DEP Solicitation No. 2026017 April 8, 2026 Addendum No. 1 Page 1 of 22

ADDENDUM No. 1

FLORIDA DEPARTMENT OF ENVIRONMENTAL PROTECTION

DEP Procurement Section

3800 Commonwealth Boulevard, MS#93 Tallahassee, Florida 32399-3000

April 8, 2026

Addendum To: DEP RFI No. 2026017, entitled “Public Records Search & Case Management Solution”

The Department hereby answers questions posed by interested entities. This addendum does not need to be returned with the response. The Department hereby answers the following questions:

Question # Solicitation Section Solicitation Page # Question / Answer

1. Platform & Licensing - Does the Department have an existing Microsoft 365 enterprise agreement, and if so, at what licensing tier (e.g., E3, E5, E5 Compliance)? Understanding the current license posture would allow vendors to accurately scope incremental solution costs versus capabilities already available within the tenant.

Answer: G3.

2. - - Will the Department consider responses from Microsoft technology partners positioning Microsoft Purview (eDiscovery Premium, Audit Premium, Legal Hold, Information Protection) as the underlying platform, with the responding vendor providing implementation, configuration, and managed services? Or is the Department seeking a standalone third-party ISV solution independent of the existing M365 environment?

Answer: Yes, the Department will consider responses from Microsoft technology partners.

3. - - Is the Department's preference for deployment on Azure Commercial or Azure Government Cloud? The RFI references Azure-hosted deployment (IM-01) and notes Azure Government as a 'Should Have' under CO-04.

Clarifying this will allow vendors to accurately represent data residency and FedRAMP authorization status.

Answer: Azure Government cloud.

4. Scope & Scale - The RFI references approximately 6,000 mailboxes as the anticipated scale. Does this represent the full Department headcount, or a subset of custodians? Are SharePoint Online sites, Teams channels, and OneDrive accounts also intended to be in scope, or is the primary focus Exchange Online?

Addendum No. 1 Page 2 of 22

Question # Solicitation Section Solicitation Page # Question / Answer

Answer: Focus is email accounts, the head counts hover around 4,000, but with service emails and shared email the number runs up to nearly 6,000.

5. - - Requirement CO-03 references CJIS policy alignment. Can the Department clarify whether DEP has active CJIS obligations (e.g., access to FBI CJIS systems), or whether this requirement reflects a precautionary compliance posture?

This distinction affects the personnel screening, encryption, and audit requirements vendors must address.

Answer: No, CJIS data is stored or transported via department email.

6. - - Regarding IN-02 (Integration with EDMS), does the Department currently operate a specific EDMS platform (e.g., SharePoint Online, Documentum, OpenText) that the solution would need to integrate with? Or is this requirement forward-looking?

Answer: EDMS system is cloud-based LaserFiche.

7. Procurement Path - If the Department proceeds to a formal competitive solicitation following this RFI, does the Department anticipate using an existing state term contract or cooperative purchasing vehicle (e.g., MyFloridaMarketPlace state term contract, Sourcewell, NASPO ValuePoint), or would a standalone ITN or RFP be issued?

Answer: The procurement type is unknown at this time. If that product is available through a State Term Contract or Alternate Contract Source, that would prove to be more economical for the State of Florida.

8. - - What is the Department's anticipated timeline between the close of this RFI and a potential formal solicitation, if the market assessment supports moving forward?

Answer: That information is unknown at this time.

9. - - Will vendors who submit responses to this RFI be invited to provide product demonstrations, and if so, will demonstrations be conducted in person in Tallahassee or via remote session?

Answer: See the attached Addendum No. 1 – Revised RFI 2026017, Section 1.05, Submittal of Response of the RFI. If the Department determines demonstrations are needed, the Department may invite select vendors to demo their product in person, at no cost to the Department. Vendors may request remote sessions, as needed.

10. A. Access Control & Authorization

AC-01 / AC-03

- Does DEP operate under a commercial Azure AD/Entra ID tenant or an Azure Government (GovCloud) tenant? This distinction directly affects authentication endpoints, SCIM

Addendum No. 1 Page 3 of 22

Question # Solicitation Section Solicitation Page # Question / Answer provisioning behavior, and conditional access policy configurations that any compliant solution will need to accommodate. Knowing the answer upfront allows us to describe our integration approach with specificity rather than covering both scenarios generically.

Answer: DEP operates under Azure Government.

11. A. Access Control & Authorization

AC-02

- Will DEP’s roles and permissions be defined primarily through Entra ID security groups synchronized into the application, or does the Department expect the solution to maintain its own independent RBAC model? The answer will shape how we describe our access control architecture, role change logging, and the day-to-day administration experience for DEP’s IT team.

Answer: DEP’s preference is to be federated with Azure Entra ID.

12. A. Access Control & Authorization

AC-04

- Which ITSM platform does DEP currently use? Knowing the specific platform will allow us to describe the depth of our existing, tested connectors versus a custom REST API integration — a meaningful difference in implementation complexity and timeline that is worth clarifying before vendors finalize their response.

Answer: DEP uses Ivanti Cherwell.

13. A. Access Control & Authorization

AC-05 / AC-06

- Does DEP have a documented workflow — even at a high level — for how public records requests are currently processed from intake through review, redaction, and release? If so, is that documentation available for vendor review as part of the RFI process, or will workflow definition be developed collaboratively with the selected vendor during implementation?

Answer: DEP cannot provide a workflow document.

14. A. Access Control & Authorization

AC-02 / AC-06

- Does the Department require periodic access certification or attestation processes for users with elevated privileges

— particularly those with permissions to perform exports, redactions, or legal hold actions? If so, should the solution support native access review workflows, or integrate with an existing identity governance platform? Given the CJIS compliance context, personnel-level access controls and review cycles may carry regulatory implications beyond standard RBAC configuration.

Answer: The Department does not currently require periodic access re-certification.

15. B. Search Scope & Query Precision

SR-01 / SR-03

- Can the Department provide an approximate total data volume — in terabytes — across Exchange Online, SharePoint Online, and OneDrive for Business? Additionally, should vendors include in-place archive mailboxes, litigation

Addendum No. 1 Page 4 of 22

Question # Solicitation Section Solicitation Page # Question / Answer hold content, and any journaled data in the indexed scope, or is the initial scope limited to active mailbox content?

Both figures are critical for accurate indexing latency estimates and storage architecture sizing.

Answer: Thirty-five (35) Terabytes.

16. B. Search Scope & Query Precision

SR-02

- Is DEP’s content environment primarily English-only, or is there a meaningful volume of multilingual content — for example, Spanish-language correspondence — that would require language-aware search capabilities beyond standard English tokenization?

Answer: In English only.

17. B. Search Scope & Query Precision

SR-04

- Does the Department expect the solution to leverage Microsoft Purview Compliance Center for collection and search scoping, or does DEP prefer a fully independent collection architecture that operates outside of Microsoft’s native eDiscovery toolset? Understanding this preference will help vendors accurately describe both their native Purview integration and any standalone collection capabilities they offer.

Answer: The Department will consider both as options.

18. B. Search Scope & Query Precision

SR-06

- Does DEP have a preferred destination for immutable audit log exports — for example, Microsoft Sentinel, Splunk, or an Azure storage repository — or is the requirement simply that logs be exportable in a standard, machine-readable format for consumption by whichever platform DEP designates?

Answer: Microsoft Sentinel.

19. C. Case Management &

Auditability

CM-01 / CM-02

- Can the Department describe the primary case types it anticipates managing in the new system? For example, is the main driver Chapter 119 public records requests, or does DEP also expect to manage regulatory enforcement actions, internal investigations, or other matter types?

Understanding the full case taxonomy will help us demonstrate how our case management model maps to DEP’s real-world operational workflows.

Answer: The Department' would like to manage any type of request such as Chapter 119 public records requests, Freedom of Information Act, and investigative.

20. C. Case Management &

Auditability

CM-03

- Does the Department anticipate producing exports primarily for public records request fulfillment to requestors, for litigation support to outside counsel or a court, or a combination of both? The production workflow, required metadata packaging, and chain-of-custody

Addendum No. 1 Page 5 of 22

Question # Solicitation Section Solicitation Page # Question / Answer documentation differ meaningfully between these scenarios.

Answer: The Department will use the solution for a combination of both.

21. C. Case Management &

Auditability

CM-04

- Does DEP currently have a formal legal hold notification process — for example, issued through the Office of General Counsel or a designated records officer — or would the new solution be expected to introduce and formalize that process? Additionally, does the Department require integration with existing in-place holds already placed through Microsoft Purview/Exchange Online, or would hold management be handled entirely within the new system?

Answer: DEP does not have a formal legal hold notification process, and the designation of record custodians is maintained in another system.

22. C. Case Management &

Auditability

CM-05

- Does DEP have specific statutory or regulatory reporting obligations that require standardized formats — for example, annual public records compliance reporting under Florida Statutes or submissions to the Florida Attorney General’s office? If so, are there examples of those report formats the Department could share so vendors can confirm their reporting capabilities align with DEP’s requirements?

Answer: The Department is not immediately aware of any specific requirements at this time.

23. C. Case Management &

Auditability

CM-01 / CM-02

- How does the Department distinguish between records management workflows and case-based discovery workflows in its current operations? Understanding where these functions overlap — and where they are handled by separate teams or processes — will help vendors accurately describe how their solution supports both disciplines, either through a unified interface or distinct functional modules.

Answer: No, this is not currently distinguished.

24. C. Case Management &

Auditability

CM-01 / CM-02

- Which organizational group — Legal, Records Management, or IT — will have primary operational ownership of the solution on a day-to-day basis? Understanding the primary system owner helps vendors propose a governance model, administrator role structure, and training approach that is realistic for DEP’s staffing and organizational structure.

Answer: Office of Technology and Information Services.

25. D. Advanced Features

AF-01

- Can the Department clarify when deduplication should occur — at the point of collection, at the case or review set level, or at the point of export? Each approach carries meaningful implications for storage sizing and chain-of-

Addendum No. 1 Page 6 of 22

Question # Solicitation Section Solicitation Page # Question / Answer custody integrity. DEP’s preference here will allow vendors to describe their deduplication architecture accurately.

Answer: Review set level.

26. D. Advanced Features

AF-02

- Does DEP expect redaction to be performed natively within the solution’s document viewer, or would integration with a specialized external redaction tool be acceptable?

Additionally, does the anticipated volume of redaction work suggest a need for multi-reviewer production queues, or is redaction expected to be primarily a single-reviewer activity?

Answer: An integrated tool would be acceptable.

27. D. Advanced Features

AF-03

- Is DEP’s primary PII detection need focused on pre-release review — identifying PII before disclosing records to a requestor under Chapter 119 — or does it also extend to proactive, ongoing data governance and PII classification across the broader Microsoft 365 environment? These are meaningfully different use cases, and clarifying the primary driver will help us propose the appropriate tier of capability.

Answer: Only pre-release review.

28. D. Advanced Features

AF-04

- Requirement AF-04 calls for bulk tag, redact, export, and hold operations with queuing and progress tracking. Can the Department share a rough estimate of the expected batch sizes for these operations — for example, the typical number of documents in a public records response or a legal hold population? Understanding expected volumes will help vendors characterize their queuing architecture and error recovery capabilities accurately.

Answer: The Department does not have that information.

29. D. Advanced Features

AF-02 / AF-03

- Does the Department require that redaction activities meet a formal defensibility standard — for example, full audit traceability of every redaction decision, reviewer attribution, and the ability to reconstruct a redaction rationale for each item? For public records fulfillment under Chapter 119, redaction decisions can be subject to legal challenge, and understanding DEP’s standard will help vendors confirm whether their redaction audit and logging capabilities meet that bar.

Answer: No, the Department does not anticipate on requiring this functionality.

30. E. Integration with Records Systems

IN-01

- Is there a specific Azure region required for data residency or state compliance reasons — for example, East US or South Central US — or is region selection at the vendor’s discretion, provided all data remains within US boundaries?

(Note: Azure Government Cloud requirements are addressed in depth in Section G, Question 3, as they carry

Addendum No. 1 Page 7 of 22

Question # Solicitation Section Solicitation Page # Question / Answer compliance-specific implications that benefit from separate treatment.)

Answer: East US.

31. E. Integration with Records Systems

IN-02

- Does the Department currently use SharePoint Online as an active records repository, or primarily as a collaboration and document-sharing platform? If records management is handled through a separate EDMS — such as OpenText, Documentum, Laserfiche, or Hyland OnBase — will that system remain in place alongside the new solution, and would bidirectional integration between the two systems be required?

Answer: See the answer to question #3.

32. E. Integration with Records Systems

IN-03

- Does DEP currently use a third-party email archiving solution — such as Mimecast, Veritas Enterprise Vault, or a journaling platform — that would serve as an additional data source, or is Exchange Online the sole email repository? If legacy PST files or journal archives exist, understanding their approximate volume and format will be critical for accurate migration and connector scoping.

Answer: Exchange Online is the sole email repository.

However, the Department would consider an option that provides alternative storage.

33. E. Integration with Records Systems

IN-04

- Does DEP have an existing middleware or integration platform — such as Azure Logic Apps, Power Automate, or MuleSoft — through which API integrations are typically orchestrated, or would the new solution’s APIs be consumed directly by DEP’s IT team?

Answer: No.

34. E. Integration with Records Systems

IN-02 / IN-04

- Are there downstream systems that require automated delivery or publication of released records following fulfillment — for example, a citizen-facing public records portal, a state government disclosure platform, or an external case management system? If so, understanding the expected delivery format and frequency will help vendors describe the appropriate outbound integration architecture for the end-to-end fulfillment workflow.

Answer: No.

35. F. System Reliability & Support

RS-01

- The RFI defines SLA thresholds of P95 ≤ 2 seconds for standard queries and P95 ≤ 5 seconds for complex queries.

Does DEP’s definition of “complex” include cross-custodian, multi-repository searches spanning the full 6,000-mailbox population, or are complex queries expected to be scoped against a defined subset? Clarifying this benchmark will allow vendors to validate their SLA commitments against DEP’s realistic workloads.

Addendum No. 1 Page 8 of 22

Question # Solicitation Section Solicitation Page # Question / Answer

Answer: DEP defines complex as multi-user and multi-subject queries.

36. F. System Reliability & Support

RS-02

- Does the Department have a preferred secondary Azure region for geo-redundant failover, or is region selection at the vendor’s discretion provided US-only data residency is maintained? Additionally, does DEP require periodic DR testing — such as an annual live failover exercise or a documented tabletop test — with results formally delivered to the Department?

Answer: See the answer to question #30.

37. F. System Reliability & Support

RS-03

- Does DEP require that Sev-1 support staff be physically located within the United States? Additionally, does the Department use an existing state ITSM platform for vendor ticket routing, or would support be managed through the vendor’s own ticketing portal? Given the CJIS compliance context, the US-based staffing question may carry regulatory implications worth clarifying.

Answer: Yes, staff are required to be within the United States. DEP uses Ivanti Cherwell.

38. F. System Reliability & Support

RS-04

- Does the Department expect performance validation or load testing against production-scale datasets prior to go-live — for example, a formal acceptance test simulating concurrent search activity across the full 6,000-mailbox population? If so, does DEP have specific pass/fail criteria or benchmark thresholds that vendors should factor into their implementation timeline and project plan?

Answer: This has not been determined yet.

39. G. Compliance & Legal Readiness

CO-01

- Can the Department share an approximate annual volume of public records requests received, along with any internal response time targets that go beyond the statutory minimums under Chapter 119? Understanding both the volume and DEP’s internal SLAs will help vendors demonstrate how their workflow automation and queue management capabilities translate to DEP’s specific operational demands.

Answer: The Department averages around 6,500 requests annually. There are no other response time targets than those set by Chapter 119.

40. G. Compliance & Legal Readiness

CO-02 / CO-03

- Can the Department clarify whether CJIS compliance is required because DEP handles data that originates from or is shared with a criminal justice agency, or is it included as a precautionary baseline? Additionally, does DEP require vendors to hold an existing FedRAMP or StateRAMP Authority to Operate, or would a documented NIST-aligned control framework with a third-party assessment — such as

Addendum No. 1 Page 9 of 22

Question # Solicitation Section Solicitation Page # Question / Answer

SOC 2 Type II or ISO 27001 — be sufficient to satisfy requirements CO-02 and CO-03?

Answer: See the answer to question #5.

41. G. Compliance & Legal Readiness

CO-04

- Beyond US-region commercial Azure, does the Department anticipate a requirement for Azure Government Cloud hosting to satisfy Florida state governance policies or obligations to federal agency partners? If Azure Government is a realistic possibility, vendors would need to confirm feature parity between commercial and GovCloud deployments before finalizing their proposed architecture.

(Note: commercial Azure region and data residency requirements are also addressed in Section E, Question 1.)

Answer: See the answer to question #3.

42. G. Compliance & Legal Readiness

CO-05

- Does DEP currently handle — or expect to handle — Protected Health Information within the records covered by this solution, such as environmental health or employee health records, such that a HIPAA Business Associate Agreement would be required of the selected vendor?

Answer: Yes.

43. G. Compliance & Legal Readiness

CO-02 / CO-03

- Does the Department’s CJIS compliance requirement extend to the personnel level — including background checks, security awareness training, and access restrictions for vendor staff who may interact with CJIS-covered data — or does it apply at the infrastructure and controls level only?

Personnel-level CJIS requirements have direct implications for vendor staffing, subcontractor restrictions, and on-site access protocols, and clarifying this distinction early will allow vendors to confirm compliance without overstating or understating their obligations.

Answer: No.

44. H. Non-Functional Requirements

(NFRs)

NF-01

- Which SIEM platform does DEP currently operate — for example, Microsoft Sentinel, Splunk, IBM QRadar, or a managed SIEM service? Knowing DEP’s environment will allow vendors to describe a specific, validated integration approach rather than a generic log-forwarding capability.

Answer: See the answer to question #18.

45. H. Non-Functional Requirements

(NFRs)

NF-02 / NF-03

- Is the intended user base primarily a small group of trained power users — records officers, legal staff, and IT administrators — or does the solution need to serve a broader end-user population with access to search and case functions? Understanding the scale and sophistication of the user base will help vendors appropriately scope training, role-based UI design, and performance benchmarking.

Addendum No. 1 Page 10 of 22

Question # Solicitation Section Solicitation Page # Question / Answer

Answer: Record officers, legal staff, and IT administrators only.

46. H. Non-Functional Requirements

(NFRs)

NF-04 / NF-05

- Does the Department have a policy preference for SaaS-delivered solutions versus vendor-managed Azure-hosted (IaaS/PaaS) deployments, or is either model acceptable provided all functional and compliance requirements are met? This distinction has significant implications for how vendors describe configuration management, patching cadences, and upgrade cycles.

Answer: Both IaaS and PaaS will be considered.

47. I. Implementation & Migration

IM-01

- Does DEP have an existing Azure landing zone or hub-and-spoke network topology that the solution would need to deploy into, or would this be a greenfield Azure deployment? If a landing zone exists, are there high-level networking constraints — such as private DNS zones, ExpressRoute connectivity, or Azure Firewall policies — that would shape the deployment architecture?

Answer: No.

48. I. Implementation & Migration

IM-02

- Does the Department have a target timeline in mind for completing the pilot phase and achieving full enterprise deployment? Have pilot departments or user groups been identified, and are there external factors — such as legislative sessions, audit cycles, or expiring system contracts — that create hard deadlines the implementation schedule must accommodate?

Answer: No, this has not been determined yet.

49. I. Implementation & Migration

IM-03

- Beyond active Exchange Online and Office 365 mailbox content, is there legacy data — such as PST archives, journaled data, or content from an on-premises Exchange environment — that would need to be migrated into the new solution? If so, an estimate of the approximate volume and format will help vendors size the migration effort accurately.

Answer: No.

50. I. Implementation & Migration

IM-04

- Does the Department have existing configuration artifacts

— such as role definitions, case type taxonomies, retention categories, or search templates — from a legacy system that should be replicated in the new solution, or will configuration be developed collaboratively from scratch during the implementation engagement?

Answer: No, all would need to be developed.

51. I. Implementation & Migration

IM-05 / IM-06

- Does the Department have a preferred training delivery model — instructor-led on-site, virtual instructor-led, or self-paced e-learning — and does DEP’s change

Addendum No. 1 Page 11 of 22

Question # Solicitation Section Solicitation Page # Question / Answer management requirement envision a formal communication plan to affected departments and custodians, or is the focus primarily on adoption tracking and post-go-live usage reporting?

Answer: No, training preference and DEP change management is an internal process only.

52. I. Implementation & Migration

IM-02 / IM-06

- Does the Department expect the selected vendor to provide ongoing operational and application support following implementation — for example, a managed service, a dedicated customer success arrangement, or application administration support — or does DEP plan to transition full operational ownership to internal staff after go-live?

Understanding the expected post-implementation model will help vendors propose a support structure and staffing plan that is appropriately scoped for DEP’s long-term needs.

Answer: Vendor operational and application support.

53. General RFI Scope

- Does the Department anticipate issuing a formal Invitation to Bid (ITB), Request for Proposal (RFP), or other competitive solicitation following the RFI process, or is DEP exploring alternative procurement vehicles such as a State Term Contract, MyFloridaMarketPlace contract, or cooperative purchasing agreement? Understanding the anticipated procurement pathway will help vendors calibrate the appropriate level of solution specificity and pricing detail for the full RFI response.

Answer: See the answer to question #7.

54. General Demonstrations

- Will the Department conduct product demonstrations or proof-of-concept evaluations as part of its market research following the RFI response period? If so, does DEP have a preferred demonstration environment — for example, a sandboxed tenant connected to a representative dataset — or would demonstrations use vendor-provided environments?

Answer: See the answer to question #9.

55. - - Please confirm whether the Department will consider a modular Microsoft-based solution architecture composed of multiple integrated components, rather than requiring a single monolithic software product.

Answer: See the answer to question #2.

56. - - Please confirm whether an architecture centered on Microsoft Dynamics 365 for case management, Power Apps for user-facing applications, Power Automate for workflow, SharePoint Online for document and records storage, and Azure services for hosting, integration, and security would

Addendum No. 1 Page 12 of 22

Question # Solicitation Section Solicitation Page # Question / Answer be acceptable, provided all functional and non-functional requirements are met.

Answer: Yes, acceptable and considered.

57. - - Please clarify whether the Department prefers a single-vendor application or whether it is open to an integrated enterprise platform solution built from native Microsoft technologies and supporting components.

Answer: See the answer to question #2.

58. - - With respect to case management requirements, please clarify whether the Department’s intended scope includes request intake, case assignment, SLA tracking, workflow routing, approval steps, correspondence history, escalation management, and audit history.

Answer: Yes to all.

59. - - Please confirm whether Dynamics 365 case management capabilities would be considered an acceptable approach for satisfying the case-based records, status tracking, role-bound access, timeline, and reporting requirements.

Answer: Yes.

60. - - Please advise whether Power Apps would be acceptable for administrative screens, request intake forms, role-based case views, exception handling, and related user interfaces.

Answer: Yes.

61. - - Please advise whether Power Automate would be acceptable for configurable workflows, routing, approvals, notifications, escalations, and integration events.

Answer: Yes.

62. - - The RFI references integration with SharePoint Online or other EDMS platforms. Please clarify whether the Department would accept SharePoint Online as the primary repository for case documents and supporting records, provided metadata, retention, versioning, and access controls are preserved.

Answer: Yes.

63. - - Please clarify whether the Department expects integration with Microsoft Purview, including retention labels, records management, audit, legal hold, or eDiscovery-related services.

Answer: No, the Department does not expect integration with MS Purview.

64. - - Please confirm the intended search scope for the solution.

Specifically, should respondents assume search must include only Exchange Online, or should it also include

Addendum No. 1 Page 13 of 22

Question # Solicitation Section Solicitation Page # Question / Answer

SharePoint Online, OneDrive, Teams, and other Microsoft 365 repositories.

Answer: Search scope will be required to select individual repositories or multiple.

65. - - Please clarify whether the Department would accept a search architecture that uses Microsoft Graph APIs, Microsoft 365/Purview data access patterns, or indexed content in Azure, provided the solution meets performance, auditability, and compliance requirements.

Answer: Yes.

66. - - Please advise whether a near-real-time indexed search model would be acceptable if it satisfies the Department’s required search latency and response-time expectations.

Answer: Yes.

67. - - For the stated scale of approximately 6,000 mailboxes, please confirm whether respondents should assume a single Microsoft 365 tenant or whether multiple tenants, business units, or segregated repositories should be anticipated.

Answer: Single tenant.

68. - - Please clarify whether the Department requires redaction and review to occur entirely within one application, or whether those capabilities may be delivered through integrated tools within a Microsoft-centered architecture.

Answer: See the answer to question #26.

69. - - Please advise whether PII detection, suggested redactions, confidence scoring, and review queues may be provided through integrated Azure-based or partner-enabled services, rather than solely through a single native application module.

Answer: Yes.

70. - - The RFI states that the solution must be designed for Azure-hosted deployments. Please clarify whether the Department would accept an Azure architecture using services such as Azure App Service, Azure Functions, Azure SQL, Azure Storage, Azure Key Vault, and private networking controls, where appropriate.

Answer: Yes.

71. - - Please clarify whether the Department prefers deployment in Azure commercial, Azure Government, or either, assuming compliance obligations are satisfied.

Answer: See the answer to question #3.

72. - - Please advise whether the Department expects the solution to be deployed within a Department-owned Azure

Addendum No. 1 Page 14 of 22

Question # Solicitation Section Solicitation Page # Question / Answer tenant/subscription or whether a vendor-managed Azure environment would also be acceptable.

Answer: Both options will be considered.

73. - - Please clarify the Department’s expectations regarding private endpoints, network isolation, and secure connectivity between Azure-hosted application components and Microsoft 365 data sources.

Answer: The question is unclear for the Department to provide an answer.

74. - - Please confirm whether Microsoft Entra ID, including Conditional Access, MFA enforcement, group-based security, and automated provisioning/deprovisioning, would be an acceptable approach to satisfy the identity, SSO, and access-control requirements.

Answer: Yes.

75. - - Please clarify whether Power BI would be acceptable for operational dashboards and reporting related to case status, workload, SLA tracking, throughput, and audit visibility.

Answer: Yes.

76. - - The RFI references vendor-agnostic ITSM integration and API-first integration. Please confirm whether REST APIs, webhooks, Power Platform connectors, and Azure integration services would satisfy these expectations, provided the solution remains platform-agnostic in its external integrations.

Answer: Yes.

77. - - Please clarify the Department’s expectations for immutable logging, chain of custody, and tamper-evident audit records, including whether Azure-native controls and Microsoft audit services would be acceptable if properly configured.

Answer: Yes, MS Sentinel.

78. - - Please advise whether respondents should distinguish between:

• Microsoft licenses already owned by the Department,

• incremental Microsoft licenses required,

• third-party software costs, and

• implementation/configuration/integration services.

Answer: Yes.

79. - - Please confirm whether the Department is interested in solutions that maximize the value of existing Microsoft

Addendum No. 1 Page 15 of 22

Question # Solicitation Section Solicitation Page # Question / Answer enterprise investments in order to minimize net-new platform acquisition costs.

Answer: Yes, the Department is interested in any solutions.

80. - - Please clarify whether the Department prefers respondents to present a phased implementation approach such as pilot, controlled rollout, and enterprise adoption, consistent with the implementation and migration section of the RFI.

Answer: Short phased approach is acceptable such as trail-pilot-rollout.

81. - - Please advise whether respondents may provide multiple solution options, such as:

• a Microsoft-native baseline architecture, and

• an enhanced option including third-party add-ons for advanced redaction, analytics, or review.

Answer: Yes.

82. - - Please clarify whether the Department would find value in a response that distinguishes between configuration-based capabilities and capabilities requiring custom development or third-party extensions within a Microsoft stack solution.

Answer: Yes.

83. - - How many users will need to access the system?

Answer: Around 4,000.

84. - - How many integrations are needed?

Answer: One.

85. - - What systems need to be integrated?

Answer: Microsoft Office 365.

86. - - Can you provide an estimate for the amount of data migration needed to support this?

Answer: See the answer to question #15.

87. App. A §A (AC-01) p.7 Does the solution support SSO with Azure AD (Entra ID) via SAML 2.0 or OIDC?

Answer: This is dependent upon the proposed solution’s capabilities. Solution must meet the requirements of Addendum No. 1 – Revised RFI 2026017, Appendix A – Requirements.

88. App. A §A (AC-01) p.7 Can MFA be enforced through Azure Conditional Access policies?

Answer: See the answer to question #87.

89. App. A §A (AC-02) p.7 Can role permissions be configured at the field level, not just the object level?

Addendum No. 1 Page 16 of 22

Question # Solicitation Section Solicitation Page # Question / Answer

Answer: See the answer to question #87.

90. App. A §A (AC-02) p.7 Are role assignment changes captured in an audit log?

Answer: See the answer to question #87.

91. App. A §A (AC-03) p.7 Does the solution support automated user provisioning and deprovisioning via SCIM?

Answer: See the answer to question #87.

92. App. A §A (AC-04) p.8 Does the solution offer REST APIs or webhooks for integration with ITSM platforms?

Answer: See the answer to question #87.

93. App. A §A (AC-05) p.8 Can admins configure workflow states and escalations without vendor assistance?

Answer: See the answer to question #87.

94. App. A §A (AC-06) p.8 Can export access be restricted based on a user’s role or department?

Answer: See the answer to question #87.

95. App. A §B (SR-01) p.8 Does the search support Boolean operators (AND, OR, NOT)?

Answer: See the answer to question #87.

96. App. A §B (SR-01) p.8 Can searches be filtered by date range, sender, recipient, and subject?

Answer: See the answer to question #87.

97. App. A §B (SR-02) p.8 Does it support proximity search (e.g., two words within N words of each other)?

Answer: See the answer to question #87.

98. App. A §B (SR-02) p.9 Are stemming and wildcard operators supported in keyword searches?

Answer: See the answer to question #87.

99. App. A §B (SR-03) p.9 Can the solution index and search within ZIP archives and nested attachments?

Answer: See the answer to question #87.

100. App. A §B (SR-03) p.9 What file formats are supported for attachment indexing (e.g., PDF, DOCX, XLSX, MSG)?

Answer: See the answer to question #87.

101. App. A §B (SR-04) p.9 Can a search be scoped to specific custodians or departments?

Answer: See the answer to question #87.

102. App. A §B (SR-05) p.9 Can saved search templates be shared across users with different roles?

Answer: See the answer to question #87.

Addendum No. 1 Page 17 of 22

Question # Solicitation Section Solicitation Page # Question / Answer

103. App. A §B (SR-06) p.9 Are query logs immutable and exportable for audit purposes?

Answer: See the answer to question #87.

104. App. A §C (CM-01) p.9 Does the audit log support WORM or immutable storage?

Answer: See the answer to question #87.

105. App. A §C (CM-02) p.10 Can multiple custodians be assigned to a single case?

Answer: See the answer to question #87.

106. App. A §C (CM-03) p.10 Do exports include load files and configurable metadata fields?

Answer: See the answer to question #87.

107. App. A §C (CM-04) p.10 Can legal holds be placed at both the item level and mailbox level?

Answer: See the answer to question #87.

108. App. A §C (CM-05) p.10 Can case status and SLA conformance reports be exported to CSV or PDF?

Answer: See the answer to question #87.

109. App. A §D (AF-01) p.10 Does deduplication support both hash-based and content-aware methods?

Answer: See the answer to question #87.

110. App. A §D (AF-02) p.10 Can redaction be applied to text within images (not just document text)?

Answer: See the answer to question #87.

111. App. A §D (AF-03) p.11 What PII types are auto detected (e.g., SSN, DOB, addresses, phone numbers)?

Answer: See the answer to question #87.

112. App. A §D (AF-04) p.11 If a bulk redaction job fails, does the system support error recovery and retry?

Answer: See the answer to question #87.

113. App. A §E (IN-01) p.11 Can the solution be deployed using Azure private endpoints? What are the supported deployment models for this solution — SaaS (vendor-hosted), private cloud, on-premises, or hybrid — and does the agency have a preference?

Answer: See the answer to question #87.

114. App. A §E (IN-02) p.11 Does it integrate with SharePoint Online and preserve metadata and versioning?

Answer: See the answer to question #87.

115. App. A §E (IN-03) p.11 Has the solution been validated at or beyond 6,000 Exchange Online mailboxes?

Addendum No. 1 Page 18 of 22

Question # Solicitation Section Solicitation Page # Question / Answer

Answer: See the answer to question #87.

116. App. A §E (IN-04) p.11 Does the solution provide REST APIs with webhooks and SDK support for external integrations?

Answer: See the answer to question #87.

117. App. A §F (RS-01) p.12 What is the SLA for query response time at P95 for standard queries?

Answer: See the answer to question #87.

118. App. A §F (RS-02) p.12 What are the RPO and RTO targets for disaster recovery?

Answer: See the answer to question #87.

119. App. A §G (CO-01) p.12 Does the system maintain audit trails for every public records disclosure?

Answer: See the answer to question #87.

120. App. A §G (CO-03) p.13 Is a HIPAA Business Associate Agreement (BAA) available?

Answer: A BAA is not available at this time.

121. App. A §G (CO-03) p.13 Does the proposed solution need to support ongoing ingestion of new records over the contract period, or is the scope limited to searching and managing an existing static dataset? If new data ingestion is expected, please describe the source systems, frequency, and anticipated volume.

Answer: Yes, the new records need to be included, and frequency for email and chat message is fast.

122. App. A §G (CO-03) p.13 Does the agency have any requirements or restrictions on the AI/LLM models used within the solution?

Answer: No. However, any AI/LLM models would require they meet Department’s security standards.

123. App. C p.17 What is the typical implementation timeline for a 6,000-mailbox deployment?

Answer: Implementation length is dependent upon Vendor’s proposed solution and should be detailed on Appendix C – Cost Information.

124. RFI §1.01 p.4 Have you previously deployed this solution for a Florida state agency or a similar government client?

Answer: DEP does not deploy solutions for other State agencies.

125. RFI §1.07 p.5 Is a no-cost product demonstration available at the Department’s request?

Answer: See the answer to question #9.

126. General - Is past performance from commercial clients acceptable, or is only public sector/government past performance considered?

Addendum No. 1 Page 19 of 22

Question # Solicitation Section Solicitation Page # Question / Answer

Answer: This is not being considered in this RFI.

127. RFI §1.01 p.4 Is the agency looking for a COTS (Commercial Off-The-Shelf) solution, or is a custom-built solution also being considered?

Answer: COTS.

128. App. C p.17 What pricing structure is preferred — Time & Materials (T&M), Fixed Price, Cost-Reimbursable, or Hybrid?

Answer: The Department is considering Fixed Price;

however, all structures are being considered at this time.

129. App. C p.17 How should configuration or implementation pricing effort be calculated and presented in a response?

Answer: See the attached Addendum No. 1 – Revised RFI 2026017, Section 1.05 for information on how to submit a response.

130. General - How many past performance references will be required in any subsequent solicitation?

Answer: See the answer to question #126.

131. General - Will subcontractor past performance be accepted toward a vendor’s qualifications?

Answer: See the answer to question #126.

132. App. C p. 17 Is there a defined budget or budget range for this engagement?

Answer: That information is not available at this time.

133. App. A §G p.12 Are there compliance standards beyond those listed in the RFI (e.g., SOC 2 Type II) required for integration with the Department’s IT infrastructure?

Answer: No, all compliance standards are outlined in the

RFI.

134. RFI §1.05 p.4 Is vendor registration with the Florida Department of State (Division of Corporations) required at the time of RFP submission?

Answer: See the attached Addendum No. 1 – Revised RFI 2026017, Section 1.01, Purpose and Scope of the RFI. This is a Request for Information (RFI), not an RFP. Registration is not required to submit a response to this RFI.

135. RFI §1.05 p.4 If not required at submission, must vendor registration be completed prior to contract award or contract execution?

Answer: Yes, registration must be completed prior to any contract award.

Addendum No. 1 Page 20 of 22

Question # Solicitation Section Solicitation Page # Question / Answer

As stated on page 1 of the Addendum No. 1 – Revised RFI 2026017, “…under Section 287.012(22), F.S., responses to this request are not offers and will not be accepted by the Department to form a binding contract.”

136. App. C p.17 What is the agency’s expected timeline for solution delivery and go-live?

Answer: That information is unknown at this time.

137. RFI §1.01 p p.4 Is onsite presence required? If so, how often and at which location?

Answer: No.

138. RFI §1.01 p.4 What is the primary location where services must be performed?

Answer: See the answer to question #137.

139. App. A §F (RS-03) p.12 What are the Sev-1 and Sev-2 support acknowledgment and resolution timeframes, and do they apply during pilot phase or full production only?

Answer: Timeframes for SEV1 and SEV2 for production are not known at this time.

140. App. A §G (CO-05) p.13 Is a Data Processing Agreement (DPA) available, and does the solution support data subject access requests?

Answer: No.

141. App. A §I / App. C p.14 Should implementation costs in Appendix C be broken out by deployment phase (pilot, controlled rollout, enterprise)?

Answer: Vendors shall submit pricing in a manner that best provides a clear, defined picture of their proposed solution’s price structure.

142. RFI §1.07 p.5 If demonstrations are requested per Section 1.07, what format and duration does DEP anticipate?

Answer: See the answer to question #9.

143. RFI §1.06 p.5 What is the process for asserting a confidentiality exemption for proprietary pricing or technical content submitted in Appendix C?

Answer: See the attached Addendum No. 1 – Revised RFI 2026017, Section 1.06 Public Records.

144. RFI §1.05 p.4 Is a cooperative purchasing agreement required to submit a response to this RFI, or is this item informational only for future procurement planning purposes?

Answer: This RFI is seeking information to plan for a possible future procurement.

145. RFI §1.05 p.4 Will a GSA Multiple Award Schedule (MAS) contract be accepted as a qualifying cooperative purchasing vehicle?

Addendum No. 1 Page 21 of 22

Question # Solicitation Section Solicitation Page # Question / Answer

Answer: DEP will determine the best procurement path at a later date, if a procurement results from this RFI.

146. App. C p.17 Does the agency expect pricing to be based on number of users, mailboxes, cases, or storage volume?

Answer: See the attached Addendum No. 1 – Revised RFI 2026017, row 2 of Appendix C – Cost Information. Vendors should select a unit of measure best appropriate for their proposed solution.

147. App. C p.17 Should the response include estimated annual maintenance and upgrade costs for Year 2 and beyond?

Answer: No.

148. App. C p.17 Will the agency separately procure any required third-party licenses (e.g., Azure services), or should the vendor include these costs in the response?

Answer: Any and all resources needed for solution should in the cost.

149. App. C p.17 Should PII detection and advanced analytics costs be included in the base price or quoted separately as add-ons?

Answer: Yes.

150. App. C p.17 Is the agency expecting government or public sector pricing in the cost response?

Answer: Yes.

151. App. C p.17 Should the cost response include pricing for both standard and premium support tiers, or is one tier preferred?

Answer: Yes, provide a cost for both standard and premium tiers.

152. App. C p.17 Will this or any resulting solicitation require or give preference to certified small or minority-owned businesses?

If so, will NMSDC MBE or Virginia SWAM certifications be recognized?

Answer: Refer to 295.187 (4)(b), Florida Statutes.

153. SR-06 + CM-01 - Does the Department require formal immutable/WORM logging with a stated policy on how long the tamper-evident period must last for the audit history?

Answer: No.

154. CO-01 - Does the Department expect the system itself to encode Florida-specific public-record exemptions/timelines, or is configurable review workflow acceptable?

Answer: No.

Addendum No. 1 Page 22 of 22

Question # Solicitation Section Solicitation Page # Question / Answer

155. CO-03 - Is formal CJIS attestation required from the platform provider, or is architectural alignment to CJIS-relevant controls sufficient?

Answer: No.

156. CO-05 - Are fully ready data subject access request workflows in scope for this procurement or is the focus more about the privacy posture / DPA / BAA readiness as the main objective?

Answer: No.

157. - - Is it the expectation of the Department that all of the requirements will be managed in one platform/solution?

Answer: No.

158. - - In the event that the Department finds it difficult to discover a single system that meets all of the Must Haves, Should Haves, etc. will the Department consider investing in a Case Management solution that orchestrates the workflow between existing or new or future search and record systems?

Answer: An answer cannot be provided at this time.

159. - - With regard to Response formatting, does the Department have any guidelines for a properly formatted submission? Is the Department looking ONLY for a response that lists a vendor's Compliance and Notes within the table structure given for Requirements? Or can the Vendor submit additional detail/verbiage?

Answer: See the instructions on the attached Addendum No. 1 – Revised RFI 2026017, Appendix A – Requirements.

160. - - Just to confirm, does DEP want vendors to include Appendix A as well? Section 1.05 Submittal Instructions lists only Appendices B and C.

Answer: Yes, vendors must submit a completed Appendix A in their response package. See the attached Addendum No.

1 – Revised RFI 2026017.

In accordance with Section 1.04 – Addenda to the RFI, the Department hereby formally amends the RFI. The amendments are indicated in blue with strikethrough for deletions and underlines for additions.

The following documents have been revised and attached separately within the Vendor Information Portal:

• Addendum No. 1 – Revised RFI 2026017