106 Page 18 of 24

Attachment C – Cost Estimate Sheet

Vendor Name: [Insert Vendor Name] Solution Name: 6106 Data Management Cataloging Solutions Date: [Insert Date]

Proposers should provide cost estimated ranges broken down as follows:

Category Estimated Cost Range(USD) Notes & Details

Licensing & Subscription $[Amount] – $[Amount]

Implementation Services $[Amount] – $[Amount]

Training & Adoption Support

$[Amount] – $[Amount]

Ongoing Support & Maintenance

Additional Features & Services

RFI – OB # S-44300-00013891 OHA #6106 Page 19 of 24

Attachment D

PRIVACY AND SECURITY REQUIREMENTS

Contractor’s obligations under this Contract include the requirements of this exhibit.

1. PURPOSE. The terms and conditions of this Privacy and Security Requirements exhibit address:

1.1. Contractor’s Use of Agency Data;

1.2. Contractor’s access to State systems and networks;

1.3. Contractor’s Services and delivery of the Solution; and

1.4. The periodic exchange of Agency Data between Agency’s and Contractor’s systems via electronic means.

2. COMPLIANCE REQUIREMENTS.

2.1. Compliance with Laws, Regulations, and Policies. Contractor and its employees, contractors, and agents shall comply with all applicable state and federal laws and regulations, and State of Oregon policies governing use and disclosure of data and access to State of Oregon networks and information systems, including as those laws, regulations, and policies may be updated from time to time. Applicable laws, regulations, and policies include but are not limited to:

2.1.1. The Oregon Consumer Information Protection Act, ORS 646A.600 through 646A.628 (OCIPA).

Contractor will have access to documents, records or items that contain “Personal Information,” as that term is used in ORS 646A.602(12), and which is subject to the protections of OCIPA. For purposes of OCIPA, Contractor is a vendor.

2.1.2. Oregon’s Statewide Information Security Standards, found online at:

https://www.oregon.gov/das/OSCIO/Pages/SecurityGuidance.aspxf, including security controls that meet or exceed “Moderate” security controls in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53.

2.1.3. Oregon’s Statewide Information Security Plan, found online at:

https://www.oregon.gov/das/OSCIO/Pages/SecurityGuidance.aspx.

2.1.4. Oregon’s Statewide IT Policies: https://www.oregon.gov/das/Pages/policies.aspx#IT.

3. NOTIFICATIONS.

3.1. Incidents and Breaches. In the event Contractor or its subcontractors or agents discover or are notified of a suspected or confirmed security incident, or a suspected or confirmed breach of security or privacy, Contractor shall notify the Agency Contract Administrator or delegate immediately, and in no event more than 24 hours following discovery or notification. An incident is an observable, measurable occurrence that is a deviation from expected operations or activities. A breach includes a failure to comply with Contractor’s confidentiality obligations. If the State determines that an incident or breach requires notification of Agency clients, or other notification required by law, the State will have sole control over the notification content, timing, and method, subject to Contractor’s obligations under applicable law.

3.2. Requests for Agency Data. In the event Contractor receives a third-party request for Agency Data, including any electronic discovery, litigation hold, or discovery searches, Contractor shall first give https://www.oregon.gov/das/OSCIO/Pages/SecurityGuidance.aspx http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://www.oregon.gov/das/OSCIO/Pages/SecurityGuidance.aspx https://www.oregon.gov/das/Pages/policies.aspx#IT

RFI – OB # S-44300-00013891 OHA #6106 Page 20 of 24

Agency notice and provide such information as may be reasonably necessary to enable Agency to protect its interests.

4. PRIVACY OBLIGATIONS. In addition to Contractor’s obligations under the terms and conditions of the Contract:

4.1. Generally. Contractor shall hold all Agency Data, and other information as to personal facts and circumstances obtained by Contractor on Agency clients, as confidential, using the highest standard of care applicable to the data, and shall not divulge any Agency Data without the written consent of Agency except as required by other terms of this Privacy and Security Requirements exhibit or applicable law.

4.2. Limited Purposes. Contractor shall limit the use or disclosure of Agency Data to persons directly connected with the administration of this Contract. Confidentiality policies apply to all requests from outside sources.

4.3. Privacy Protections. Agency Data may include information, such as client records, subject to specified confidentiality protections under state or federal law. Contractor shall comply with laws, regulations, and policies applicable to the information, including as specified in this Contract.

4.4. Training. Contractor’s employees, subcontractors, and agents who will access Agency Data have received training on the privacy and security obligations relating to Agency Data, including client records. Contractor shall provide periodic privacy and security training to its employees, subcontractors, and agents.

4.5. Responsible for Compliance. Contractor is responsible for the compliance of its employees, agents, and subcontractors with this Contract, including this Exhibit J, and with any third-party licenses to which access is subject.

4.6. Privacy and Security Measures. Contractor represents and warrants it has established and will maintain privacy and security measures that meet or exceed the standards set in laws, rules, and regulations applicable to the safeguarding, security, and privacy of Agency Data, including client records, State networks, and information assets, regardless of the media. Contractor shall monitor, periodically assess, and update its security controls and risk to ensure continued effectiveness of those controls.

4.7. Security Risk Management Plan. Contractor shall ensure the level of security and privacy protection required in accordance with this Contract is documented in a security risk management plan. Contractor shall make its security risk management plan available to the State for review upon request.

4.8. Audit Rights and Access. Contractor shall maintain records in such a manner as to clearly document its compliance with and performance under this Privacy and Security Requirements exhibit, and provide Agency, the Oregon Secretary of State, the federal government, and their duly authorized representatives access to Contractor’s officers, agents, contractors, subcontractors, employees, facilities, and records to:

4.8.1. Determine Contractor’s compliance with this Privacy and Security Requirements exhibit,

4.8.2. Validate Contractor’s written security risk management plan, or

4.8.3. Gather or verify any additional information Agency may require to meet any state or federal laws, rules, or orders.

4.8.4. Access to facilities, systems, and records under this section will be granted following reasonable notice to Contractor. Records include paper or electronic form, system security logs, and related

RFI – OB # S-44300-00013891 OHA #6106 Page 21 of 24 system components and tools (including hardware and software), required to perform examinations and audits, and to make excerpts and transcripts, including for data forensics.

5. ACCESS TO STATE SYSTEMS.

5.1. Agency Review of Access Requests. If required for access to State networks and systems, Agency will review requests and will:

5.1.1. Notify Contractor of the approval or denial of its request for each user for whom access has been requested;

5.1.2. Provide any unique log-on identifier required for authorized access;

5.1.3. Provide updates to approved inquiry processes and instructions to Contractor.

5.2. Contractor’s Responsibilities for User Accounts. Contractor shall facilitate completion of any forms for each person for whom access to state networks and systems is requested.

5.2.1. Contractor is responsible for all activities that occur through its access, including for any acts related to a lost or stolen user ID or password.

5.2.2. Contractor is responsible for ensuring information provided by its users is accurate, complete, and up to date.

5.2.3. Contractor shall immediately notify Agency when a user, group of users, or Contractor, no longer requires access, whether due to changes in duties or due to changes in Contractor’s programs related to this Contract.

5.3. Security and Disposal. Contractor shall maintain security of equipment, and ensure the proper handling, storage and disposal of all information assets accessed, obtained, or reproduced by Contractor and its users to prevent inadvertent destruction or loss. Contractor shall ensure proper disposal of equipment and information assets when authorized use ends, consistent with Contractor’s record retention obligations and obligations regarding information assets under this Contract.

5.4. Prevention of Unauthorized Access. Contractor shall prevent any access to State of Oregon networks and information systems by its users that is not authorized in accordance with this Contract and applicable law, and shall implement and maintain safeguards to prevent unauthorized access.

5.5. No Overseas Access. Contractor shall not allow access to Agency Data or the Production Environment from locations outside of the United States or its territories, nor allow use of any information asset in any country or in any manner prohibited by governing applicable law, rule, or policy.

5.6. Authorized Access and Use Only. No user may access or use Agency Data for any purpose other than those specifically authorized through this Contract.

5.6.1. Users shall not use access to obtain or attempt to obtain any Agency Data or information assets not authorized or intentionally made available.

5.6.2. The use and disclosure of any information asset is strictly limited to the minimum information necessary to the exchange of Agency Data between the parties.

5.6.3. Except as otherwise specified or approved by Agency, neither Contractor nor its users may modify, alter, delete, or destroy any information asset.

RFI – OB # S-44300-00013891 OHA #6106 Page 22 of 24

5.7. Revocation or Termination of Access. Breach, or wrongful use or disclosure of Agency Data or other Confidential Information by Contractor or its users, may cause the immediate revocation of the access granted though this Contract, in the sole discretion of Agency, or Agency may specify a reasonable opportunity for Contractor to cure the unauthorized use or disclosure and end the violation, and terminate the access if Contractor does not do so within the time specified by Agency. Legal actions also may be taken for violations of applicable regulations and laws.

5.8. No Unauthorized Distribution. Contractor shall not sell, make available, or provide Agency Data or other Confidential Information in any form to any other persons or organizations, and shall not use Agency Data or other Confidential Information for any purposes other than as allowed under this Contract and applicable law.

5.9. No Impairment. Contractor shall not use this access in any manner which could damage, disable, overburden, or impair State of Oregon networks or information systems, or interfere with any other entity’s use or benefit of the network and information systems.

5.10. Prohibition on Data Mining. Contractor shall not capture, maintain, scan, index, share or use Agency Data stored or transmitted by virtue of the Services or Solution, or otherwise use any data-mining technology, for any non-authorized activity. For purposes of this requirement, “non-authorized activity” means the data mining or processing of data, stored or transmitted through the Solution or State systems, for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security analysis that is not explicitly authorized in this Contract.

9.11. Incidents and Breaches. Contractor shall comply, and shall cause its subcontractors to comply, with any requirements for identifying and addressing a security incident or breach. This requirement applies regardless of whether the incident or breach was accidental or otherwise.

6. SUSPENSION OR TERMINATION.

6.1. Agency may immediately revoke the access granted Contractor for Contractor’s failure to comply with the requirements of this Privacy and Security Requirements exhibit. In such event, Agency will provide subsequent written notice to Contractor’s point of contact. Agency may, to the extent it determines it is reasonable and able to do so, provide advance notice to Contractor to cure any deficiency or breach of this Privacy and Security Requirements exhibit.

6.2. Either party may terminate access under this Privacy and Security Requirements exhibit, and Agency may modify access, upon written notice if there are changes to or revised interpretations of federal or state laws, rules, or regulations, or if either party has changes in policies that require such action.

7. RETURN OF AGENCY DATA. Upon expiration or termination of the Contract for any reason whatsoever, Contractor shall immediately deliver to Agency all of Agency’s information assets, including Agency Data, that are in the possession or under the control of Contractor in whatever stage and in a format acceptable to Agency.

7.1. Except as necessary to meet obligations under Contract Section 22, Records Maintenance and Access, Contractor shall not retain any copies of Agency Data or other electronic Confidential Information.

Contractor shall notify Agency of any conditions that make returning all such Agency property not feasible. Upon Agency’s written acknowledgement that returning all Agency Data and electronic Confidential Information is not feasible, Contractor shall purge or destroy retained Agency Data and electronic Confidential Information in all its forms in accordance with the most current version of NIST SP

RFI – OB # S-44300-00013891 OHA #6106 Page 23 of 24

800-88 (or other agreed-upon standard) and on request provide Agency with written certification of sanitization.

7.2. Contractor shall maintain protections required by law or the Contract for any retained Agency Data and electronic Confidential Information for so long as Contractor (including through any subcontractor) retains it.

8. COSTS. Each party will bear its own costs related to the acquisition of all equipment, software, data lines or connections necessary for access to State of Oregon networks and information systems, unless otherwise agreed to by written agreement between the parties. Each party is responsible for securing compatible hardware, equipment, and software, and network connections. Each party is responsible for complying with the licenses for third party products, including software and services that allow access.

9. INTERPRETATION. Any ambiguity in this Privacy and Security Requirements Exhibit will be resolved to permit Agency to comply with applicable privacy and security laws and State of Oregon and Agency policies interpreting those laws.

SUBCONTRACTORS. Contractor shall ensure all subcontractors providing services related to this Privacy and Security Exhibit comply with its terms.

RFI – OB # S-44300-00013891 OHA #6106 Page 24 of 24

Attachment E

Definitions

Definitions for key components of Enterprise Data Management Cataloging Solutions:

Data Cataloging “means” The process of organizing and classifying data assets to enhance discoverability, accessibility, and usability within an enterprise.

Data Governance Framework “means” A set of policies, standards, and controls designed to ensure data quality, security, compliance, and ethical usage.

Data Integration & Interoperability “means” The ability to seamlessly exchange and consolidate data across different systems, applications, and platforms for unified access.

Data Lineage Tracking “means” A system that provides visibility into the origins, transformations, and movement of data across various platforms, ensuring transparency and traceability.

Data Quality Management ‘means” Processes and technologies that assess, cleanse, and maintain data accuracy, completeness, and reliability.

Master Data Management (MDM) ‘means” A framework ensuring consistency, accuracy, and governance of core business data across systems, eliminating duplication and discrepancies.

Metadata Management “means” The practice of maintaining structured information about data assets, including descriptions, relationships, and attributes, to improve governance and understanding.

Security & Access Control “means” Mechanisms that protect sensitive data, enforce access permissions, and ensure compliance with regulatory requirements.

Self-Service Analytics “means” Tools and platforms that empower users to search, explore, and analyze data independently, without requiring technical expertise.