Addendum 1.pdf

Department of Procurement & Material Management

12000 Government Center Parkway, Suite 427

Fairfax, VA 22035-0013

Website: www.fairfaxcounty.gov/procurement

Phone 703-324-3201, TTY: 711, Fax: 703-324-3228

DATE: August 31, 2026

ADDENDUM NO. 1

TO: ALL PROSPECTIVE OFFERORS

REFERENCE: RFP 2000004365

TITLE: Consulting Services

DUE DATE/TIME: September 18, 2026 @ 3:00 P.M. EDT (REVISED)

The referenced request for proposal is amended as follows:

1. The due date/time has changed to September 18, 2026, at 3:00 p.m. eastern time.

2. Refer to Attachment A for responses to questions received via the Bonfire portal and email.

3. Refer to Attachment B for the Fairfax County Project Proposal Matrix for Meeting Information Technology Security Policy Requirements.

4. Add the following “Attachment A8: References” in the above referenced RFP, Special Provisions, Section 5, Statement of Qualifications, Paragraph 5.6

5. Delete the paragraph “Professional Liability Insurance in the amount of $1,000,000 per claim to cover each individual professional staff” in the above referenced RFP, Special Provisions, Section 15, Insurance, Paragraph 15.2.5., and replace with “Professional Liability Insurance: $1,000,000 per claim. Coverage shall extend to all professional personnel performing services under the contract.”

6. Delete the statement “defined contribution pension plans” in the above referenced RFP, Appendix D, page 1, and replace with “defined benefit plans”.

7. Delete the second sequence of “a through c” in the above referenced RFP, Appendix D, Phase Two, Item 1 (page 4) and replace with “d through f”. Only the lettering sequence is corrected, the content remains unchanged.

8. Delete the statement “Attachment A” in the above referenced RFP, Appendix D, Phase Two, Item 1(a) (page 4) and replace with “Appendix B”.

9. Delete the statement “[MP1.1]” in the above referenced RFP, Special Provisions, Section 15, Insurance, Paragraph 15.2.4.

A D D E N D U M

C o u n t y o f F a i r f a x , V i r g i n i a http://www.fairfaxcounty.gov/procurement

Department of Procurement & Material Management

12000 Government Center Parkway, Suite 427

Fairfax, VA 22035-0013

Website: www.fairfaxcounty.gov/procurement

Phone 703-324-3201, TTY: 711, Fax: 703-324-3228

All other terms and conditions remain the same.

Sehresh Tanweer, CPPB, VCA Contract Specialist II

THIS ADDENDUM IS ACKNOWLEDGED AND IS CONSIDERED A PART OF THE SUBJECT

REQUEST FOR PROPOSAL:

Name of Firm

(Signature) (Date)

A SIGNED COPY OF THIS ADDENDUM SHOULD BE INCLUDED IN THE PROPOSAL PACKAGE

OR RETURNED PRIOR TO DUE DATE/TIME. FAILURE TO DO SO MAY RESULT IN THE

REJECTION OF THE PROPOSAL.

NOTE: SIGNATURE ON THIS ADDENDUM DOES NOT SUBSTITUTE FOR YOUR SIGNATURE ON

THE ORIGINAL PROPOSAL DOCUMENT. THE ORIGINAL PROPOSAL DOCUMENT MUST BE

SIGNED.

http://www.fairfaxcounty.gov/procurement

Addendum #1

RFP 2000004365

Attachment A

Addendum 1 – Questions and Answers

Q1) Newly established businesses: Is there any minimum number of years that an offeror must have been in business to be eligible for this procurement?

A1) There is no required minimum number of years in business.

Q2) Financial statements: The RFP requests the offeror's most recent income statement and balance sheet. For a newly established company with limited or no operating history/revenue, will current financial statements reflecting that status satisfy this requirement, or is additional evidence of financial capability required?

A2) The most recent or current income statement and balance sheet are required.

Q3) References: Attachment A8 requests three references. If the offeror is a newly established company without three corporate past-performance references, may the offeror provide references associated with the directly relevant prior work of its proposed key personnel and/or subcontractors? If not, would the absence of three corporate references make the proposal nonresponsive?

A3) Yes. References from key personnel or subcontractors performing relevant work may be submitted.

Q4) Key personnel experience: For purposes of evaluating Experience & Qualifications, will Fairfax County consider directly relevant experience performed by proposed key personnel and subcontractors before joining the offeror, in addition to the offeror's own corporate experience?

A4) Yes. Key personnel and subcontractor experience will be evaluated in addition to the offeror's own corporate experience.

Q5) Subcontractors/independent consultants: May key personnel proposed for this engagement be independent consultants/subcontractors rather than employees of the prime contractor, provided they are identified in the proposal and meet all applicable requirements?

A5) Yes. Independent consultants/subcontractors may be proposed if identified and qualified.

Q6) Location of personnel: Are proposed key personnel/subcontractors required to be U.S.

residents or U.S. citizens? Are personnel located outside the United States permitted to perform any portion of the work, particularly work that does not involve access to FCRS systems or confidential member data?

A6) Key personnel/subcontractors do not need to be U.S. citizens. However, individuals performing work under the resulting contract must be legally authorized to work in the United States and must comply with all applicable federal, state, and local laws and regulations regarding employment eligibility and work authorization. The key personnel/subcontractors must be based in the United States.

Attachment A

Addendum 1 – Questions and Answers

Q7) PAS independence requirement: For proposed subcontractors currently employed by consulting firms, would their employer's relationship with a PAS software vendor create a conflict under the RFP's independence requirements even if the individual consultant is not personally involved with that vendor?

A7) Yes. Independence applies to the firm and affiliates; subcontractor employers may pose conflicts.

Q8) Section 5.4 mentions experience and references in the specific area of PAS. However, since this is an RFP for consulting services, can the vendor provide a reference for similar work done in consulting services to develop business and technical requirements?

A8) References must reflect experience in public sector pension systems, enterprise system or ERP replacements, and public retirement administration.

Q9) Special Provisions §5.4 – Statement of Qualifications / References: Please clarify how the County will evaluate the relevance of public-sector pension experience. Will experience assessing, auditing, modernizing, or advising public retirement programs and supporting enterprise technology transformation be considered responsive, or does the County require references demonstrating direct Pension Administration System requirements development, procurement, or implementation experience?

A9) Reference RFP, Paragraph 14.6 for Proposal Evaluation Criteria. Paragraph 5.4 requests references that are directly relevant to the scope of the RFP.

Q10) Appendix D – Phase Two: Operational Needs Assessment: Can FCRS clarify the expected level of detail for documenting current-state business processes during Phase Two, including whether the County expects process inventories, detailed process maps, standard operating procedure-level documentation, or another defined level of detail?

A10) Offerors may propose the level of detail they deem appropriate for what is referenced in Appendix D – Outline of Requirements (Phase Two: Operational Needs Assessment).

Q11) Appendix D – Phase Two: Operational Needs Assessment: Can FCRS provide an inventory of the current PAS interfaces, side systems, external systems, data exchanges, reports, batch processes, and third-party integrations that are expected to be assessed as part of this engagement?

A11) No. The awarded Contractor will assess and perform a comprehensive review of the current business operations for FCRS.

Q12) Appendix D – Phase Two: Operational Needs Assessment: Approximately how many distinct business processes, workflows, forms, reports, correspondence templates, interfaces, and business rules does FCRS anticipate will need to be assessed and/or documented?

A12) The awarded Contractor will be responsible for conducting a comprehensive assessment to determine the full scope of operational components that require evaluation and documentation.

Q13) Appendix D – Phase Two: Operational Needs Assessment: What level of participation and availability should the Contractor assume from FCRS subject-matter experts during discovery activities, requirements workshops, deliverable reviews, and validation sessions?

Attachment A

Addendum 1 – Questions and Answers

A13) FCRS subject-matter experts will be available to support Contractors as needed throughout the project lifecycle. FCRS will prioritize availability based on the selected Contractors project plan. The FCRS Project Manager will support Contractors with stakeholder coordination, as needed.

Q14) Appendix B / Appendix D – Retirement Systems and Operational Needs Assessment:

Should the Contractor assume that the Employees’, Police Officers’, and Uniformed Retirement Systems will require separate discovery and requirements-validation sessions, or may common processes and requirements be evaluated jointly where appropriate?

A14) While there are slight variations in benefits and requirements across the three retirement systems, we do not anticipate the need for separate discovery and requirements validation sessions for each retirement system and common processes and requirements may be evaluated jointly where appropriate.

Q15) Appendix D – Phase Three: RFP Development Services: Can FCRS clarify whether the Contractor will be expected to develop the complete procurement package for the replacement PAS—including evaluation methodology, scoring criteria, pricing schedules, vendor response templates, and supporting exhibits—or primarily the functional, business, and technical requirements and draft RFP?

A15) Contractor is expected to develop a comprehensive technical and operational requirements for the procurement of a replacement PAS. The RFP (including evaluation methodology, scoring criteria, pricing schedules, vendor response templates, and supporting exhibits) will be drafted by the County.

Q16) Appendix D – Phase Four: Procurement Services: What level of Contractor participation should be assumed during the PAS procurement, including vendor demonstrations, oral presentations, reference checks, clarification questions, negotiations, best-and-final offers, and contract negotiations?

A16) Contractor will support evaluation; County leads discussions and negotiations.

Q17) Appendix D – Phase Four: Procurement Services: Does FCRS have an anticipated number of PAS vendors that may advance to demonstrations, interviews, oral presentations, or final evaluation?

A17) There is no predetermined number of vendors.

Q18) Appendix D – Phase Two: Operational Needs Assessment: Is the Contractor expected to conduct hands-on data profiling or an independent data-quality assessment of the current PAS data, or is the scope limited to assessing data-related needs and developing recommendations and requirements for future data remediation, conversion, and migration?

A18) FCRS completed a data quality assessment within the last two years and does not expect a need for extraneous efforts within this area.

Attachment A

Addendum 1 – Questions and Answers

Q19) Appendix A / Appendix D – Technical Environment and Operational Needs Assessment:

Will FCRS provide the selected Contractor with appropriate access to the current PAS, databases, reporting environment, technical documentation, existing business rules, system documentation, and relevant vendor documentation necessary to perform the assessment?

A19) Yes, the Contractor will have access to the current PAS, databases, reporting environment, technical documentation, existing business rules, system documentation, and relevant vendor documentation necessary to perform the assessment.

Q20) Appendix D – Technical Requirements: Does Fairfax County have established enterprise architecture, cloud, cybersecurity, identity and access management, data, integration/API, records-management, or accessibility standards that the Contractor should incorporate into the future-state PAS requirements?

A20) Yes, Fairfax County Department of Information Technology has a technology security matrix that is a required form for every software or software as a service RFP. FCRS will also have several requirements for integration and record management that will be discussed as part of the project management consultancy. Fairfax County Project Proposal Matrix for Meeting Information Technology Security Policy Requirements is provided for reference as Attachment B.

Q21) Appendix D – Technical Requirements: Are there County-mandated or preferred hosting or cloud environments that should be considered when evaluating and developing requirements for the future PAS?

A21) Yes, Fairfax County Department of Information Technology has a technology security matrix that is a required form for every software or software as a service

RFP.

Q22) Appendix D – Technical Requirements: Should the future-state assessment evaluate multiple deployment models, including SaaS and other cloud-hosted alternatives, or has FCRS established a cloud-based/SaaS solution as the required target state?

A22) FCRS has established a cloud-based/SaaS solution as the required target state.

Q23) Appendix D – Operational Needs Assessment: Are there known data-quality, conversion, reconciliation, historical-data-retention, document-management, or imaging challenges that FCRS expects the Contractor to prioritize during the assessment?

A23) No.

Q24) Appendix D – Technical Requirements: Can FCRS identify the financial, HR/payroll, document management, identity management, and other County enterprise systems that currently interface with the PAS or are anticipated to interface with the replacement

PAS?

A24) SAP (known internally as FOCUS) is the interface for payroll/HR. Laserfiche is the interface for document retention. SAP/FOCUS will need to interface with the replacement and FCRS is open to alternatives for document retention.

Attachment A

Addendum 1 – Questions and Answers

Q25) Appendix D – Operational and Technical Requirements: Does FCRS expect the engagement to include organizational change management, stakeholder communications, workforce readiness, and training strategy associated with the future-state operating model, or should the Contractor limit this work to development of requirements for the future PAS?

A25) Yes. Should the Contractor continue to support the project through Phase Five, FCRS expects the Contractor to work with the PAS Vendor team to support the Agency with organizational change management, stakeholder communications, workforce readiness, and training strategy associated with the future-state operating model.

Q26) Appendix D / Attachment C – Phase Five: Does FCRS have an anticipated duration or planning assumption that Offerors should use when developing the optional Phase Five Not-to-Exceed price?

A26) FCRS anticipates Phase Five will require at least two years to complete. This timeframe is provided for pricing and planning purposes only and is not intended to establish a guaranteed implementation schedule. The actual duration will depend on the selected solution, implementation approach and strategies, and other factors identified during the project. For purposes of developing Phase Five, Offerors should identify the duration and assumptions upon which proposed pricing is based, including any assumptions regarding staffing, level of effort, and implementation activities.

Q27) Appendix D / Attachment C – Phase Five: For optional Phase Five, should Offerors assume that the required full-time Contractor Project Manager must be dedicated exclusively to the FCRS implementation, and does FCRS anticipate a minimum team composition or level of effort for additional roles such as Quality Assurance Lead, Technical Architect, and Business Analyst?

A27) No, the full-time Contractor Project Manager does not have to be dedicated exclusively to the FCRS implementation as long as they are able to fulfill the duties and expectations outlined in Appendix D, Phase Five of. FCRS does not have a specific minimum team composition or level of effort for additional roles.

Offerors should propose staffing resources, roles, and level of effort they determine necessary to successfully perform Phase Five based on their proposed implementation approach, method, and experience.

Q28) Special Provisions §1.2 / Appendix D – Phase Five: Please confirm that the independence and conflict-of-interest requirements applicable to the Contractor during development and procurement of the replacement PAS will continue throughout Phase Five implementation oversight.

A28) Yes, independence requirements extend through Phase Five.

Q29) Appendix D states that FCRS administers three defined benefit plans but also states that the future PAS should support defined contribution pension plans. Please confirm whether defined contribution plan administration is within the scope of the requirements-development effort.

A29) No, “defined contribution pension plans” are not part of the scope. Strike “defined contribution pension plans” in Appendix D and replace with “defined benefit plans”.

Attachment A

Addendum 1 – Questions and Answers

Q30) Appendix D, Phase Two, Item 1 contains subparagraphs labeled “a” through “c,” followed by another sequence labeled “a” through “c,” and later refers to Items “a through f.” Please confirm the intended lettering and whether all six listed areas are required elements of the operational review.

A30) Yes, all six operational review areas are required. The intended lettering was “a through f”. Strike second sequence of “a through c” in Appendix D, Phase Two, Item 1 and replace with “d through f”. Only the lettering is corrected, the content remains unchanged.

Q31) Appendix D, Phase Two, Item 1(a) references “Attachment A: FCRS Programs and Services Administered.” That document appears to be Appendix B. Please confirm the intended reference.

A31) Yes, the intended reference is Appendix B. Strike “Attachment A” in Appendix D, Phase Two, Item 1(a) and replace with “Appendix B”.

Q32) Please confirm that the Phase Two, Three, and Four deadlines—six months, ten months, and twelve months after award, respectively—are cumulative milestones and that work across phases may overlap.

A32) Yes, milestones are cumulative and may overlap.

Q33) Phase Four includes proposal analysis, PAS vendor evaluation, a high-level implementation plan, and estimates of implementation schedule, staffing, and budget.

Please clarify whether all Phase Four activities must be completed within twelve months of the consulting contract award, including activities dependent upon issuance and completion of the subsequent PAS procurement.

A33) Phase Four should be completed within twelve months; scheduling may adjust.

Q34) Please identify the anticipated County review and approval periods for major deliverables, including the operational assessment, requirements documents, information technology plan, and PAS RFP. Should offerors include proposed review periods in their schedules?

A34) The majority of project deliverables (including the operational assessment, requirements documents, and information technology plan) will be reviewed and approved at the Agency level and offerors should include proposed review periods in their schedules.

Q35) Appendix D requires an onsite kickoff and quarterly onsite project updates and states that onsite meetings shall not exceed four mandatory visits during the period of performance. Please confirm whether the kickoff is included within the four mandatory visits.

A35) The Kickoff meeting is not included as part of the four quarterly project status updates per year.

Q36) Does the four-visit limitation apply only to mandatory project-status meetings, or does it also apply to operational-assessment interviews, workshops, validation sessions, and other activities that the County may request to be performed onsite?

A36) There are four mandatory onsite visits for quarterly project status updates. There are no limitations for onsite visits to execute project tasks and activities.

Attachment A

Addendum 1 – Questions and Answers

Q37) Appendix D states that sensitive FCRS information may not be removed from FCRS premises or stored electronically outside the FCRS network. Will authorized contractor personnel be provided secure remote access to a County-managed environment, or should offerors assume that access to sensitive information must occur onsite?

A37) Yes, Contractors will be provided with secure remote access to the County network to access sensitive information following contract award.

Q38) Will FCRS provide available current-state documentation—including process documentation, business rules, interface inventories, report inventories, data dictionaries, system documentation, and lists of workarounds and side systems— following contract award?

A38) FCRS will provide all available current state documentation following contract award.

Q39) Appendix A identifies HR Focus as an example of an external system. Can the County provide the approximate number of current PAS interfaces, side systems, and third-party systems expected to be included in the assessment? A detailed technical description is not requested at this stage.

A39) Please refer to Answer 11.

Q40) Please clarify whether the three required references, collectively, may demonstrate experience in public-sector pension systems, enterprise or ERP replacements, and public retirement administration, or whether each reference must demonstrate all three areas.

A40) Collectively, references may cover all areas.

Q41) The RFP states that personnel named in the proposal must remain assigned throughout the contract. Please confirm whether offerors may propose different personnel and levels of effort for different phases, provided the phase assignments are identified in the staffing plan and approved personnel remain available for their proposed assignments.

A41) Yes. Different personnel may be assigned if approved by the County.

Q42) Please confirm whether Attachment C should include separate firm-fixed prices for each of Phases One through Four and a separate price for optional Phase Five.

A42) Yes. Separate pricing required for Phase One–Four and Phase Five.

Q43) Because the period and scope of Phase Five will depend upon the selected PAS vendor’s implementation schedule, please clarify the pricing basis expected for optional Phase Five—for example, firm-fixed price, labor rates with estimated hours, or another pricing structure.

A43) Phase Five pricing may use labor rates and estimated hours.

Q44) The DPMM cover sheet references certifications in Attachments A1 through A8, while RFP §5.6 lists Attachments A1 through A7. Please confirm whether an Attachment A8 is required and, if so, provide the form.

A44) Yes. Attachment A8 is included in Attachment A, which includes attachments A1 through A8, and all pages of Attachment A are required to be submitted.

Paragraph 5.6 is hereby amended to add the following:

• Attachment A8: References

Attachment A

Addendum 1 – Questions and Answers

Q45) RFP §15.2 requires professional liability insurance of $1 million per claim “to cover each individual professional staff.” Please confirm whether a firm-level professional liability policy with a $1 million per-claim limit satisfies this requirement.

A45) Reference item #4 in the body of Addendum #1.

Q46) RFP §15.2.4 contains the text “[MP1.1]” within the cyber-insurance requirement. Please confirm that this is an editorial notation and that the required limit is $1 million per claim and annual aggregate

A46) Yes, the required limit is $1 million per claim and annual aggregate. Strike “[MP1.1]” from page 9 of the Special Provisions, Section 15, Insurance, Paragraph 15.2.4.

Q47) Will FCRS remove the requirement that references specifically demonstrate public-sector pension/public retirement experience and allow comparable public-sector benefits, enterprise systems, business process improvement, requirements, procurement, and implementation experience?

A47) No. The RFP requires references demonstrating experience in public-sector pension systems, enterprise system/ERP replacements, and public retirement administration.

Q48) If retirement experience remains required, will compliance, operational assessment, business process, technology, controls, and system implementation experience for public retirement organizations qualify without prior PAS procurement experience?

A48) No. The RFP requires references demonstrating experience in public-sector pension systems, enterprise system/ERP replacements, and public retirement administration.

Q49) May the three required references collectively demonstrate public pension systems, enterprise/ERP replacement, and public retirement administration experience, rather than each reference demonstrating all three?

A49) Yes. Collectively, references may cover all areas.

Q50) Is prior end-to-end PAS procurement experience required, or will combined retirement, enterprise technology, requirements development, procurement, and implementation experience qualify?

A50) The RFP requires experience in public-sector pension systems, ERP replacements, and public retirement administration. It does not require prior PAS procurement experience.

Q51) Will public-sector ERP/enterprise system replacement experience outside of pension administration qualify when combined with demonstrated public retirement experience?

A51) Yes.

Q52) Approximately how many current business processes are in scope for assessment; what existing process maps, procedures, policies, work instructions, and related documentation are available; and is any third-party vendor or consultant currently providing business process assessment, documentation, improvement, or reengineering

Attachment A

Addendum 1 – Questions and Answers services to FCRS? If so, will relevant work products be available to the selected Contractor?

A52) The awarded Contractor will assess and perform a comprehensive review of the current business operations for FCRS. No, FCRS does not have a third-party vendor/consultant providing the services mentioned above. Current PAS documentation is limited and may be outdated but will be available to the selected Contractor.

Q53) Does Phase Two require detailed documentation and assessment of every in-scope business process, or should detailed analysis focus on PAS-dependent processes, gaps, workarounds, inefficiencies, risks, and improvement opportunities?

A53) Phase Two requires detailed documentation and assessment of every in-scope business process to identify process/operational inefficiencies that can be resolved or improved with a new PAS.

Q54) Does FCRS expect detailed future-state process designs, or identification and recommendations for business process reengineering opportunities?

A54) Offerors may propose the level of detail and deliverable format they deem appropriate for what is referenced in Appendix D – Outline of Requirements.

Q55) What level of detail does FCRS expect for the comprehensive business and technical Requirements Document?

A55) Offerors may propose the level of detail they deem appropriate for what is referenced in Appendix D – Outline of Requirements.

Q56) Does FCRS expect a traceability matrix linking current-state needs and gaps to requirements, RFP requirements, vendor responses, and implementation/testing?

A56) Offerors may propose the level of detail and deliverable format they deem appropriate for what is referenced in Appendix D – Outline of Requirements.

Q57) What current PAS documentation will FCRS provide, including architecture, data models/dictionaries, business rules, interfaces, reports, configurations/customizations, and user documentation?

A57) Current PAS documentation is limited and may be outdated, FCRS staff and other stakeholders will provide insights into current PAS architecture and functionality.

Q58) Approximately how many side systems, County systems, third-party systems, interfaces, and integrations are in scope for assessment and requirements development? Can the FCRS provide the list of systems?

A58) Please refer to Answer 11.

Q59) Does FCRS maintain an inventory of spreadsheets, databases, manual processes, or other workarounds used because of current PAS limitations, and will this information be available to the selected Contractor?

A59) Spreadsheets, databases, manual processes, or other workarounds used because of current PAS limitations are minimal. Available information/documentation will be provided to the selected Contractor.

Attachment A

Addendum 1 – Questions and Answers

Q60) Does FCRS expect detailed data profiling and data-quality analysis or primarily a high-level data remediation, conversion, and migration strategy?

A60) FCRS completed a data quality assessment within the last couple of years and anticipates primarily high-level data remediation, conversion, and migration strategy.

Q61) Does the IT plan require a vendor-neutral target architecture covering cloud, integrations/APIs, security, identity/access, reporting/analytics, document management, and disaster recovery?

A61) Yes.

Q62) What level of detail and accuracy does FCRS expect for estimates of software, implementation, maintenance, infrastructure, staffing, and project management/oversight costs?

A62) As detailed and accurate as possible.

Q63) Does Phase Four include development of evaluation tools, evaluator training, proposal scoring, vendor demonstrations, reference checks, total-cost-of-ownership analysis, consensus sessions, and negotiation support?

A63) No.

Q64) What level of detail is expected for the Phase Four implementation plan, staffing estimate, budget, and implementation timeframe?

A64) High-level.

Q65) Other than the kickoff and quarterly meetings identified in Appendix D, which discovery, process, requirements, procurement, or other project activities does FCRS expect to be performed on-site?

A65) FCRS does not have any expectations to perform project tasks or activities onsite, outside of the kickoff and quarterly meetings. However, FCRS will have space available for Contractors to carry out project tasks or activities onsite, if/when needed.

Q66) Approximately how many FCRS and County functional and technical stakeholders should Offerors assume will participate in interviews, workshops, requirements validation, and deliverable reviews?

A66) Stakeholder groups expected to participate in interviews, workshops, requirements validation, and deliverable reviews:

- FCRS Staff: Executive team, Board Support and Training team, Membership Services team, Retiree Services team, and Technology team.

- Active County employees and retirees.

- Department of Information Technology (DIT).

- Department of Procurement and Materials Management (DPMM).

Q67) Are Phases Two through Four expected to overlap, and what FCRS review and approval periods should Offerors incorporate into their project schedules?

Attachment A

Addendum 1 – Questions and Answers

A67) Yes Phase Two – Four activities can overlap. The majority of project deliverables (including the operational assessment, requirements documents, and information technology plan) will be reviewed and approved at the Agency level and offerors should include proposed review periods in their schedules.

Q68) Should Offerors provide an approach, staffing model, and/or pricing for optional Phase Five with this proposal, or will those items be developed only if FCRS elects to exercise the option?

A68) Yes, Offerors should provide their approach, staffing model, and/or pricing for Phase Five in this proposal.

Q69) Given that responses to these questions may materially affect scope, staffing, schedule, and firm-fixed pricing, will FCRS extend the proposal submission deadline to at least fourteen (14) calendar days after publication of responses to questions and any related addendum?

A69) Reference item #1 in the body of Addendum #1.

Q70) The Exhibit B, Cost Quote for Software form says to "upload cost and bidder quote on company letterhead" to the Public Purchase portal. Could the County clarify what should be on company letterhead? Is it the Exhibit B form? Or the "BidResponse RFQ DPARC- 685.xls" file? Or something else?

A70) There is no requirement to submit any cost information or forms on company letterhead.

Q71) Section 5.4 requires relevant experience and a minimum of three project references.

May relevant pension application implementation and support experience performed by proposed key personnel more than three years ago be used to demonstrate pension experience? If so, must that pension engagement be one of the three customer references, or may the three references be from more recent comparable enterprise system projects?

A71) Yes, past experience of key personnel may be referenced for the requirement listed in Special Provisions, Paragraph 5.4.2.

Q72) Please confirm whether any page limit applies to the technical proposal, including resumes and required attachments.

A72) No, there are no page limits for any of the required submissions.

Q73) Will electronic signatures be accepted on the required Fairfax County forms submitted through Bonfire?

A73) Yes. Please refer to Special Provisions, Paragraph 32.

Q74) We would like to request an extension of the DUE date for this RFP so that vendors can address any Q&A appropriately and provide a strong response to your requirements.

Can Fairfax County extend this by 1-2 weeks?

A74) Reference item #1 in the body of Addendum #1.

Attachment A

Addendum 1 – Questions and Answers

Q75) Attachment A8 requests information on references. References are also requested as Section 2 of the Statement of Qualifications. Can the County please clarify if this information needs to be provided in both places?

A75) References should be provided in Attachment A8.

Fairfax County Project Proposal Matrix for Meeting Information Technology Security Policy Requirements

June 2020

Attachment B

Introduction The Fairfax County Project Proposal Matrix for Meeting Information Technology Security Policy Requirements is required as an attachment for information technology responses to Request for Proposal (RFP) processes initiated by Fairfax County. It is intended to assist Fairfax County with soliciting vendor responses that identify the requirements of the Fairfax County Information Technology Security Policy. The clear identification of each element is required by Fairfax County in order to sustain and ensure a solid foundation for the development and implementation of secure information technology practices within Fairfax County Government.

Vendors with access to Fairfax County information resources are required to abide by all policies and procedures of Fairfax County Government.

The RFP Security Matrix has been divided into four main sections. A response is required depending on the proposed solution/service provided by the vendor.

Section A is to provide basic information regarding the proposed solution

Section B is relevant to Cloud/Hosted services, or hybrid Cloud services, in which solution will be located in non-County datacenters.

Section C is applicable to traditional on-premises solutions which will be located in Fairfax County datacenters under control by Fairfax County personnel.

Section D requires responses regardless if solution is a cloud/hosted solution or traditional on-premises solution. This section covers general functional security capabilities inherent to the solution.

How to Use the Security Template

Each section has multiple columns:

1. Standard This section includes the requirement that needs to be addressed. It can take the form of a question or a statement.

2. Compliance The responder shall provide a high level response to the Standard. The answers can be YES, NO, And N/A. The responder should check one of the three boxes to indicate their solution’s capability. Responders can provide a high level explanation of answers in the “Comments/Additional Information” section.

3. Comments/Additional Information In this section the responder should provide any additional information required to answer the question.

References:

The Fairfax County Information Technology Security Policy and the HIPAA Security Standards. This vendor RFP template was based upon similar work approved for public distribution by the North Carolina Healthcare Information and Communications Alliance, Inc. (NCHICA) in August 2003.

Addendum #1

RFP 2000004365

http://www.fairfaxcounty.gov/dit/iso/pm70-05_01.pdf

SECTION A: Please complete the following section for proposed CLOUD, HYBRID SERVICES, and ON-PREMISES SOLUTIONS

DESCRIPTION OF PROPOSED SOLUTION COMMENTS/ADDITIONAL INFORMATION

A.1 Requesting County Agency:

A.2 System Name/Title:

A.3 Vendor/Developer:

A.4 RFP Reference Number (if Applicable):

A.5 Is proposed application or service a cloud-based or on-premises solution?

Vendor-hosted On-Premises BOTH:

A.6 Please identify server application components supported to include software, middleware, authentication and user directory options, and third party supporting software or middleware.

Web application Database Active Directory Integration

3rd-party middleware Other Application Windows Server OS

Unix/Linux

Please provide additional information below:

A.7 Client application Internet Explorer Third-party Plugins

A.8

A.9

Please describe any client application components to include client software, and any third party supporting software or middleware for solution to function.

Please indicate which system development lifecycle and security standards your organization adheres to?

Please specify any database versions that support the application.

Oracle Microsoft SQL Server Other N/A

Please specify supported release versions and other additional information below:

A.10 Please specify any user access directory and external authentication requirements to support the application.

Local application user directory Active Directory Other LDAP N/A

SECTION B: Please complete the following for proposed CLOUD/HOSTED OR HYBRID SERVICES

STANDARDS COMPLIANCE COMMENTS/ADDITIONAL INFORMATION

B.1 Payment Card Industry Data Security Standard (PCI-DSS)

If applicable, is your organization and the proposed solution compliant with PCI-DSS? Provide evidence of industry certification of compliance.

Yes No

Provide additional information below:

B.2 Health Insurance Portability and Accountability Act (HIPAA)

If applicable, is your organization and the proposed solution compliant with HIPAA? Provide evidence of industry certification of compliance or other relevant documentation, if available.

B.3 Personally-Identifiable Information (PII)

If applicable, is your organization and the proposed solution compliant with requirements to secure PII? Provide evidence of compliance, if applicable.

B.4 Does the organization maintain a formal information security program that identifies management, operational, and technical controls to ensure the confidentiality, integrity, and availability of information systems and data and validates those controls?

Provide additional information below:

B.5 Does organization maintain an active vulnerability management program to protect systems from known vulnerabilities?

B.6 Does organization validate and test implemented security controls?

Please describe methods whether through internal or third-party audits, vulnerability assessments, penetration testing, etc.?

Provide additional information below:

Addendum #1

B.7 Does the organization’s solution use strong cryptography and security protocols (for example, SSL/TLS, IPSEC, etc.) to safeguard information data during transmission between networks?

B.8 Does the organization’s proposed solution maintain a defense-in-depth security architecture incorporating intrusion detection, firewalls, and other network security monitoring and access control mechanisms?

B.9 Does the organization provide adequate controls to protect against malicious code in hosted environment?

Please describe controls.

B.10 Does the organization protect data by implementing access control mechanisms to limit access to data to personnel whose job requires such access?

ALT

B.11 Does the proposed solution uniquely identify and authenticate all users?

B.12 Does the organization protect data by implementing an auditing and systems monitoring program to identify and alert of unauthorized access or transactions?

B.13 Does the organization restrict physical access to systems housing customer data and is the access audited?

B.14 Will County data be encrypted at rest in the proposed solution?

Yes No

Provide additional information below:

B.15 Has the organization implemented data retention and disposal policies, procedures and processes to limit data storage amount and retention time to that which is required for legal, regulatory, and business requirements?

Provide additional information below:

B.16 Does the organization maintain formal electronic data destruction procedures in the event of customer termination of contract?

B.17 Are the data centers in which County data would reside located only in United States or its territories? If no, please explain.

B.18 Are the organization’s hosted application or resources maintained in a multi-tenant environment or platform in which County data is co-mingled with other entities, or dedicated infrastructure for County-specific resources?

B.19 Does the organization maintain high availability of resources available to customers and document and define specific service availability level agreements?

B.20 Does the organization maintain an incident response plan including strategy for notifying customers in the event of a breach and compromise of customer information? Is this incident response plan regularly tested?

B.21 Does the organization maintain a formal Business Continuity/Disaster Recovery Plan? Does organization perform regular exercises to test the effectiveness of the plan?

Provide additional information below

B.22 Does the organization maintain disaster recovery procedures to assist in preventing interruption of system use?

B.23 Does the organization maintain cyber security risk insurance?

Yes No

Provide additional information below

B.24 Is the organization compliant with legal restrictions on the use of copyright material, ensuring that only software developed by the organization, or licensed or provided by the developer to the organization, is used?

B.25 Do all vendor employees and sub-contractors successfully complete a background investigation upon hire?

SECTION C: Please complete the following for proposed ON-PREMISES SYSTEMS

STANDARDS COMPLIANCE COMMENTS/ADDITIONAL INFORMATION

C.1 Payment Card Industry Data Security Standard (PCI-DSS)

If applicable, is the solution compliant with PCI-DSS? Please provide evidence of industry certification of compliance.

C.2 Health Insurance Portability and Accountability Act (HIPAA)

If applicable, is the solution compliant with HIPAA? Please provide evidence of industry certification of compliance.

C.3 Personally-Identifiable Information (PII)

If applicable, is the solution compliant with requirements to secure PII? Provide evidence of compliance, if applicable.

C.4 Does the organization maintain an active vulnerability management program to identify and remediate vulnerabilities in the system/application which is implicated throughout the product lifecycle?

C.5 Does the organization test and validate security controls implemented within the system/application? Please describe methods whether through internal or third-party audits, vulnerability assessments, penetration testing, etc.?

Provide additional information below:

C.6 Does the organization’s application/system use strong cryptography and security protocols (for example, SSL/TLS, IPSEC, etc.) to safeguard information data during transmission?

C.7 Does the proposed solution uniquely identify and authenticate all users (no anonymous access)?

C.8 Will County data be encrypted at rest in the proposed solution?

Yes No

Provide additional information below:

Addendum #1

C.9 Does the proposed system/application maintain built-in high-availability features?

C.10 Does organization’s proposed solution include disaster recovery features and recommended practices specific to the solution to allow for the continuation of operations in the event of a disaster?

Provide additional information below:

C.11 Is the organization compliant with legal restrictions on the use of copyright material, ensuring that only software developed by the organization, or licensed or provided by the developer to the organization is used for customer’s systems?

SECTION D: Vendors must complete the following section for both CLOUD and ON-PREMISES SOLUTIONS

GENERAL FUNCTIONAL SECURITY

COMPLIANCE COMMENTS/ADDITIONAL INFORMATION

Password Controls

D.1 Does the system enforce strong passwords to include minimum length and combination of alpha and numeric characters?

Current Minimum: ___ Current Maximum: ___

D.2 Can user passwords be automatically changed or account disabled after a period of inactivity has passed?

Current Change Interval: ___

D.3 Can system force users to change default passwords following the initial set up or resetting of the password?

D.4 Can the system prevent auto logon, application remembering, embedded scripts, and hard-coded passwords in software?

D.5 Does system maintain a history of previously used passwords to prevent reuse?

Current Value: ___

D.6 Does the system allow for users to change their own passwords at their discretion?

D.7 Does the system disable accounts after a specified number of consecutive invalid login attempts?

Current # Attempts: ___

D.8 Does system automatically activate a session termination or lock if user remains idle or inactive for a determined period of time?

Default Auto logoff Time:___

D.9 Are passwords entered in a non-display field to access application/system?

D.10 Are passwords encrypted in storage and transmission? Please identify strategy to secure passwords to include encryption algorithm, key size, and use of salted and password hashing.

Provide additional information below:

D.11 Does system supports multi-factor authentication?

APPLICATION TECHNICAL CONTROLS COMPLIANCE COMMENTS/PLANS FOR MEETING COMPLIANCE

Security Administration

D.12 Does system log unauthorized access attempts by date, time, User ID, device and location?

D.13 Does system maintain an audit trail of all security maintenance performed by date, time, User ID, device and location and information is easily accessible?

D.14 Does system provide security reports of users and access levels?

D.15 Does system maintain role-based group and user access control based on business functional requirements?

D.16 Does system provide the capability to place security controls on each system module and on confidential and critical levels within each module?

D.17 Does system provide capability to restrict access to particular records within the system, based on User ID and groups?

D.18 Is on-site training and sufficient supporting reference materials related to security administration available to provide to County if solution is selected?

D.19 Can system and security logs be archived and recalled as needed?

APPLICATION TECHNICAL CONTROLS COMPLIANCE COMMENTS/ADDITIONAL INFORMATION

Networking

D.20 Has the System configuration/architecture (i.e., hardware, wiring, display, network, and interface) been documented in proposal?

Provide additional information below:

D.21 Does your solution require data transmission between multiple solution provider networks? For example, data transmission requirements between Fairfax County networks and vendor-controlled networks, or vendor and sub-contractor networks?

Describe methodology and requirements

D.22 Is there a requirement for vendor to access system remotely from the internet?

Please describe remote access requirements and any built-in features.

D.23 For management and vendor support, can the system support secure remote access such as multi-factor authentication?

D.24 Is the system compatible with mainstream anti-virus and endpoint protection software?

Please specify compatible products:

D.25 For web application security, has the vendor implemented controls in the proposed solution to protect against SQL injection, cross-site scripting, and other common attacks?

I certify that the above responses are true and accurate.

NAME OF OFFEROR:

Typed Name and Title

Signature Date of Submission