ADDENDUM 1 OHA Operations Maintenance Data for S-DASOBO-00014873 _Final.pdf

Addendum No. 1

9/9/2025 Page 1 of 11

OREGONBUYS BID NUMBER: S-DASOBO-00014873

Operations, Maintenance, Data Migration and Enhancement Services

ADDENDUM 1

OCTOBER 8, 2025

SECTION 1: PURPOSE

The purpose of this addendum is to release the State’s responses to questions submitted by the Q&A deadline in the RFP, Revise Attachment H - Requirements and to extend the “Opening” Date (Proposal Due Date) in the RFP.

The addendum includes the following:

1. Attachment H – Requirements

1. Release of State's Responses to Question.

QUESTIONS AND ANSWERS

Question

RFP Part & Section

Reference

Question Agency Response

Who is the incumbent?

Public Sapient

2 What is the estimated budget range for this engagement?

The State does not have budget information to share at this time.

3 Will the agency provide access to legacy code and documentation?

We will be providing functional documents, Data dictionary, & technical documents in round 2 for vendors who are selected to move to round 2. At that point it can be expected that those vendors will need to sign an Non-Disclosure Agreement.

4 What is the expected volume of monthly tickets/incidents?

Variable and highly dependent on our resource allocation with our current vendor which will look different in our next contract, but our current average open & closed tickets for incident, bugs, and user story's only is 33 closed 25 opened over the last 6 months.

5 Section 3.3.14

Could the State please extend the proposal due date to two (2) weeks from the release of answers to vendor questions? As per the current schedule, if answers are released on 10/1, we request that the due date be modified to 10/15. If the answers are released beyond 10/1, we request the due date be modified accordingly to two weeks following that release date.

New Opening date of October 27th, 2025 at 12:00PM PT.

9/9/2025 Page 2 of 11

6 Can you please send the recording for the Pre-Proposal Conference:

September 19, 2025.

The meeting was not recorded.

7 Also where can we download the documents for this opportunity.

See following link:

https://oregonbuys.gov/bso/external/bidDetail.sdo?docId=S- DASOBO-00014873&external=true&parentUrl=close

8 I missed the pre-bid conference. Would you happen to have meeting minutes to share?

The Pre-Proposal Conference was not recorded. There are no meeting minutes to share.

9 Regarding Attachment D / Reference Check Form: Our most relevant reference is related to the current work we are doing for ODHS. Am I permitted to seek either Ron Seitz- Mcghee and/or Stefanie Johnson’s support in completing Attachment D in regards to our current work?

ODHS is looking for outside references other than ODHS.

10 2.4 SCOPE OF

WORK

Will the current vendor provide any transition support or documentation to the awarded proposer? If not, what level of system documentation is currently available?

Yes, transition support & documentation are required in our current contract.

11 3. Incident Management and System

Defect Resolution

Is there a defined risk-based prioritization model for incidents and defects (e.g., severity tiers, business impact scoring)?

While still negotiable and will likely be detailed further --expectations around SLA's are in exhibit B of the Sample Contract.

For any further details around requirements please refer to attachment H.

12 3.1.5 Preferred Technical Skills

Will the vendor be responsible for leading or supporting formal security audits (e.g., HIPAA, NIST SP 800-53)? If so, what is the expected cadence and scope?

The Vendor will be responsible for assessing risk and making recommendations to the state on system security as well as all other system security requirements listed in the RFP & attachment H requirements.

13 1. System Operations and

Maintenance

What tools or processes are currently used for privileged access tracking and reporting?

Azure Development Operation System (ADOS) also used for ticket tracking as listed in the RFP. S-Docs, DemandTools & other implemented software solutions referenced in attachment H are also used as tools within the system.

14 2.2.2 Project Specific

Definitions

Is there a preferred tool or process for detecting and mitigating configuration drift

The awarded implementation vendor manages configuration drift by using their established DevOps and monitoring tools to detect differences across environments and ensure all Salesforce instances remain aligned.

9/9/2025 Page 3 of 11 across Salesforce environments?

15 7. Other aspects related to Operations, Maintenance, Data Migration and Enhancement Services.

Are there existing business continuity or disaster recovery plans the vendor must align with? If not, is the vendor expected to develop one?

There is a current disaster recovery plan. However, agency and awarded vendor will adapt/adjust current plan or come up with a new plan prior to start date.

16 4.11 ROUND 1

POINT AND

SCORE

CALCULATIONS

In Round 2, what pricing model should we anticipate, will it be a Time and Materials approach or a Fixed Price contract?

While these determinations will officially be made in round 2… We are looking for fixed pricing for monthly O&M cost and Time & materials for enhancement work.

17 RFP

Attachment A -

Sample Contract

Could you please confirm whether the Statement of Work (SOW) will include an unlimited liability clause, or if liability will be subject to a defined cap?

See Attachment A to the RFP for the Sample Contract. Liability is addressed in this attachment.

18 AWARD AND

NEGOTIATION

We understand that vendors are not required to be registered in Oregon at the time of bidding but must be properly registered and authorized to do business in the state prior to contract execution. Could you please confirm if this assumption is correct?

The awarded vendor will need to register as an Oregon business before the contract goes into effect.

19 3.1.3 Key Persons

Could you please confirm how many key members’ resumes will be required, and specify the roles along with the expected qualifications and experience levels for each?

ODHS has no further information to share other than listed in the RFP section 3.3.4.

20 Background Checks

What is the onboarding process and duration for any new resource? What is the typical timeframe for new resources to obtain security clearance?

The state of Oregon will not be responsible for background checks of contractor personnel.

21 General

What is the existing Support coverage and Size of incumbent support team?

This is not relevant to what the state is procuring, and we have no further information to share other than what is listed in the RFP.

22 General

What is the approx.

total volume of tickets annually across all the Salesforce applications and indicative % split between Simple, This specific information is not available but please reference question #4.

9/9/2025 Page 4 of 11

Medium and Complex tickets?

23 General

Does the request cover only managed services for L2 and L3 incidents, or does it also include support for L1?

Vendor will be required to support all incidents but not provide L1 support to end users. Please refer to sample contract Exhibit B.

24 2.4 SCOPE OF

WORK/SPECIFIC

ATIONS

Do you expect the team to work on enhancements of the applications, along with incident fixes or you want different teams for incident management and enhancements?

Yes, we expect the incident fixes and O&M to continue. How the vendors team is managed is dependent on the vendor state is not responsible for the management of contractor personnel.

25 Incident and System

Defect Resolution

How many external systems are currently integrated with Salesforce, and what is the expected growth in integration points?

Vendor is responsible for single source server to and from salesforce server. The state is responsible for data sources that enter and extract from the single source server.

26 RFP

Attachment H - Requirements

For requirements marked “F” (Future Roadmap), should vendors consider these separately or include them in base scope?

There are no requirements marked F.

27 RFP

Are any of the listed requirements considered enhancements (billable separately), or are all expected to be part of the base O&M scope?

Requirements marked enhancement services #99-118 outline enhancement service we may contract for and would be billed separately. Everything else should be included base monthly price proposal.

28 General

What is the expected frequency of sandbox refreshes and data obfuscation routines?

This is a determination made between the awarded vendor and state based on ongoing work activates, assessment of synced environments should be performed and refreshed as needed or recommended by vendor.

29 Refinement and Release

Management:

For release management items (RM1–RM3), is there a fixed deployment schedule (e.g., bi-weekly, monthly), or is it ad hoc?

Monthly, but open to proposals.

30 Data and Migration

What is the approximate volume of data (records, storage size) involved in migrations and synchronization activities?

Not applicable.

31 Data Protections

Are there specific encryption standards or audit tools required for compliance with HIPAA and Oregon privacy laws?

Data protections are done as field encryptions within the Salesforce platform. Tracking of user access to the system & authorization to the system is required.

32 Ticket Software”

Will vendors be granted direct access to the State’s ticketing system (ADOS), or will they

Direct Access.

9/9/2025 Page 5 of 11 work through intermediaries?

33 General

What is the average monthly volume of incidents across all categories (P1–P5), and what % are expected to be L1 vs L2/L3?

Please refer to the answer to question #4 which is all the information we have to share at this point.

34 Data and Migration:

How many reports and dashboards are currently in use (ISS11, ISS21)? Are these expected to be redesigned or maintained?

The system has dashboards and reports already built in and is not in need of redesign however there may be need for maintenance and additional refinement based on future reporting needs.

35 RFP

For requirements involving training

(ISS15, ES16, DOC6),

is the vendor expected to conduct live sessions, or is documentation sufficient?

Documentation is primarily required and there may be times where live training is needed. Training as a result of contracted enhancement work is conducted separately.

36 RFP

For HD12, is the Salesforce Knowledge feature already configured, or will the vendor be responsible for initial setup?

Yes, it is already configured.

37 General

Can the agency provide a list of all Salesforce applications/modules in scope (e.g., CAM, CALMS, ERMS), including:

User base and projected growth Live since date Monthly incident volume Enhancement request volume Integration touchpoints Customization level (Low/Medium/High) AppExchange products used Mobile app support Language support requirements

Salesforce applications/modules will be provided in technical document definitions in round 2. We don't have projections for growth, System has been active 2018, please refer to answer to question #4 for volume, enhancements are dependent on business need/legislation, for integration touchpoints refer to question #23, the system is highly customized and as stated in the RFP the vendor will need to be able to work with custom code within the salesforce system. For app exchange refer to requirements attachment H, no mobile app support is currently required -- but users may access the system through mobile devices, no language support requirements.

38 Data

What is the volume and frequency of data transfers to/from the State Central Data Warehouse?

Daily -- through DRM server.

39 Data

Are there specific tools or middleware currently used for data migration?

Yes, Dbamp & LiquidXML tool used for running out upserts for

DRM.

40 General

How many environments are maintained (e.g., Dev, Test, UAT, Prod)?

We currently have 12 environments, 9 of these are active -- some of those 9 are partials. There is no current plans to change this.

9/9/2025 Page 6 of 11

41 General

Are there peak load periods or seasonal spikes in incident volume?

Emergency response management will have peaks during times of natural disasters -- which cannot be determined. Outside of this there are not necessarily seasonal spikes or peak load periods, but there are times of increased work volume based on system needs.

42 General

Will enhancements be funded separately via service orders?

Is there a cap or budget range for enhancements?

Enhancements are funded separately via a change order process;

the state is not sharing budget information at this time.

43 General

Are there any restrictions or preferences regarding subcontractor use?

Subcontractor is potentially allowable, but use must be approved through the state. However, the state is not responsible for managing the vendors personnel.

44 Business Operations

Window

What is the expected support window (e.g., 24x7, 8x5)?

Are on-call resources required?

Monday through Friday 8-5 PST excluding holidays. There are additional response times based on incidents as listed in SLA's in exhibit B of the sample contract.

45 General

SLA Enforcement:

Are there financial penalties or service credits for SLA breaches?

What are the thresholds for triggering penalties (e.g., missed P1 resolution)?

Is there a cap on total penalties per reporting period?

Yes, & SLA's are negotiable, but this is currently outlined in Exhibit B of the sample contract -- please refer to liquidated damages.

46 General

Share historical SLA performance data or common breach areas?

The State has nothing to share at this time.

47 3.3.7 Reference Check Form

(Scored)

Will all reference responses be scored equally, or will recent/public-sector references be weighted more heavily?

References will be scored based on subjective scoring stated in the RFP section 4.10-4.13.2.

48 3.3.7 Reference

Can proposers submit reference responses in a different format (e.g., email confirmation or online form) if the reference entity prefers?

No, references must follow outlined process as stated in the RFP.

49 3.3.7 Reference

Is it mandatory that references reflect Salesforce O&M experience, or can they include other relevant IT engagements?

References can include all experience, but scoring is subjective and slaesforce experience is a stated preferred qualification.

Please refer to the RFP.

50 4.11 ROUND 1

POINT AND

SCORE

CALCULATIONS

Is there a minimum score or threshold across references that could disqualify a proposer?

Please refer to RFP section 4.13.1.

51 General

What is your budget for 2024 and 2025 spend on Salesforce

The State does not have budget information to share at this time.

9/9/2025 Page 7 of 11

System Operations, Maintenance, Data Migration, and Enhancement Solution?

52 3.1.4 Preferred Certifications

There is mention of

CISSP, CGRC, CRISC,

CIPT, and CIPP/US certifications in the RFP. Since the RFP is on Salesforce AMS, is staffing of personnel with these certifications Mandatory or is it nice to have? If it's mandatory, what are the expected tasks on security and risk which is expected?

These certifications are preferred -- not mandatory.

53 RFP, Page 13 - Round 1 - Proposal

Submissions and Proposal Page Limits

Are Performance Metrics and Service Level Agreements (SLAs) counted in the 50-page word count limit?

No

54 RFP, Page 13 - Round 1 - Proposal

Submissions and Proposal Page Limits

Are the Security Requirements in counted in the page limits?

55 Attachment F

Is attachment F required for proposal submission or is it completed post-award?

Yes, required as part of the proposal submission.

56 RFP Section 6.3 page 28 -

CERTIFIED FIRM

PARTICIPATION

Our company is a certified MBE in several states and localities. Do other certifications transfer to Oregon? If not, what is the process for getting certified?

No, other MBE Certifications count for Oregon. Link:

https://www.oregon.gov/biz/programs/cobid/mbe-wbe/pages/default.aspx.

57 RFP Section 6.3 page 28 -

CERTIFIED FIRM

PARTICIPATION

Are there "extra" points awarded for being a certified MBE as a prime contractor?

58 Attachment H -

Column F in the RTM Solutions tab seems to be locked with no drop down selections available. Can the state please provide an updated version?

Updated version is attached in OregonBuys.

59 Attachment H -

Is a response in Column G required for every row or only when clarification on our approach is necessary?

Only when clarification is necessary or when proposers feel further explanation of their selection is needed.

60 4.12 ROUND 1

RANKING OF

PROPOSERS

Can the state please clarify whether price is part of Round 1 ranking? In the round 1 language the following is stated in the last paragraph, which seems to indicate price is part of round 1 ranking:

Price is not a part of scoring in round 1.

9/9/2025 Page 8 of 11

The SPC will combine the average score for each Proposal with Proposer’s price score. After any applicable preference has been applied, SPC will describe the rank order for each Proposer, with the highest score receiving the highest rank, and successive rank order determined by the next highest score.

61 RFP - Key Persons

Minimum Requirements, Qualifications & Experience:

The state has listed 2 key personnel requirements for admin and Platform Developer 1. Are these the only roles currently staffed?

The state does not have any current staffing information to share at this time.

62 RFP page 17 -

3.3.14 - Security Requirements

We have seen the requirement for GovRamp, our analysis shows that GovRamp is a state security requirement that mirrors FedRamp, please confirm.

Yes

63 RFP page 17 -

3.3.14 - Security Requirements

GovRamp is typically tied to the SaaS vendor which in this case is Salesforce, Oregon uses Salesforce in production, can you clarify what you are asking of the system integration vendor?

Proof of current GovRAMP Authorized status or Documentation of a valid GovRAMP Security Snapshot Score.

64 RFP - Page 15 -

3.3.4 - Staffing

Plan, Key Persons and resumes

It is stated not to go over 2 pages each, but are those 4 pages added to the overall page count?

Yes

65 RFP Timeline

In order to give our references enough time and submit a complete RFP response, would the State please give a due date extension?

No, references must be completed and submitted along with proposals as outlined in the RFP.

66 Attachment H -

As this is an existing Salesforce implementation and we are not the incumbent, it is very difficult for us to know the degree of configuration or customization that may be necessary on many of the listed requirements as we have no prior knowledge of how the Salesforce functionality

No, but we will provide technical documentation & data dictionary in round 2. Going into round 2 to vendors can be expected to sign a Non-Disclosure Agreement.

9/9/2025 Page 9 of 11 references was implemented. Is it possible to add a column to indicate whether the Salesforce component in reference has been configured using out of the box functionality, or some degree of customization.

67 Oregonbuys

Are we able to upload multiple files for submission or does it have to only 1 file?

Multiple files can be uploaded to OregonBuys.

68 Incident

What is the current process for ticketing and escalation, and how are severity levels and SLAs tracked?

Please refer to the RFP for ticketing information -- currently using ADOS, the sample contract exhibit B has current expectations around SLA's however are negotiable with awarded vendor.

69 Change

Does the Agency currently operate a Change Control Board (CCB) for enhancements and refinements, or will the Contractor be expected to establish and manage this process?

Yes the agency currently has a CCB. The contractor will be required to manage external triage in partnership with state O&M staff.

70 Security & Compliance

Has the system undergone a recent security audit (e.g., NIST 800-53, HIPAA, OCIPA, FedRAMP)? If so, can the Agency share any findings or gaps the Contractor will be expected to address? Will there be a transition period with the incumbent vendor? If so, how long, and what level of knowledge transfer documentation (playbooks, SOPs, runbooks) currently exists? Does

ODHS/OHA

anticipate expanding Salesforce usage (e.g., new modules such as Experience Cloud, MuleSoft, Tableau), or consolidating additional case management systems into Salesforce beyond CAM, CALMS, and ERMS? The dropdown in the Attachment H file under the section "Meets Requirement" in the

Yes, the system has gone through security assessment recently and there were no privacy concerns/security risks noted at this time. The state doesn't have any information to share regarding the incumbent vendor. Knowledge transfer and transition plan will be outlined and negotiated with awarded vendor. ODHS has no information to share regarding growth of the system. We are working to fix the drop down in attachment H and an amendment will be posted at the time of response to these questions.

9/9/2025 Page 10 of 11

RTM Solutions tab is not working, Will the file be re uploaded?

71 Security & Compliance

Has the system undergone a recent security audit (e.g., NIST 800-53, HIPAA, OCIPA, FedRAMP)? If so, can the Agency share any findings or gaps the Contractor will be expected to address?

Refer to the answer to question #68.

72 Transition Planning

Will there be a transition period with the incumbent vendor? If so, how long, and what level of knowledge transfer documentation (playbooks, SOPs, runbooks) currently exists?

73 Future Roadmap Does ODHS/OHA anticipate expanding Salesforce usage (e.g., new modules such as Experience Cloud, MuleSoft, Tableau), or consolidating additional case management systems into Salesforce beyond CAM, CALMS, and

ERMS?

74 Excel File Disfunction

The dropdown in the Attachment H file under the section "Meets Requirement" in the RTM Solutions tab is not working, Will the file be re uploaded?

2. Extension of RFP Opening (Due Date for Proposals).

The “Opening” Date (Proposal Due Date) is extended from 10/13/25 to 10/27/25, at 12:00 PM PT.

9/9/2025 Page 11 of 11

Event Date Time

RFP Release to OregonBuys 9/12/25 By COB

Voluntary Pre-Proposal Teleconference 9/19/25 10:30 AM PT

Questions / Clarification/Protests Due 9/24/25 3:00 PM PT

Answers to Questions/Clarification/Protest (“Q&P”) posted to OregonBuys (approx.) 10/1/25

Opening (Proposals Due) 10/13/25

10/27/25 By 12:00 PM

PT

Evaluation Team Evaluates Proposer Response TBD TBD

Competitive Range Announcement and Exclusion Protest Deadline TBD TBD

Subsequent Round Evaluation, e.g., Presentations, Demonstrations, Revised Price Proposals, and Interviews.

TBD TBD

Issuance of Notice of Intent to Award (approx.) TBD TBD

Award Protest Period Ends 7 calendar days after posting Notice of Intent To Award

The Single Point-of-Contact (SPC) for the procurement remains:

Brad Wisniewski State Procurement Analyst brad.wisniewski@das.oregon.gov

(971) 707-1672

Prospective Proposers have until 10/15/25, by 3:00 PM PT to submit written concerns or questions via email only to the SPC regarding the content in Addendum 1 to the RFP.

mailto:brad.wisniewski@das.oregon.gov

SECTION 1: PURPOSE