addendum-2-rfp-nhlc-2026-06.pdf

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 1 of 30

SECOND SET OF INQUIRIES & RESPONSES TO

RFP 2026-06 E-COMMERCE MODERNIZATION

QUESTION 1:

During the May 19 Vendor Conference, in response to the grouped GovRAMP questions, the

State indicated that its focus for Requirement M2 (Appendix B, Table B-2.1) is on the environment in which the solution operates being GovRAMP compliant, rather than the platform or code base itself. Please confirm in the State's written responses that M2 is satisfied where the solution is hosted and operated within a GovRAMP-compliant environment, and that the e-commerce application is not required to be independently listed on the GovRAMP Authorized Product List.

ANSWER:

The GovRAMP requirements are required within the system authorization boundary, including at the environment and the SaaS application layer. GovRAMP’s authorization boundary requirement ensures you provide full visibility into your cloud system’s attack surface. While you need not delay authorization waiting for every vendor to be certified, you must document and manage any gaps transparently and responsibly.

QUESTION 2:

Requirement M9 (Appendix B, Table B-2.1) requires the awarded contractor to grant access to continuous monitoring and reporting supporting GovRAMP Authorization status, including 3PAO audits of the contractor's environment, through the life of the contract.

Please confirm whether the M9 obligation applies at the operating-environment level consistent with M2, or whether it extends to the e-commerce application independently.

ANSWER:

Both. It extends to the e-commerce application as well.

QUESTION 3:

Requirement M15 (Appendix B, Table B-2.1) requires the Vendor's Project Manager to be on-site at NHLC Headquarters a minimum of three days per week during the gap analysis, SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 2 of 30 design, development, testing, and implementation phases, plus the first five weeks after go-live. Please confirm that this on-site Project Manager may be a qualified individual provided by the Vendor's subcontractor or teaming partner, where that individual serves as the designated Project Manager and meets the qualification, approval, and background-check requirements set out in the Statement of Work (Attachment 1, Exhibit B).

ANSWER:

The Project Manager can be a qualified project manager provided by the vendor’s subcontractor or teaming partner.

QUESTION 4:

Under the Not to Exceed pricing structure (Appendix E, Tables E-1.1 through E-1.3), if the hours required to complete a milestone are less than estimated, may the unused hours or budget be reallocated to additional in-scope functionality through a Change Order, or do unused amounts revert to the State as savings?

ANSWER:

The terms of the contract resulting from this RFP will be determined by the project methodology proposed by the vendor, contract negotiations, and NHLC business needs.

QUESTION 5:

NextGen / Azure target architecture: Given NHLC’s existing investment in NextGen/D365 and Azure, will NHLC accept or prefer a solution that operates within the existing NextGen

Azure tenant/environment, with the vendor managing the e-commerce application, integrations, support, and enhancements?

ANSWER:

The RFP requires a vendor hosted solution in a GovRAMP certified environment. The solution will not be hosted in the NHLC’s NextGen environment.

QUESTION 6:

Please confirm whether the existing NextGen/D365 Azure environment is hosted in Azure

Commercial, Azure Government, or another Microsoft cloud environment.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 3 of 30

The NHLC’s NextGen ecosystem is hosted in both the Commercial and Government spaces at present. While the NHLC is a governmental agency, we have both tenants due to lack of feature parity between the GCC and Commercial tenants. Once feature parity exists, the NHLC will move entirely to the GCC tenant.

QUESTION 7:

Should the e-commerce solution be treated as: a) An extension of the existing NextGen environment, b) A separate application deployed within the same tenant/security boundary, or c) A separately hosted vendor environment integrated with NextGen?

ANSWER:

QUESTION 8:

Can existing NextGen infrastructure, Azure subscriptions, Entra ID, integration services, monitoring tools, and security controls be reused where technically appropriate?

ANSWER:

Maybe, depending on the specifics of the solution proposed. This will be determined during the gap analysis phase with the selected vendor.

QUESTION 9:

For the required Production, Stage, UAT, and Development environments, should vendors assume these environments will be created within NHLC’s existing NextGen tenant/subscription model or within a separate vendor-controlled environment?

ANSWER:

The testing environments for the proposed solution should be hosted in the vendor’s controlled environment. These environments will be integrated into the NHLC’s lower environments for complete end to end testing.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 4 of 30

QUESTION 10:

GovRAMP, Security, and Compliance: For Mandatory Requirement M2, “Hosting

Environment must be GovRAMP Authorized,” please clarify whether GovRAMP applies to a) The underlying cloud infrastructure, b) The application hosting environment, c)

The full application stack, d) The integration boundary, or e) The complete system authorization boundary.

ANSWER:

The GovRAMP requirements are required across the complete system authorization boundary.

QUESTION 11:

If the solution operates within NHLC’s NextGen environment, how should responsibilities for GovRAMP, NIST 800-171, PCI DSS, continuous monitoring, vulnerability management, and security evidence be divided among NHLC/DoIT, Microsoft, incumbent NextGen vendors, and the awarded vendor?

ANSWER:

QUESTION 12:

What specific continuous monitoring artifacts does NHLC expect, including dashboards, 3PAO assessments, vulnerability scans, penetration tests, audit reports, risk assessments, and remediation evidence?

ANSWER:

3PAO assessments are expected as part of the GovRAMP process. PCI-DSS has separate requirements. The State reserves the right to request and review all Third-

Party Assessment Organization (3PAO) audits, risk assessments, vulnerability assessments, and penetration tests of the contractor's environment. Additional details are provided in the RFP.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 5 of 30

QUESTION 13:

Are there existing State, DoIT, or NHLC Azure landing zone standards, network/security policies, logging requirements, key management standards, backup policies, or deployment patterns vendors must follow?

ANSWER:

Yes, these will be discussed with the Contracted Vendor during the gap analysis and design phases of the project.

QUESTION 14:

Pricing and Cost Treatment: If the solution is deployed into NHLC-owned Azure infrastructure, should Azure consumption, Microsoft licensing, storage, networking, monitoring, and security tooling be excluded from vendor pricing and shown separately as

NHLC-paid costs or planning assumptions?

ANSWER:

The RFP requires a vendor hosted solution in a GovRAMP certified Environment.

The solution will not be hosted in the NHLC’s NextGen environment.

QUESTION 15:

For monthly Operations and Support pricing, should vendors price only vendor-managed application operations and support when the infrastructure is owned or paid for by NHLC?

ANSWER:

The RFP requires a vendor hosted solution in a GovRAMP certified Environment.

The solution will not be hosted in the NHLC’s NextGen environment. All costs need to be part of the submitted proposals.

QUESTION 16:

May vendors include a separate, non-scored Total Cost of Ownership appendix showing estimated Azure consumption, Microsoft licensing, payment gateway costs, SMS/email costs, and third-party service costs?

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 6 of 30

All costs need to be part of the submitted proposals. That cost should encompass the NHLC’s total cost of ownership.

QUESTION 17:

Should vendors assume all travel and expenses for the required on-site Project

Manager are included in fully loaded pricing, or may recurring travel be itemized separately?

All costs need to be part of the submitted proposals.

QUESTION 18:

System of Record and Integrations: Please confirm that NextGen/D365 is the authoritative system of record for products, inventory, pricing, promotions, customer/licensee records, license status, orders, invoices, payments, fulfillment status, and reporting datasets unless otherwise specified.

ANSWER:

D365 is the system of record for products, inventory, pricing, promotions, customer/licensee records, license status, orders, invoices, payments, fulfillment status, and reporting datasets unless otherwise specified.

QUESTION 19:

Please provide available technical documentation for NextGen/D365 integrations, including Commerce APIs, OData endpoints, Azure Service Bus patterns, file interfaces, authentication methods, rate limits, retry logic, error handling, monitoring, and reconciliation processes.

ANSWER:

Technical Documentation will be provided to the selected Contracted Vendor during the gap analysis and design phases of the project.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 7 of 30

QUESTION 20:

Which existing integrations should be reused, extended, replaced, or retired as part of this modernization effort, including Global Payments/Cayan, Bank of

America/ACH, GiveX, DHL, Evoke/System Automation, product image/content providers, email services, and reporting tools?

All existing integrations should be considered needing replacement.

QUESTION 21:

Please define target synchronization expectations for inventory, pricing, promotions, orders, payments, invoices, allocations, product updates, and fulfillment status, including what NHLC considers: a) Real-time, b) Near real-time, c) Within 15 minutes, and d) Within one hour.

ANSWER:

Unless otherwise specified in the requirements, synchronization expectations are as close to real time as possible.

QUESTION 22:

Will NHLC provide access to non-production NextGen/D365 environments, representative data, integration endpoints, test payment/gift card environments, and third-party sandbox environments during design, development, testing, and UAT?

ANSWER:

Yes, the selected vendor will be provided access to the non-production environments to various systems needed to complete the design and development of the solution.

QUESTION 23:

Payments and PCI: Does NHLC prefer a hosted payment page, embedded iframe, tokenized payment flow, or another architecture designed to minimize cardholder-data exposure within the e-commerce solution?

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 8 of 30

The NHLC wants a solution that provides our customers with a seamless way to securely pay for merchandise and maintains PCI compliance for the lifetime of the contract and ensures the NHLC’s systems are out of scope for

PCI audits.

QUESTION 24:

Are integrations with Global Payments/Cayan, Bank of America/ACH, GiveX/stored value cards, and related payment services already established and reusable, or should vendors assume these integrations are part of implementation scope?

ANSWER:

Assume that the development of these integrations is part of the scope of the project.

QUESTION 25:

Please clarify whether the awarded vendor is responsible only for PCI compliance of its own application and services, or also for coordinating PCI evidence across payment processors, stored value providers, D365/NextGen, and other third-party service providers.

ANSWER:

The vendor is responsible for ensuring PCI compliance for only the applications and services, including any third-party tools, that are provided to the NHLC as part of the solution.

QUESTION 26:

Business Workflows and Functional Complexity: Which business workflows currently exist in D365/NextGen versus need to be built or extended within the e-commerce solution, including allocations, allowance offers, purchase price submissions, product submissions, image submissions, out- of-state transfers, invoice payments, and approval workflows?

All workflows will need to be built as part of the e-commerce solution.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 9 of 30

QUESTION 27:

Should workflows be configurable by NHLC business users, configurable by administrators, or implemented as fixed logic requiring enhancement work?

Workflows should be configurable by admins where possible.

QUESTION 28:

For allocations, should the solution reserve physical inventory in D365/NextGen, operate as a logical allocation layer within the e-commerce solution, or use a hybrid model?

ANSWER:

The solution needs to decrease the Broker’s visible inventory and increase the

Licensee’s visible inventory after allocation. The Licensee needs to be able to purchase the product. The NHLC is open to any solution that accomplishes accurate allocation, visibility and purchasing of product.

QUESTION 29:

Should pricing, promotions, discounts, coupons, promo cards, and licensee pricing logic be managed primarily in D365/NextGen, within the e-commerce solution, or through an orchestration/rules layer?

ANSWER:

D365 is the system of record for products, inventory, pricing, promotions, QUESTION 30:

Should the Order Fulfillment Tool extend existing Store Commerce/POS capabilities, integrate with them, or operate as a standalone application used by retail store staff on mobile devices and office computers?

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 10 of 30

The vendor should propose an order fulfillment tool that best meets the needs of the

NHLC based on the requirements laid out in the RFP. The tools that the retail teams use to access the application and how it is integrated into the overall solution is up to the vendor to decide.

QUESTION 31:

Allowance Offers: Kindly share the current business rules and criteria used to determine when an allowance offer is automatically approved versus when it requires manual NHLC

Staff review?

ANSWER:

An Allowance Offer requires manual approval if any of the following is true: there is a

NHLC funded Match, the Product Lifecycle State matches Full Close Out, or the offer date is less than one full promotion period in the future. These rules are subject to change.

QUESTION 32:

Out-of-State Transfer: For the Out-of-State Transfer process with DHL, could you clarify whether the integration should be real-time API-based or batch file-based? What is the expected frequency of data exchange?

ANSWER:

The process for DHL can be either real time API or batch file based. The frequency expected to send to DHL is within an hour after approval. The expected frequency of the information sent to D365 is as close to real time as possible once approved.

QUESTION 33:

Product Submission: Which third-party image provider does NHLC currently use for product images? What is the preferred integration method (API, SFTP, or other)?

ANSWER:

We currently work with Southern Glazer’s Wine & Spirits to provide URLs to their

Content Delivery Network for product images.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 11 of 30

QUESTION 34:

Allocations: When a broker creates an allocation for restricted products, how should this interact with D365 inventory? Should allocations create soft reservations, or should inventory remain available until the licensee places an order?

ANSWER:

The solution needs to decrease the Broker’s visible inventory and increase the

Licensee’s visible inventory after allocation. The Licensee needs to be able to purchase the product. The NHLC is open to any solution that accomplishes accurate allocation, visibility and purchasing of product.

QUESTION 35:

Broker Business Model: Can a single broker represent multiple vendors? If so, how is this relationship managed, and how does it affect product visibility and reporting?

ANSWER:

A Broker can and does represent multiple Vendors. Products have an associated

Broker and Vendor in D365. Brokers see all products they represent, regardless of vendor. Vendors only see their products.

QUESTION 36:

Broker Business Model: When a broker-vendor relationship ends, what happens to existing allocations and allowance offers that the broker submitted for that vendor's products?

ANSWER:

When a Broker-Vendor relationship ends, any future allowance offers are rejected out of the system. The new Broker agrees as part of the transfer to either match or better the already-submitted offers. The New Broker submits allowance offers for the Vendor’s products. How your solution handles the effect on allocations due to a change in the Broker-Vendor relationship should be part of your answer to the mandatory questions.

QUESTION 37:

Vendor Business Model: Do vendors have direct access to the portal, or do they exclusively

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 12 of 30 work through their authorized brokers? If direct access exists, what functions are available to vendors?

ANSWER:

Yes, Vendors have direct access to the portal. The requirements for vendors are listed in Appendix B of the RFP.

QUESTION 38:

Allowance Offers: After a broker submits an allowance offer, can it be edited? If so, at what stages (before approval, after approval, during active period)? What audit trail is required for changes?

ANSWER:

No, allowance offers cannot be edited after submission. The submitted allowance offers are either rejected by the NHLC or accepted.

QUESTION 39:

Pricing: When brokers view pricing information in the portal, can they see pricing across all channels (Agency, Off-Prem, On-Prem), or only for their represented products? Are there any restrictions on pricing visibility?

ANSWER:

Brokers can see pricing across all channels. However, they can only see pricing for items that they represent.

QUESTION 40:

General: Our Fit/Gap analysis currently includes items that involve connecting to external systems (e.g., DHL, Global Payments, D365 F&O). Would NHLC prefer we categorize these as 'Integration' rather than 'Customization' to better distinguish platform-agnostic requirements from NHLC-specific custom development?"

Please classify these connections as integration.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 13 of 30

QUESTION 41:

M15 PM on-site flexibility: Will the M15 on-site requirement allow the named role to vary by phase (designer during design, PM during integration, multiple staff for workshops)? Are there benefits to the PM being on-site and also at home base working live with the team?

Does the very near geographic distance make this easier to have flexibility?

ANSWER:

The project manager being on site is a requirement. The vendor can propose additional resources be on site during various phases in addition to the project manager.

QUESTION 42:

Azure Entra ID scope (Appendix F): Appendix F lists Azure Entra ID for Identity

Management. Does the scope cover NHLC staff only, or also vendor and consultant personnel requiring privileged access OR is this anticipated to extend to B2B licensee and partners?

ANSWER:

Azure Entra ID will be extended to the Vendor and Consultant personnel but not to

B2B licensees and partners.

QUESTION 43:

D365 NextGen interface ownership: For each integration endpoint between the e-commerce platform and D365 NextGen, please confirm if an existing NHLC vendor will manage the D365 side requests/requirements or if this is the new vendor's responsibility. If it is an existing vendor, is there an anticipated limit of hours or scope?

The NHLC will be responsible for managing the D365 side of the endpoints.

QUESTION 44:

Incumbent transition cooperation: What mechanisms will the Commission use to ensure incumbent cooperation on source code, configuration, infrastructure access, and

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 14 of 30 personnel knowledge transfer? Where the existing system is proprietary, what access is available to the core code base?

ANSWER:

If the submitted proposal includes using the proprietary source code, configuration, and infrastructure, an agreement will need to be in place between the Vendor submitting the proposal and Evenica Corp.

QUESTION 45:

Is FedRAMP Moderate acceptable instead of GovRAMP? Most major cloud hosting environments (Azure Gov, AWS GovCloud, etc.) carry FedRAMP authorization rather than

GovRAMP. FedRAMP is the federal version, generally considered as stringent or more stringent than GovRAMP.

ANSWER:

FedRAMP Authorized is acceptable, but not the FedRAMP 20x program. The application and everything within the system boundary – essentially, the shared configuration – need to be certified, not just the hosting platform.

QUESTION 46:

OFT remote-outlet on-site response: Will the new vendor be responsible for on-site OFT hardware installation and ongoing diagnostic and remediation at all NHLC's outlets across the state (where online ordering is offered), and if so, what response time is required?

The NHLC is responsible for the installation and maintenance of the OFT hardware.

QUESTION 47:

Limited Allocation engine and marketing integration: Will the allocation engine be expected to integrate with consumer marketing systems (SMS, email automation, customer profiles, waitlist/sweepstakes)?

Yes.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 15 of 30

QUESTION 48:

Multi-vendor incident coordination: When an incident may originate in a connected system

(Global Payments, DHL, D365 NextGen), what SLA and after-hours coverage do those vendors carry, and will teams be mutually accessible?

All three vendors have similar SLA’s and the teams will be mutually accessible.

QUESTION 49:

Is there a preference for local vendors?

No.

QUESTION 50:

What is the annual budget allocated for this RFP?

ANSWER:

There is no pre-approved budget, tentative budget range, or not-to-exceed budget for the project. Pricing should represent the vendor’s best price to meet the requirements and optional work laid out in the RFP.

QUESTION 51:

Work will be onsite or remote?

Portions of the work that is required to be completed onsite are listed in the RFP.

QUESTION 52:

Can vendor provide entire services from offshore location (outside US geography)?

ANSWER:

Vendor resources (Development Personnel) can be offshore services as long as they adhere to DoIT policy. Per DoIT Policy, Affiliates (or vendor staff) responsible for developing and supporting the system/product must be located within the United

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 16 of 30

States and its territories, Canada, or India. GovRAMP requires U.S.-only data residency. The specific cloud region should be selected with consideration for project cost, highest availability, lowest latency, and application performance for a customer base primarily in the northeastern US. Additional detail is specified in the

RFP.

QUESTION 53:

Who are previous incumbents on this project?

ANSWER:

Evenica Corp. provides the platform that powers the current NHLC e-commerce website.

QUESTION 54:

We kindly request a 1-2 week extension of the proposal submission deadline to ensure a thorough and high-quality response.

The deadline for submission of proposals to this RFP is July 17, 2026, at 2:00 p.m.

QUESTION 55:

What is the total budget for this contract?

ANSWER:

There is no pre-approved budget, tentative budget range, or not-to-exceed budget for the project. Pricing should represent the vendor’s best price to meet the requirements and optional work laid out in the RFP.

QUESTION 56:

Please confirm whether vendors may propose a solution that uses a third-party commerce platform plus custom components, or whether NHLC expects a single, unified commercial suite from one vendor.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 17 of 30

The vendor can propose whatever platform and components they believe best meets the needs of the NHLC as outlined in the RFP.

QUESTION 57:

Can NHLC clarify whether the platform must be: vendor-hosted, state-hosted (Azure), or flexible based on vendor approach?

ANSWER:

The RFP requires a vendor hosted solution in a GovRAMP certified Environment.

The solution will not be hosted in the NHLC’s NextGen environment.

QUESTION 58:

Can NHLC provide detail on the following (for both direct to consumer & licensee ordering):

order volumes (peak & average), concurrent users, SKU Counts/Catalog Size, pricing complexity (e.g., case vs. bottle pricing, dynamic pricing?

ANSWER:

Subsections 1.1 through 1.4 of Section 1 of the RFP provides context around the number of Licenses, Retail Outlets, items, and website volume statistics. The current SKU count is just over 35,000. Pricing varies based on the license type and the location the order is being purchased in.

QUESTION 59:

The RFP includes vendor-driven product pricing workflows — can NHLC clarify the expected frequency and volume of pricing updates by vendors/brokers?

ANSWER:

Cost is updated quarterly. Sales pricing is uploaded monthly. The NHLC works three months in the future to allow time for negotiations and price resubmissions as needed. Volume is usually around 2,000 codes per broker but needs to be able to handle a Broker’s entire portfolio which can span over 8,000 codes.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 18 of 30

QUESTION 60:

Please confirm whether optional / future capabilities (e.g., direct shipment, specialty sites, regional pricing, and multi-warehouse fulfillment) are evaluated only as future roadmap capabilities or are expected to be included in the proposed base implementation.

The expectation is that a labor rate will be provided for future development. The examples used are not expected to be quoted in the base implementation.

QUESTION 61:

Can NHLC confirm whether all required functionality must be delivered at go-live, or if phased delivery is acceptable?

ANSWER:

Please see Appendix B Table B-2.1 Mandatory Requirements and Table B-2.2 System

Requirements for a list of requirements that are expected as part of the base functionality implementation. The approach to go live (Several Phases or Integrations) will determine what requirements will be part of each phase in a phased approach. Enhancements are addressed in Appendix B Table B-2.5

Enhancement Phase Requirements

QUESTION 62:

Please clarify fulfillment models for both consumers and licensees (e.g., in-store/warehouse pickup only vs shipping).

ANSWER:

Licensees can purchase from the warehouse or a retail location. Warehouse orders can be picked up in person or shipped to the Licensee’s location by an approved carrier that the Licensee has a contract with. Licensee orders placed at a retail location must be picked up in person and cannot be shipped. Retail Customers can only order from our retail locations and must pick up at the retail location (In store or

Curbside), there is no option for shipping for Retail Customers.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 19 of 30

QUESTION 63:

What is the expected frequency of data synchronization between systems (real-time vs.

Batch), in addition to the existing requirement for inventory synchronization (15 minutes with a full true up nightly) from the RFP?

Unless otherwise specified in the requirements, synchronization expectations are as close to real time as possible.

QUESTION 64:

Can NHLC confirm DevOps ownership and environment responsibilities? Who sets up the environments and who is responsible for promoting to production?

ANSWER:

The NHLC has ownership of DevOps and can provide access to the selected vendor’s team. The vendor is responsible for all environment management including code promotion.

QUESTION 65:

How do you want NHLC to be perceived by customers and licensees in 3–5 years as a result of e‑commerce modernization (e.g., “fastest and easiest way to buy,” “destination for discovery and education,” “most responsible and transparent control state”)?

All of the above.

QUESTION 66:

When you talk about being a “nationally recognized” and “best‑in‑class” control state, which peers or private retailers do you benchmark against, and where do you feel you’re currently falling short digitally?

ANSWER:

We measure ourselves against all other control states and major retailers like Total

Wine and More. Like any great retailer we are constantly looking for ways to improve

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 20 of 30 our customers’ experiences and recognize that changes in technology provide new opportunities to provide a better omni channel experience for all our customers and business partners.

QUESTION 67:

What are the top 3–5 measurable outcomes you expect from e-commerce modernization

(e.g., online sales growth %, margin improvement, basket size, cross-border capture, staff productivity, or other operational metrics)?

Online sales growth, basket size, and improved user experience.

QUESTION 68:

Does the State of New Hampshire allow offshore / nearshore resources?

ANSWER:

Vendor resources (Development Personal) can be offshore services as long as they adhere to DoIT policy. DoIT policy states that Affiliates (or vendor staff) responsible for developing and supporting the system/product must be located within the

United States and its territories, Canada, or India. GovRAMP requires U.S.-only data residency. The specific cloud region should be selected with consideration for project cost, highest availability, lowest latency, and application performance for a customer base primarily in the northeastern US.

QUESTION 69:

Can NHLC provide data volume and scope details for migration (e.g., number of users, orders, SKUs, and years of historical data expected to be migrated)?

ANSWER:

Subsections 1.1 through 1.4 of Section 1 of the RFP provide context around the number of Licenses, Retail Outlets, items, and website volume statistics. While the exact timeframe for historical data to be migrated has not been determined yet, 18 months’ worth of data is being discussed as an option.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 21 of 30

QUESTION 70:

Can NHLC provide a high-level mapping of current NextGen/D365 components to major business capabilities and website functionality, including areas expected to be replaced, extended, or remain unchanged as part of this initiative?

ANSWER:

Technical Documentation will be provided to the selected Contracted Vendor during the gap analysis and design phases of the project. Assume that the development of all areas is part of the scope of the project.

QUESTION 71:

Can NHLC identify which requirements represent net-new capabilities versus capabilities currently supported by existing systems that require enhancement or modernization?

ANSWER:

All requirements listed in the RFP are current capabilities in our current system that may require enhancement or modernization. The net new capabilities will be addressed as part of the future enhancement scope of the RFP laid out in Table B-

2.5 Enhancement Phase Requirements.

QUESTION 72:

For each major transaction domain, which system is expected to be the authoritative system of record (ex. Products, Inventory, Pricing, Orders, Invoices, Customers, Payments, Fulfillment)?

ANSWER:

D365 is the system of record for products, inventory, pricing, promotions, QUESTION 73:

Beyond the integration requirements identified in the RFP, are there any architectural constraints, standards, or existing platform investments that vendors should consider when proposing their solution approach?

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 22 of 30

No.

QUESTION 74:

Which required workflows are currently handled in D365, current website custom code, manual process, spreadsheets, email, or third-party systems?

All workflows will need to be built as part of the e-commerce solution.

QUESTION 75:

Can NHLC provide available interface documentation for existing and expected integrations, including data entities exchanged, direction of data flow, frequency/latency expectations, authentication method, error-handling expectations, and responsible system owner for each integration?

ANSWER:

Technical Documentation will be provided to the selected Contracted Vendor during the gap analysis and design phases of the project.

QUESTION 76:

Beyond the requirements in the RFP, what documentation exists for workflows/processes expected to be handled by the commerce solution (E.g., vendor product submission, offer creation, etc.)?

ANSWER:

There are some Functional Design Documents and Technical Design

Documents to address a few of the workflows and processes but not for all.

Additionally, the NHLC is undergoing some business process revisions that might have an impact on how these workflows/processes will need to work with the new solution.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 23 of 30

QUESTION 77:

Do NHLC employee users require workflows & capabilities to directly access, view & edit orders on behalf of users (E.g., cancel an order)? Does this differ based on a consumer or licensee order?

ANSWER:

No. The NHLC does not access or edit orders. Canceling an order is handled in the

OFT or outside of the portal as part of the normal fulfillment process.

QUESTION 78:

Is measurement of user/customer behavior (E.g., clickstream data) required for any component of the experience? If so, please describe the expected scope regarding instrumentation and reporting to be delivered by the vendor.

ANSWER:

The NHLC uses limited user/customer behavior functionality on our current site.

Additional functionality is desired but will need to be developed as part of an enhancement phase of the project. Currently, we are using Hotjar to provide insight into the customers shopping behavior.

QUESTION 79:

Is the setup/development of customer messaging (E.g., order status emails/texts) in scope for the RFP or just the trigger development? If so, what is your current SMS & email automation platform?

ANSWER:

The development of customer messaging is in scope for this project. The current platform is a widely used cloud-based email delivery and management service that integrates with Azure. The specific platform will be shared with the contracted vendor.

QUESTION 80:

Please clarify where on the NHLC website bidders should expect to see responses to questions posted.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 24 of 30 https://gov.liquorandwineoutlets.com/notice/state-of-new-hampshire-liquor-commission-invitation-to-submit-proposal-for-e-commerce-modernization/

QUESTION 81:

Section 1.2(d) references “upgrades to software,” manufacturer warranties, versions, and related software maintenance concepts. Please confirm whether this requirement is intended to apply only to third-party commercial-off-the-shelf software, licensed products, or platform components included in the solution.

ANSWER:

The Contracted Vendor will be responsible for ensuring all software that is used as part of the solution is maintained per section 1.2(d) regardless of whether it is third-party commercial-off-the-shelf software, licensed products, or platform components included in the solution.

QUESTION 82:

Statement of Work Item K requests a 90-day post-acceptance warranty period. Please confirm whether the 90-day warranty period applies only to defects in deliverables accepted under the Statement of Work, and whether the warranty obligation is limited to correcting non-conformities against the mutually agreed acceptance criteria.

ANSWER:

Yes. The NHLC’s response assumes this inquiry is regarding RFP Appendix B, Section 1, 1.1(k) (page 27).

QUESTION 83:

Would the NHLC remove the provisions of Appendix G: Merchant Card Services of the RFP from the requirements for vendors?

No, the NHLC will not remove the provisions.

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 25 of 30

QUESTION 84:

Would the NHLC accept the following language in place of Provision 5.4: Contract

Price/Price Limitation/Payment of Form Number P-37 of the proposed contract in

Attachment 1?

“IN NO EVENT SHALL EITHER PARTY BE LIABLE HEREUNDER FOR ANY INCIDENTAL,

INDIRECT, SPECIAL, CONSEQUENTIAL, PUNITIVE OR EXEMPLARY DAMAGES, LOST

PROFITS, LOST SALES OR ANTICIPATED ORDERS, OR DAMAGES FOR LOSS OF DATA OR

GOODWILL, EVEN IF A PARTY WAS INFORMED OR KNEW OR SHOULD HAVE KNOWN OF

THE POSSIBILITY OF SUCH DAMAGES OR LOSS.

CONTRACTOR’S RESPECTIVE LIABILITY ARISING OUT OF THE SERVICES PERFORMED

UNDER EXHIBIT B, REGARDLESS OF THE DAMAGES THEORY, SHALL NOT EXCEED THE

FEES PAID AND PAYABLE PURSUANT TO EXHIBIT B.”

No, the NHLC will not accept the proposed language.

QUESTION 85:

Would the NHLC accept the following language in place of Provision 10.4: Property

Ownership/Disclosure of Form Number P-37 (see Exhibit A) of the proposed contract in

Attachment 1?

“Contractor retains ownership of its know-how, ideas, techniques, systems, models, templates, tools, generalized features of the structure, sequence and organization of software, user interfaces, screen designs and the like, and any enhancements made to the foregoing while performing Services (collectively, “Contractor Tools”). In consideration of the State’s payment of fees pursuant to this Agreement, Contractor hereby grants the State a worldwide, perpetual, fully paid, royalty-free, and non-exclusive right and license to use any Contractor Tool incorporated in and required for the State’s use of the work.”

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 26 of 30

QUESTION 86:

Would the NHLC accept the following language in place of Provision 13: Indemnification of

Form Number P-37 of the proposed contract in Attachment 1?

“The Contractor shall indemnify, defend, and hold harmless the State, its officers, and employees from and against all third-party actions, claims, damages, demands, judgments, fines, liabilities, losses, and other expenses, including, without limitation, reasonable attorneys’ fees, arising out of or relating to this Agreement directly or indirectly arising from death, personal injury, property damage, intellectual property infringement, or other claims asserted against the State, its officers, or employees caused by the acts or omissions of negligence, reckless or willful misconduct, or fraud by the Contractor, its employees, agents, or subcontractors. The State shall not be liable for any costs incurred by the Contractor arising under this paragraph 13.

Notwithstanding the foregoing, nothing herein contained shall be deemed to constitute a waiver of the State’s sovereign immunity, which immunity is hereby reserved to the State.

This covenant in paragraph 13 shall survive the termination of this Agreement.

The following terms have the following definitions: (i) “Claim” means a claim, suit or proceeding brought against an Indemnitee by a party that is not an Indemnitee; (ii)

“Indemnitor” means the Party required to indemnify an Indemnitee hereunder; (iii)

“Indemnitee” means a Party who is entitled to be indemnified under, including that Party’s officers, directors, employees, members, managers, agents, legal representatives, subsidiaries or affiliates; (iv) “Loss” means all losses, liabilities, settlements, damages, costs, fees and expenses of any type (including reasonable attorneys’ fees and costs) that is awarded to an Indemnitee by final judgment or agreed to by the Indemnitor in settlement of a Claim.

Should an element of the Work become, or is likely to become, the subject of a third party infringement or misappropriation claim, Contractor shall (i) procure for the State the right to continue using the same, or (ii) replace or modify it to make it non-infringing, provided that the replacement or modification matches or exceeds the performance and functionality of the original Work. In the event that Contractor shall reasonably determine

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 27 of 30 that neither (i) nor (ii) above is commercially reasonable, the State shall discontinue using the infringing Work and Contractor shall refund an equitable portion of the fees paid therefor.

Contractor shall have no indemnity obligation or other liability for any Claim arising from: (i) design, specification, instruction, software, system, framework, data, or material provided by or on behalf of the State, (ii) use of the Work other than in the manner contemplated by this Agreement, or continued use of the Work after Contractor has provided the non-infringing alternative, or (iii) any changes to or any combination of the Work with other material not made, provided or expressly authorized by Contractor.

An Indemnitee hereunder shall: (i) give the Indemnitor prompt written notice of the Claim,

(ii) tender to the Indemnitor control of the defense and settlement of the Claim, and (iii) reasonably cooperate with the Indemnitor in defending or settling such Claim. Subject to the foregoing, the Indemnitee shall have the right to participate at its own expense in any

Claim using counsel of its own choice. The Indemnitor may not consent to the entry of any judgment or enter into any settlement that adversely affects the rights or interests of the

Indemnitee without such Party’s prior written consent, which may not be unreasonably withheld or delayed, provided that consent shall not be required if such judgment or settlement provides for the unconditional and full release of the Indemnitee in respect of such Claim and does not diminish any of the Indemnitee’s rights under this Agreement or result in additional fees or charges to the Indemnitor.”

QUESTION 87:

Would the NHLC remove the provisions of Provision 1.4: Conditional and Unconditional

Acceptance of proposed Exhibit B within Attachment 1?

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 28 of 30

QUESTION 88:

Would the NHLC remove the provisions of Provision 7.2: System Support of proposed

Exhibit B within Attachment 1?

QUESTION 89:

Would the NHLC accept the following language in place of Provision 7.4: Contract

Warranties and Representations of proposed Exhibit B within Attachment 1?

“Software. The Contractor warrants that, for a period of thirty (30) days following

Acceptance of the applicable Software and/or Services (“Warranty Period”), any Software provided as part of this Agreement, including but not limited to the individual modules or functions furnished under the Contract, will be properly functioning within the System, compliant with the requirements of the Contract, and will operate in accordance with the

Specifications and terms of the Contract.

For any breach of the above Software warranty reported by the State during the Warranty

Period, in addition to all its other remedies at law and in equity, at the State’s option the

Contractor shall:

a. provide the correction of program errors that cause breach of the warranty, or if

Contractor cannot substantially correct such breach in a commercially reasonable manner, the State may end its program license, if any, and recover the fees paid to

Contractor for the program license and any unused, prepaid technical support fees the

State has paid for the program license; or

b. re-perform the deficient Services; or

c. if Contractor cannot substantially correct a breach in a commercially reasonable manner, the State may end the relevant Services and recover the fees paid to Contractor for the deficient Services.

Except as expressly set forth above, Contractor shall have no warranty obligations with respect to the Software or Services after expiration of the Warranty Period.”

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 29 of 30

QUESTION 90:

Would the NHLC accept the following language in place of Provision 7.4: Contract

Warranties and Representations of proposed Exhibit B within Attachment 1?

“Compatibility. Contractor warrants that, for a period of thirty (30) days following

Acceptance of the applicable System component (“Component Warranty Period”), the

System components provided by Contractor under this Agreement, including any replacement or upgraded Software components provided by Contractor to correct

Deficiencies or as an Enhancement, will operate with the rest of the System, as configured by Contractor, without any material reduction in the functionality of the System as described in the Specifications.

This warranty does not apply to issues caused by (a) modifications, configurations, or integrations made by the State or third parties; (b) use of the System in a manner not in accordance with the Specifications; or (c) changes to third-party systems, software, or infrastructure outside Contractor’s control.”

QUESTION 91:

Would the NHLC remove the provisions of Provision 7.4: Contract Warranties and

Representations of proposed Exhibit B within Attachment 1?

QUESTION 92:

Would the NHLC remove the provisions of Provision 9: Software Agreement of proposed

Exhibit B within Attachment 1?

SECOND SET OF INQUIRIES & RESPONSES TO RFP 2026-06 - E-COMMERCE MODERNIZATION Page 30 of 30

QUESTION 93:

Would the NHLC remove the provisions of Provision 12: Merchant Card Services of proposed Exhibit B within Attachment 1?