Addendum 1 - RFP# 2026- 0125 - Q & A UDDA - OIT.pdf

Addendum 1

COLORADO DEPARTMENT OF PUBLIC HEALTH AND ENVIRONMENT

SOLICITATION QUESTIONS AND ANSWERS

Solicitation #: RFP# 2026000125 Solicitation Name: Unified Data Dissemination App - OIT

Vendor Question #1: Could you please let me know if there is an incumbent associated with this opportunity, or if this is a new implementation?

CDPHE Answer #1: This is a new implementation.

Vendor Question #2: If the hosting environment, infrastructure operations, and security boundary for the proposed solution are fully managed by a subcontractor that holds a current SOC 2 Type II certification covering those systems, would this satisfy the certification requirement?

CDPHE Answer #2: Yes, as long as they are the one hosting

Vendor Question #3: If the Proposer is actively undergoing a SOC 2 Type II audit process, with certification expected prior to contract execution or production deployment, would the State consider this sufficient to meet the requirement?

CDPHE Answer #3: Only if they have an old certificate, and this audit is re certification

Vendor Question #4: Does the State require specifically SOC 2 Type II or ISO 27001 certification, or would other equivalent third-party audited security certifications be considered acceptable?

CDPHE Answer #4:

A. Please refer to Section 1.15 INFORMATION SECURITY on pages 8 - 9 of the RFP document (shown below).

B. For SOC 2 Type II, please see 1.15 d. i. (shown below).

C. Please refer to Section 2.13 OIT SECURITY REQUIREMENTS on pages 25 - 26 of the RFP and including the weblinks within as an example: Technical Standards & Policies | Office of Information Technology https://oit.colorado.gov/standards-policies-guides/technical-standards-policies https://oit.colorado.gov/standards-policies-guides/technical-standards-policies

Vendor Question #5: Can CDPHE provide a definitive list of all data sources to be integrated, including whether APIs already exist for each source?

CDPHE Answer #5: The following table provides a summary of the majority of data sources that will need to be integrated into the System. Additional data sources may be incorporated into the final system as well; these will be identified during the scoping process with the awarded vendor. Data Source Link PDF

Vendor Question #6: To what extent is the contractor responsible for data transformation and pipeline development versus leveraging existing MuleSoft or upstream processes?

CDPHE Answer #6: The extent of data transformation is completely dependent on the solution proposed. CDPHE will work closely with the awarded vendor to minimize the amount of data transformations handled within the system.

Vendor Question #7: Does CDPHE require the solution to use a specific GIS platform (e.g., ESRI), or is the platform selection left to the proposer?

CDPHE Answer #7: CDPHE is familiar with ESRI tools, but does not currently have a mapping tool that meets the needs of this system. Depending on the solution proposed, CDPHE will work with the vendor to ensure a mapping layer that meets the needs of this system is available. CDPHE prefers a solution that prioritizes cost and ease of use.

Vendor Question #8: Will the application be required to operate entirely within the State’s AWS environment, and are there mandated services or architectural constraints that must be followed?

CDPHE Answer #8: To align with CDPHE standardized architecture, it must be built in OITs AWS environment.

Vendor Question #9: Can CDPHE clarify the specific security and compliance requirements, including any required frameworks or OIT standards that must be met?

CDPHE Answer #9: Please refer to Question #4.

Vendor Question #10: What are the expectations for user authentication and access control (e.g., public-only access vs. role-based access for internal users)?

CDPHE Answer #10: User authentication must align with OIT requirements (i.e., use existing SSO system). In addition, the application should have a front-facing component completely https://drive.google.com/file/d/1Vb1OgoDPNO7Og3eF0BBRcCcPjJ9jGMjT/view?usp=sharing open to the public, and an admin section requiring sign-in. Access in the admin section would be limited to a relatively small number of CDPHE staff (anticipating around 10 users, with a max of 20). As the application is developed we will evaluate in partnership with the vendor whether there is a need for different types of users with different levels of permission within the admin section.

Vendor Question #11: Does CDPHE expect the contractor to implement a content management system, or should the solution integrate with an existing CMS (if so, which one)?

CDPHE Answer #11: CDPHE does not have an existing web CMS for this solution to integrate with. Instead, the contractor is expected to implement content management capabilities directly into the proposed application.

Specifically, the solution must feature an "admin section" built on a low-code or no-code framework that allows non-technical APCD staff to easily update, add, and remove tabs, text, labels, and dataflows. Please note that while a web CMS integration is not needed, the system must integrate with Hyland's OnBase to retrieve existing textual data and PDFs.

Vendor Question #12: Can CDPHE clarify the expected phased delivery approach, including whether an MVP is required prior to full system deployment?

CDPHE Answer #12: No MVP is required, rather the individual components of the system will be tested and approved by CDPHE staff as they are completed.

Vendor Question #13: What level of post-deployment support and maintenance is expected, including any required service level agreements (SLAs)?

CDPHE Answer #13: Post deployment support is currently optional and dependent upon available funding.

Vendor Question #14: Are proposers allowed to recommend alternative technical approaches that differ from the conceptual design shown in the mockup exhibit?

CDPHE Answer #14:Yes, we welcome proposed alternative technical approaches.

Vendor Question #15: Does CDPHE have a preferred data architecture or cloud environment?

CDPHE Answer #15: CDPHE’s preferred environment is AWS, but is willing to evaluate a GCP solution if proposed

Vendor Question #16: Do you expect the contractor to handle data governance and metadata?

CDPHE Answer #16:

We can provide some guidance on data governance. CDPHE is working on a draft data governance framework, but is unprepared to share widely at the moment. Please respond with an email address so that we can share the draft document with you (the vendor).

Link to share: https://docs.google.com/document/d/19ftzvKnkvKHbYzkpl9HIG35-qgY2gVG4/edit#heading=h.14ee3lkd6gsa

Vendor Question #17: Are there any known data quality issues we should be aware of?

CDPHE Answer #17: We are unaware of any data quality issues that would impact the development of this system.

Vendor Question #18: What level of support is needed after system launch?

CDPHE Answer #18: Refer to question #13

Vendor Question #19: Can proposers suggest alternative approaches, or should responses strictly adhere to the draft Statement of Work?

CDPHE Answer #19:Refer to Question #14

Vendor Question #20: Is there a current system or contractor in place today?

A. If yes, what are the primary challenges with the current solution?

B. Will data migration from existing systems be required?

CDPHE Answer #20: No, there is currently not a system in place. This is a new system.

Vendor Question #21: Can CDPHE provide the relative weighting of evaluation criteria (technical, cost, experience, etc.)?

CDPHE Answer #21: The following PDF of the Proposal Evaluation Scoresheet provides the RFP category, document sections/ locations, and possible points by which all proposals will be scored. Proposal Evaluation Scoresheet

Vendor Question #22: What systems and data sources will need to be integrated as part of this effort?

CDPHE Answer #22: Refer to Question #5 https://docs.google.com/document/d/19ftzvKnkvKHbYzkpl9HIG35-qgY2gVG4/edit#heading=h.14ee3lkd6gsa https://docs.google.com/document/d/19ftzvKnkvKHbYzkpl9HIG35-qgY2gVG4/edit#heading=h.14ee3lkd6gsa https://drive.google.com/file/d/17rbXO7Z5Qe4H2b1W54WAkH1w_el-yF_7/view?usp=drive_link

Vendor Question #23: Is there a preferred mapping or GIS platform for this solution?

CDPHE Answer #23: Refer to Question #7

Vendor Question #24: Per Exhibit A, electronic submittals require one signed Attachment 1 and one digital file of the Proposal. Can CDPHE clarify whether all required attachments (Attachment 2 – Budget Sheet, Attachment 4 – System Security Plan, and supporting documents) should be included within a single consolidated proposal file or submitted as separate files?

CDPHE Answer #24: The main concern is that Attachment 1, as the signature page, is submitted separately from the rest. We are comfortable with receiving multiple documents for the balance or they can all be included within one electronic file, with the exception of confidential/proprietary information. Those must be kept separate within their own digital file(s) as specified within the RFP under Section 1.7. To further clarify, Attachment 4 is informational only and is specifically for the awarded vendor only at contracting time and does not need to be filled out and submitted with proposals.

Vendor Question #25: What are the current data sources? Are they a mix of static PDFs, CSV/Excel, APIs, and databases?

CDPHE Answer #25: Refer to Question #5

Vendor Question #26: How frequently does the data get updated or is anticipated to change?

CDPHE Answer #26: The data change rate completely depends on the data source. In general the range would be from daily to annually.

Vendor Question #27: Are you looking for a custom solution or a pre-built data solution?

CDPHE Answer #27:We would accept either if it meets the specifications outlined in the SOW.

Vendor Question #28: AWS Current Infrastructure: Is the solution expected to be hosted on the proposer's AWS or in the State’s AWS infrastructure?

CDPHE Answer #28: Refer to Question #8

Vendor Question #29: How will CDPHE define success for this project at the one-year mark post-launch? Are there specific usage metrics, stakeholder satisfaction benchmarks, or data access targets you are aiming to hit?

CDPHE Answer #29: Success will be defined by the vendor meeting the agreed upon deliverables of the contract.

Vendor Question #30: Is this tool intended to reduce direct inquiries to APCD staff (i.e., is public self-service a measurable goal), or is the primary purpose transparency and stakeholder education?

CDPHE Answer #30: The intent of this system is to address all of the objectives mentioned in your question.

Vendor Question #31: Are there existing tools or platforms this is intended to replace, consolidate, or supplement? If so, what pain points from those tools should this system specifically resolve?

CDPHE Answer #31: There are many independent dashboards built in Tableau. This tool will replace some and leverage others. The primary pain point this tool resolves is developing a single location for disseminating air quality data and information.

Vendor Question #32: Who are the primary public audiences for this tool (e.g., community members near industrial facilities, environmental advocates, journalists, academic researchers, or regulated industry representatives)? Are some audiences higher priority than others?

CDPHE Answer #32: The public is the primary audience, but all that are mentioned in your question are considered important users.

Vendor Question #33: Can CDPHE provide an inventory of the existing data sources (e.g., ATMD, APIs, datasets) that will feed the application, including formats, refresh frequency, and expected data volumes?

CDPHE Answer #33: Refer to Question #5

Vendor Question #34: Does CDPHE have a preferred mapping framework (e.g., Esri, Mapbox, OpenLayers) or existing licensing agreements that the project should leverage?

CDPHE Answer #34: Refer to Question #7

Vendor Question #35: Are there performance expectations for map rendering, data queries, and visualization updates when users apply filters or change layers?

CDPHE Answer #35: Yes, the map renderings should feel seamless from the user perspective.

Vendor Question #36: Beyond the ATMD, what other existing databases or data sources need to be connected (e.g., permit databases, emissions inventories, EPA AQS data, census/EJ layers)?

CDPHE Answer #36: Refer to Question #5

Vendor Question #37: The SOW references base map layers from providers like Google, Esri, and OpenStreetMap. Are there existing licensing agreements for these services, or will the vendor need to procure and manage those licenses?

CDPHE Answer #37: Refer to Question #7

Vendor Question #38: Is CDPHE envisioning specific AI use cases (e.g., natural language search, automated insights, chatbot assistance, anomaly detection), or should vendors propose potential applications during discovery?

CDPHE Answer #38:

Per Section 2.11.2 of the RFP, CDPHE does envision specific AI use cases - primarily a natural language interface capable of regulatory synthesis and contextual data retrieval.

However, we are also looking for vendors to propose the most cost-effective and practical applications during the discovery phase. Please note:

● Cost & Scope: The AI layer is explicitly listed as an "Optional cost" in the budget (Attachment 2).

● We encourage vendors to leverage existing open-source or OIT-approved cloud-native tools (such as those within AWS) to keep costs minimal.

● Future-Proofing: If a full AI solution is not feasible within the core budget, your proposal must at minimum ensure the core system is "AI-ready." The architecture must be modular, scalable, and utilize published APIs (Section 2.11.2) so that future natural language search integrations are seamless.

● Compliance: Any proposed AI functionality must focus on data retrieval and synthesis, as AI is not approved for "High-Risk" use cases and must strictly comply with OIT policies and Colorado state laws

Vendor Question #39: What user roles are expected beyond public users and CDPHE technical staff, and will authentication integrate with an existing State identity system?

CDPHE Answer #39: Please refer to Question #10.

Vendor Question #40: How frequently are underlying datasets expected to change, and should the system support automated data ingestion pipelines or manual updates managed by CDPHE staff?

CDPHE Answer #40: Refer to Question #26

Vendor Question #41: Does CDPHE envision this system expanding to additional environmental datasets or divisions in the future, and should the architecture be designed as a broader platform rather than a single application?

CDPHE Answer #41: The ability to incorporate additional new datasets into the system is a requirement, regardless of who owns the dataset.

Vendor Question #42: Does CDPHE have a preferred technology stack for the front-end and back-end components, or are vendors encouraged to propose the architecture and frameworks that best support scalability, performance, and long-term maintainability?

CDPHE Answer #42:

CDPHE encourages vendors to propose the architecture and frameworks that best support scalability, performance, and long-term maintainability. However, per Section 2.11.2 of the RFP, any proposed stack must be hosted in AWS, be non-vendor proprietary, and utilize commercial or open-source technologies that can be approved by OIT. Additionally, vendors must include a clear, non-proprietary exit strategy for CDPHE to take ownership of the source code at the end of the contract, and the UI should lean toward no/low-code solutions for easy state administration.

Vendor Question #43: Should the system be architected with a modular structure that allows additional datasets, environmental programs, or dashboards to be added in the future beyond the initial scope?

CDPHE Answer #43: Refer to Question #41

Vendor Question #44: Are there existing user personas or accessibility/usability goals that should guide the UX design for dashboards and educational content?

CDPHE Answer #44: No.

Vendor Question #45: Has CDPHE conducted any previous user research or stakeholder feedback sessions about how the public currently accesses air quality data, and are there known usability challenges the new system should address?

CDPHE Answer #45: Indirectly yes. We have heard through many different stakeholdering processes that accessing air quality data is currently very challenging. The primary issue is that all of our existing publicly available data sources are located in different places.

Vendor Question #46: Exhibit B SOW mentions an Air Toxics Monitoring Database (ATMD).

Describe this backend component. Was it developed in-house? commercial software? What factors impair it from calculating or computing intermediary data products and stats?

CDPHE Answer #46: The ATMD is an AWS database and accompanying application. The purpose of this tool is to facilitate the review/approval of the state’s air toxics monitoring data, and to provide a place to house final datasets for access by staff and the public. The ATMD is only one of the many data sources that will need to contribute information to this new system.

Thus in order to provide data from multiple sources in a single location, we are under the assumption that harmonized intermediary data products will need to be produced in order to accomplish this.

Vendor Question #47: Exhibit D mockup, slide 27 shows the timeline. What vendor(s) were involved in the Scoping phase? What vendor(s) were involved in the Contract phase, scheduled to end July 1, 2026?

CDPHE Answer #47: The scoping phase indicates internal scoping across all the programs within the air pollution control division. Vendors were not involved in this scoping process.

Vendor Question #48: Exhibit B SOW Objective 1 reads the system shall incl both webpage & backend components. Please clarify "backend." e.g. an air quality database? connections like APIs? software to control the front-end webpage?

CDPHE Answer #48: The “backend” consists of two components. The first component is the admin section, which will allow authorized users to add to and modify the public webpage.

The second component is a processing layer. The processing layer will access information from existing databases (e.g., via API). Any necessary data transformations, computations on the data, or new visualizations will be produced and stored in the processing layer. These data products will then be made available to be displayed on the front-end webpage from the processing layer.

Vendor Question #49: Exhibit B SOW Standards and Requirements 5d. mentions MuleSoft integrations. Please describe the primary function(s) of MuleSoft as integrated with the UDDA?

Describe the desired use case(s).

CDPHE Answer #49: MuleSoft would be the function vendor to utilize for any integrations, unless the platform used has native integrations functionality.

Vendor Question #50: Exhibit B SOW Standards and Requirements 6. mentions "computations,"

7. "intermediary data products" and statistics. Please describe calculations beyond basic max, min, average. Also will similar computations be reported on the "My Air Quality" tab?

CDPHE Answer #50: Yes the same computations and visualizations will be provided on the “Overview” and “My Air Quality” tabs. The statistics computed are expected to be relatively simple (e.g., max, min, average, quartiles, etc.), however, the System will need to access one or more data sources to ensure all appropriate data is included. For example, this could include accessing data for a user-specified pollutant, across a user-specified timeframe, from multiple monitoring sites or databases. The system would then need to aggregate this data and compute the necessary statistics.

Vendor Question #51: 2.11.3.2) Please elaborate on the OnBase integration. Is the intent to permit UDDA webpage visitors to access documents from the OnBase system?

CDPHE Answer #51: Yes

Vendor Question #52: 2.6.3) How many staff members ought to have access to modify, update, and maintain aspects of the UDDA? Also, please describe if tiers of user rights apply.

e.g. admins vs power users vs occasional users

CDPHE Answer #52: Refer to Question #10.

Vendor Question #53: 2.11.3.2) OnBase integration - Does CDPHE already have API or web services from this system to facilitate data retrieval? Which aspects of the Exhibit D mockup(s) access information from OnBase?

CDPHE Answer #53: Refer to Question #75 In Exhibit D, the following items access information from OnBase: the map depicted on page 2, certain filters on pages 3 and 4 will guide information queried from OnBase, the map and side panels on pages 6 - 9, and the tab depicted on page 16. There may be instances where the “Hot Topic” tabs need to access information from OnBase as well, this need will be assessed with the awarded vendor.

Vendor Question #54: 2.11.2.6) Please clarify and describe "non-vendor proprietary" system architecture.

CDPHE Answer #54: The final developed system must be owned by CDPHE, as per 2.11.2.6.

Vendor Question #55: 2.18 Performance outside the U.S. Which tasks (e.g. web development) could be performed offshore in west/central Europe? Which tasks must remain onshore (e.g.

project kick-off & mgmt., data residency in AWS, UAT, training, tech support)?

CDPHE Answer #55: Multipart Answer –

1. Per OIT - Vendors can do offshore work as long as it's preapproved by OIT. OIT will review such requests and confirm that our data is not being stored offshore. Data storage is a high priority consideration for data-related projects.

2. Related - Per the RFP document from Section 1.2 PROPOSER IDENTIFICATION All Proposals must include a valid tax identification number for the Proposer. Any Proposer must be a legal entity with the legal right to contract in the State of Colorado.

3. See also PDF link: Offshoring Guidance for State Agencies

Vendor Question #56: In Attachment 2 (Budget / Price Sheet), the RFP number appears as “2026*0125.” Please confirm that the correct RFP reference is RFP 2026000125.

CDPHE Answer #56: Both are correct. The * is often used as a placeholder for two of the zeros.

Vendor Question #57: Based on our review of the RFP and Attachment 2 (Budget / Price Sheet Template), our understanding is as follows:

a. Our understanding is that the Initial Contract Period (July 1, 2026 – October 8, 2026) represents a partial administrative term, and that system development continues through October 8, 2028, with optional maintenance thereafter. Please confirm.

b. The reference to “Execution of Contract – October 2029” in Attachment 2 represents a pricing visibility horizon that includes development and post-Go-Live stabilization and does not extend the development completion date beyond October 8, 2028. Please confirm.

c. Optional Year 1 and 2 represent vendor maintenance/support services, while “Annual Operational Cost to run the developed system” represents estimated State infrastructure/platform costs, and that these are separate. Please confirm.

CDPHE Answer #57: a. This information has been revised within the RFP and reposted as a modified RFP on 3.24.26. The initial contract period is now tentatively scheduled as a full year: July 1, 2026 through June 30, 2027.

b. Full system development is requested from Execution of Contract through to and completed by 10/4/2029.

c. After 10.4.29, and fully dependent upon additional funding, there will be an additional year and a partial year considered as option years through to 6/30/31, for a full one year contract plus four https://drive.google.com/file/d/1DbDoIp8_CIeVSGNy5tMka2jGv6vAadN8/view?usp=drive_link option partial / option years (as matches above) for not more than five years. We apologize for any inconvenience the incorrect dates caused.

Vendor Question #58: Proposal Attachments & Submission Requirements: Please confirm whether proposers are required to respond directly within Attachment 3, or whether separate response documents referencing Attachment 3 sections are acceptable.

CDPHE Answer #58: We provide the response sheet as Attachment 3 for proposers to use as a template, but if you prefer, you are welcome to submit your own separate document, following the document topics and original order.

Vendor Question #59: Please confirm whether Attachment 4 (System Security Plan) is required at proposal submission as a high level / planned controls document, with detailed system specific controls to be completed post award in coordination with the State.

CDPHE Answer #59: Refer to Question #24.

Vendor Question #60: Our understanding is that Attachment 5 is provided for review only at the proposal stage and would be executed post award by the successful bidder. Please confirm.

CDPHE Answer #60: That is correct.

Vendor Question #61: We assume electronic/digital signatures are acceptable for Attachment 1 (RFP Signature Page).

CDPHE Answer #61: Yes, a digital signature is fine.

Vendor Question #62: Please confirm whether the scope includes API development and associated backend components required to support the solution.

CDPHE Answer #62: Yes, the scope includes the development of necessary data integration layers (APIs) and associated backend components required to support the solution.

As outlined in the Statement of Work Summary, the requested solution must encompass both the public-facing webpage and any required data integration layers. Furthermore, Section

2.11.2 states that the system architecture must be portable and utilize published APIs.

Please note the following technical guardrails for API and backend development outlined in Section 2.11.3.

Vendor Question #63: Our understanding is that the RFP does not restrict the use of offshore resources, and that a global delivery model (including offshore resources from India) is permitted, subject to security and delivery requirements. Please confirm.

CDPHE Answer #63: Please refer to question #55.

Vendor Question #64: In the event of unforeseen circumstances during project execution, please confirm whether replacement of project resources with equally or better qualified personnel is acceptable, subject to the State’s prior approval and continuity requirements.

CDPHE Answer #64: This is acceptable as long as project continuity and contract deliverables are not negatively impacted by these changes.

Vendor Question #65: Can CDPHE provide additional detail on the relative weighting of evaluation categories, particularly the balance between technical approach and cost?

CDPHE Answer #65: Please refer to question #21.

Vendor Question #66: Under Mandatory Minimum Qualifications, proposers are required to provide a formal declaration confirming financial stability (no bankruptcy, receivership, or insolvency proceedings in the past three years).

a. Our understanding is that only this declaration is required at the proposal stage, and that certified and audited financial statements, referenced in Section 3.3, would be requested post-evaluation (for example, from the apparent successful bidder) and are not required to be submitted with the proposal.

b. If such financial statements are requested post-evaluation, could the State please confirm the appropriate secure submission method or designated email contact, as these documents are confidential and may not be suitable for submission through the public proposal portal?

CDPHE Answer #66: Should the state request these documents all documents will be submitted to a state fiscal email address.

Vendor Question #67: We assume resumes are required only for key personnel (such as Project Manager, Lead Architect, Lead Developer), or if resumes are required for all proposed project staff.

CDPHE Answer #67: Resumes for key personnel is sufficient.

Vendor Question #68: For project experience and references, please confirm whether the referenced projects must be fully completed, or whether ongoing projects may also be included if they meet the scope and size requirements.

CDPHE Answer #68: Any project that meets the scope and size requirements would be considered in a proposal.

Vendor Question #69: If the proposer intends to note any deviations, comments, or proposed changes to the Model Contract terms and conditions, please confirm where such deviations should be documented in the proposal (for example, within the Proposer Response Template or as a separate attachment).

CDPHE Answer #69: Proposers may submit the Model (sample) contract with redlines with the track changes on and/or notes in the comments to identify deviations.

Vendor Question #70: Business Scope & Objectives: What are the primary success criteria for the system (KPIs)?

CDPHE Answer #70: The success criteria for the system will be established as deliverables in the contract development with the awarded vendor.

Vendor Question #71: Who is the target user groups (public, researchers, policymakers)?

CDPHE Answer #71: Refer to Question #32

Vendor Question #72: Are there existing tools being replaced?

CDPHE Answer #72: Refer to Question #31

Vendor Question #73: Data Architecture / Data Management: Is the vendor expected to redesign or optimize existing data repositories (e.g., databases, data warehouses, or data models), or should the solution integrate with and utilize the current data structures as-is?

CDPHE Answer #73: Redesign or optimization of existing data repositories is outside the scope of this project.

Vendor Question #74: Are there existing data models, schemas, or documentation available for the source systems, and can CDPHE provide sample datasets or data dictionaries to help vendors assess data structure, relationships, and transformation complexity for estimation purposes?

CDPHE Answer #74: Refer to Question #5

Vendor Question #75: Data Sources & Integration: OnBase Integration: Section 2.11.3 references integration with Hyland OnBase. Can CDPHE provide details on the current OnBase implementation, including:

• Version :

• Hosting model (cloud or on-premise) -

• Availability of APIs or web services for integration?

CDPHE Answer #75: Version : Current version is 24.1 (plan to upgrade to 26.1 around September 2026)

• Hosting model (cloud or on-premise) - Hyland Cloud

• Availability of APIs or web services for integration? OnBase REST API available

Vendor Question #76: How many source systems are expected to be integrated within the initial scope? Additionally, are real-time data feeds (e.g., air monitoring data) already available via existing APIs, or will the vendor be responsible for establishing ingestion pipelines?

CDPHE Answer #76: Refer to Question #5

Vendor Question #77: What is the approximate volume of historical data expected to be exposed through the system (number of records, storage size, or years of monitoring data)?

CDPHE Answer #77: The System is expected to only access and display relatively small portions of the complete datasets, based on user selections and filters.

Vendor Question #78: What is the expected scale of system usage (e.g., monthly users, peak concurrent users)?

CDPHE Answer #78: See section 2.7 “OVERVIEW AND STATEMENT OF WORK SUMMARY”

Vendor Question #79: Are there performance benchmarks for page load times or map rendering performance expected for the application?

CDPHE Answer #79: Refer to Question #35

Vendor Question #80: Content Management: Will the system require a content management capability for non-technical staff to manage informational pages and content?

CDPHE Answer #80: Refer to Question #11

Vendor Question #81: Who will be responsible for creating, updating, and maintaining informational and educational content within the system (e.g., “Air Pollution 101” sections and topic-specific pages), and what is the expected frequency of updates?

CDPHE Answer #81: System admin users will be responsible for creating, updating, and maintaining the informational and education content of the system. Infrequent updates are expected, but solely dependent on the status of CDPHE content needs.

Vendor Question #82: Does CDPHE currently use or plan to use a specific Content Management System (CMS), and should the proposed solution integrate with an existing CMS or include a new CMS as part of the vendor’s scope?

CDPHE Answer #82: Refer to Question #11

Vendor Question #83: Data Readiness & Transformation: For the datasets associated with key subject areas (e.g., criteria pollutants, air toxics, GHG, ozone, methane), are data sources already standardized and ready for integration, or is data transformation and normalization expected to be part of the vendor’s scope?

CDPHE Answer #83: Refer to Question #6

Vendor Question #84: Data Scope & Migration: What are the source systems for air monitoring, emissions, and modeling data, and in what formats are these datasets available (APIs, databases, flat files, etc.)?

CDPHE Answer #84: Refer to Question #5

Vendor Question #85: Is historical data migration required? If yes:

a. How many years?

b. Estimated data volume?

CDPHE Answer #85: Refer to Question #77

Vendor Question #86: Are there real-time data ingestion requirements?

CDPHE Answer #86: Please see the mock-up as a reference. Real time data ingestion is required in the sense that a user will custom filter the data they are interested in and the system will go fetch the data needed, in real time. However, there are no real time data feeds that the system is continually accessing.

Vendor Question #87: Who owns data quality and validation?

CDPHE Answer #87: CDPHE is the owner of both data quality and validations. CDPHE will work with the vendor to ensure that any data products created by the system are quality controlled and validated through the UAT process.

Vendor Question #88: Architecture & Technology: Is there a preferred tech stack (frontend/backend)? Section 2 references OIT technology approval requirements. Can CDPHE provide guidance or documentation on currently approved technology stacks (e.g., frontend frameworks, backend technologies, databases) to ensure alignment in proposed solutions?

CDPHE Answer #88:For more information, please see: https://oit.colorado.gov/standards-policies-guides/technical-standards-policies#:~:text=*%20TS%2DCISO%2D001%20Authentication%20&%20Account%20Management%20 Standard,Security%20for%20IT%20Spaces%28opens%20in%20new%20window%29

Vendor Question #89: Will all application components be required to reside within the State’s AWS environment managed by OIT, or may vendors provision and manage a separate AWS account with appropriate cross-account access controls (e.g., IAM roles, PrivateLink)?

CDPHE Answer #89: The proposed system is required to be hosted in Amazon Web Services (AWS). It must integrate with the State's current cloud environment and comply with all security and connectivity standards approved by OIT.

Vendor Question #90: Any preference for: GIS tools (ArcGIS, Mapbox, ESRI, Leaflet)?

CDPHE Answer #90: Refer to Question #7

Vendor Question #91: Are APIs expected to be: Public, Internal, Both?

CDPHE Answer #91: CDPHE will work directly with the awarded vendor to identify if any newly developed API will be public, internal, or both.

Vendor Question #92: Does the State have a preferred AWS region and/or a list of OIT-approved AWS services that vendors must adhere to? Are commonly used services (e.g., RDS, Lambda, API Gateway, OpenSearch) pre-approved?

https://oit.colorado.gov/standards-policies-guides/technical-standards-policies#:%7E:text=*%20TS%2DCISO%2D001%20Authentication%20&%20Account%20Management%20Standard,Security%20for%20IT%20Spaces%28opens%20in%20new%20window%29 https://oit.colorado.gov/standards-policies-guides/technical-standards-policies#:%7E:text=*%20TS%2DCISO%2D001%20Authentication%20&%20Account%20Management%20Standard,Security%20for%20IT%20Spaces%28opens%20in%20new%20window%29 https://oit.colorado.gov/standards-policies-guides/technical-standards-policies#:%7E:text=*%20TS%2DCISO%2D001%20Authentication%20&%20Account%20Management%20Standard,Security%20for%20IT%20Spaces%28opens%20in%20new%20window%29 https://oit.colorado.gov/standards-policies-guides/technical-standards-policies#:%7E:text=*%20TS%2DCISO%2D001%20Authentication%20&%20Account%20Management%20Standard,Security%20for%20IT%20Spaces%28opens%20in%20new%20window%29

CDPHE Answer #92: Commonly used services that are generally acceptable to OIT include:

● Compute/Serverless: Lambda, EC2, ECS.

● Database: RDS (MySQL, PostgreSQL, etc.), DynamoDB.

● Integration/API: API Gateway.

● Analytics/Search: OpenSearch.

3. Key Requirements for Vendors Vendors must comply with the following, rather than just a list of services:

● Colorado CISO Requirements: Vendor security practices must meet or exceed State CISO standards (following NIST standards).

● Data Ownership: The vendor’s Service Level Agreement (SLA) must state that the State of Colorado owns the data.

● Data Access: Access to state data must be secured to the highest degree, particularly if the vendor is on state-owned property.

● Accessibility: Services must conform to WCAG 2.0 Level A and AA https://oit.colorado.gov/standards-policies-guides/technical-standards-policies#:~:text=*%20TS%2DCISO%2D001%20Authentication%20&%20Account%20Managem ent%20Standard,Security%20for%20IT%20Spaces%28opens%20in%20new%20window%29

Vendor Question #93: Mockup Interpretation: Exhibit D (APCD UDDA Mockup) is referenced as part of the requirements. Should the mockups be considered a fixed design specification, or are they intended as conceptual guidance allowing vendors to propose alternative UI/UX approaches that meet the functional goals?

CDPHE Answer #93: Refer to Question #14

Vendor Question #94: Cloud & DevOps: Will AWS environments (Dev/Test/Prod) be pre-provisioned?

CDPHE Answer #94: Yes.

Vendor Question #95: Are there required DevOps tooling standards such as Infrastructure-as- Code frameworks, logging, or monitoring tools that vendors must use?

CDPHE Answer #95: Cloud native/provider specific tools. AWS Cloud formation (JSON or YAML) azure RESOURCE MANAGER

Vendor Question #96: Could you please confirm on the CI/CD expectations?

CDPHE Answer #96: The expectations are immediate developer feedback via automated testing, consistent build across environments and high quality secure code development.

https://oit.colorado.gov/standards-policies-guides/technical-standards-policies#:%7E:text=*%20TS%2DCISO%2D001%20Authentication%20&%20Account%20Management%20Standard,Security%20for%20IT%20Spaces%28opens%20in%20new%20window%29 https://oit.colorado.gov/standards-policies-guides/technical-standards-policies#:%7E:text=*%20TS%2DCISO%2D001%20Authentication%20&%20Account%20Management%20Standard,Security%20for%20IT%20Spaces%28opens%20in%20new%20window%29 https://oit.colorado.gov/standards-policies-guides/technical-standards-policies#:%7E:text=*%20TS%2DCISO%2D001%20Authentication%20&%20Account%20Management%20Standard,Security%20for%20IT%20Spaces%28opens%20in%20new%20window%29

(automation first, rapid feedback loops, fast frequent integrations, built in security and quality, immutable artifacts, reliable pipelines, improved collaborations)

Vendor Question #97: Section 1.15 references FedRAMP and StateRAMP requirements. Can CDPHE clarify whether the expectation is for the hosting infrastructure to utilize FedRAMP-authorized cloud services, or whether the vendor organization itself must hold such authorization? Additionally, is there a preference for StateRAMP-authorized solutions?

CDPHE Answer #97: product level

Vendor Question #98: Security & Compliance: What data classifications apply (public, sensitive, restricted)? Is PII involved?

CDPHE Answer #98: All data utilized within this application is considered public, with no specific license associated with it. No PII is involved in this application.

Vendor Question #99: Section 2.3 requires SOC 2 Type II or ISO 27001 certification. Must this certification be held by the prime contractor specifically, or can it be satisfied through a parent organization or subcontractor?

CDPHE Answer #99: Refer to question #4

Vendor Question #100: Are there specific:

a. Encryption requirements

b. Access controls (RBAC)

CDPHE Answer #100: Details on tech standards can be found here:

https://oit.colorado.gov/standards-policies-guides/technical-standards-policies#technical

Vendor Question #101: Identity & Access Management: Will the application require user authentication or integration with State identity providers (e.g., SSO such as Azure AD or Okta), and what role-based access levels are expected?

CDPHE Answer #101: Yes, SSO access will be required for the admin access portion of the system.

Vendor Question #102: GIS & Visualization: Is there an existing GIS platform and licensing in place (e.g., ESRI/ArcGIS), and will required licenses be provided by the State, or should vendors include GIS licensing costs as part of their proposal? Additionally, are there any preferred or mandated GIS tools or vendor agreements that must be used?

CDPHE Answer #102: Refer to Question #7

Vendor Question #103: What are the expected map performance requirements? Are there any requirements for mobile responsiveness?

CDPHE Answer #103: Refer to Question #35

Vendor Question #104: Reporting & Analytics: Are dashboards expected to be Custom-built OR Integrated with tools (Power BI, Tableau)?

CDPHE Answer #104: Dashboards expected to be custom built, but if Tableau dashboards are needed after the project is over they should be able to be easily embedded into template pages.

Vendor Question #105: Do users need custom report creation?

CDPHE Answer #105: Yes, for tabular data download functionality.

Vendor Question #106: Integration: What enterprise systems must be integrated? Are APIs already available or need to be built? Any third-party data providers?

CDPHE Answer #106: OnBase is the only known enterprise system that will be integrated within the system. Integration of OnBase is expected to be discovered by the vendor.

Vendor Question #107: Testing & Acceptance: What are the acceptance criteria?

CDPHE Answer #107: The development of performance testing requirements and acceptance criteria will be an ongoing collaborative process with the awarded vendor. The details of the project will be scoped, then performance testing requirements and acceptance criteria for reference during UAT will be established for individual features.

Vendor Question #108: Will there be UAT environment? Performance testing requirements?

CDPHE Answer #108: The vendor is expected to plan for and utilize Development, Test, and Production Environments. CDPHE staff will be completing ongoing UAT as features are developed and deployed in the Test Environment. The development of performance testing requirements and acceptance criteria will be an ongoing collaborative process with the awarded vendor. The details of the project will be scoped, then performance testing requirements and acceptance criteria for reference during UAT will be established for individual features.

Vendor Question #109: Support & Maintenance: What is the Expected support model (24/7, business hours)? SLA requirements?

CDPHE Answer #109: Refer to Question #13

Vendor Question #110: Do post-launch responsibilities include bug fixes, enhancements, and data updates only, or are additional support activities expected?

CDPHE Answer #110: Refer to Question #13

Vendor Question #111: AI / GenAI Requirements: Our understanding is that AI capabilities referenced in the RFP are optional or phased enhancements, and that inclusion of a GenAI or LLM based solution is not mandatory for initial system delivery in order for a proposal to be considered compliant. Could the State please confirm the expected scope and nature of AI involvement for this project, including whether any AI functionality is required as part of the initial implementation and whether there is any approved or preferred AI providers?

CDPHE Answer #111: Refer to Question #38

Vendor Question #112: Does the functionality, capabilities, and requirements described in “Exhibit B – Draft Statement of Work” and “Exhibit D- APCD UDDA RFP Mockup” represent the Minimum Viable Product (MVP) for acceptance and First public release, or is it a long-term vision that can be approached incrementally by first defining an MVP and then a roadmap to progressively add capability over time in a series of releases?

CDPHE Answer #112: We will evaluate your proposal based on meeting the specifications as outlined in the activities and information provided within the SOW.

Vendor Question #113: What is the preferred tech stack and hosting environment for this application? If there are none, what cloud or on-prem resources are available to State of Colorado for hosting and operating websites on the public internet?

CDPHE Answer #113: Refer to Question #88

Vendor Question #114: What is State of Colorado’s Policy regarding the introduction and use of open-source software from common online package repositories like NPM?

CDPHE Answer #114: The State of Colorado encourages the use of Open Source Software (OSS) to foster innovation, modernization, and transparency, but strictly regulates its introduction through security policies aligned with NIST 800-53. While tools from repositories like NPM are used in modern development, they must conform to state cybersecurity standards, specifically CISO-001/003, which prioritize managing risks related to vulnerabilities and supply chain attacks.

Key Policy Aspects

● Security & Risk Management (CISP-003):All software, including open-source packages, must be vetted for security risks.

● Modernization: Colorado actively uses OSS tools and libraries, particularly in data systems, while documenting workflows for safety.

● Acceptable Use (CISP-001): The use of state information technology resources is heavily controlled to protect state data, which applies to external libraries.

● Best Practices: Policies encourage, and sometimes require, keeping open-source dependencies updated to avoid vulnerabilities commonly found in public repositories like NPM.

Essentially, Colorado allows open-source usage but requires that it be managed, reviewed, and secure, as highlighted in guidelines regarding Colorado’s Decision Support Systems.

Vendor Question #115: Regarding the AI chatbot behaviors described pages 24, 25, and 26 of “Exhibit D – APCD UDDA RFP Mockup.pdf”, does State of Colorado already have Large Language Model, Semantic Search, Inference, Agent orchestration, and Vector Data resources in place to support these capabilities or will the provisioning and build-out of these resources need to be part of our solution?

CDPHE Answer #115: Refer to Question #38

Vendor Question #116: Also, regarding AI-based capabilities, does State of Colorado have published policies or guidelines regarding requirements for safe and secure use of AI, especially in regard to large public frontier models? Can these be shared with us?

CDPHE Answer #116: a. Refer to Section 1.19 on page 10 of the RFP.

b. Refer to the Guide to Artificial Intelligence found here: https://oit.colorado.gov/ai

c. Refer to the information provided within the webpage link:

https://oit.colorado.gov/standards-policies-guides/guide-to-artificial-intelligence/individual-user-responsibilities https://cdss.colorado.gov/software/opencdss https://oit.colorado.gov/ai

Vendor Question #117: Is there a general budget range the State of Colorado is looking for the Initial or Overall project work? Are all features and capabilities listed in Exhibit B : Draft Statement of Work expected to be delivered within the budget range?

CDPHE Answer #117: We will evaluate your proposal based on meeting the specifications as outlined in the activities and information provided within the SOW.

Vendor Question #118: Are offshore / nearshore resources permitted in our solution, or must it be done entirely with domestic US labor?

CDPHE Answer #118: Please refer to question #55.

Vendor Question #119: Regarding the document “Attachment 4 – System Security Plan 2.5.5 Teamplate.docx”, is this being provided as an example of the types of documents we will need to provide to OIT after the project starts or is the expectation that this form will be completed and provided on submittal of our solution proposal for purposes of competing for this RFP?

CDPHE Answer #119: Please refer to question #24.

Vendor Question #120: Exhibit B: Draft Statement Of Work: Page 2, Objective #1 states that the data dissemination web application must be delivered no later than the expiration date of the Contract. However, on Page 4 of the RFP 2026000125 Unified Data Dissemination App – OIT.pdf it says the initial contract period is 3 months (7/2026 to early 10/2026). That document also mentions potential for extensions. In our solution, should we plan for a 3-month design and build window or for longer with the assumption that extensions will occur as needed? Is a 12-month project period too much to assume?

CDPHE Answer #120: Refer to Question #57

Vendor Question #121: Page 2, Sub-Activities #1 Does State of Colorado have any preferences in working method (Waterfall, Agile Scrum, Agile Kanban, etc.) and will a two-to-three-month joint Discovery and Design period prior to the start of build be acceptable?

CDPHE Answer #121: We would prefer Agile Scrum. A discovery period is expected, and all deliverables of the contract will be negotiated with the awarded vendor.

Vendor Question #122: Page 2, Sub-Activities #1 status that the project must adhere “to all security and ecosystem requirements for incorporation into the State’s existing web environment”. In the RFP packet the only thing along these lines provided was the Attachment 4 – System Security Plan 2.5.5 Template.docx. Can the full set of “security and ecosystem requirements for incorporation into the State’s existing web environment” be made available to us for review and use in our solution?

CDPHE Answer #122: Refer to Question #4.

Vendor Question #123: Page 2, Sub-Activities #3 For all of these capabilities, does State of Colorado already have the data collected and made available for use in a common database in a format that can be leveraged by a website or will we need to bring Data Engineering resources to work with SMEs at State of Colorado to establish the data…