ADDENDUM 3 DCBS Learning Management System for S-DASOBO-00012614 _Final.pdf

Addendum No. 3

12/3/2025 Page 1 of 3

OREGONBUYS BID NUMBER: S-DASOBO-00012614

DCBS Learning Management System (“LMS”)

ADDENDUM 3

DECEMBER 3, 2025

SECTION 1: PURPOSE

The purpose of this addendum is to release the State’s responses to questions submitted by the Q&A deadline in the Addendum 2 and to extend the due date for the “Security Compliance Verification Plan”.

The addendum includes the following:

1. State’s Responses to Questions

2. Round 2 – Security Compliance Verification Plan submission Date Extension

1. Release of State's Responses to Question.

QUESTIONS AND ANSWERS

Question #: Question: Agency Response:

1 Since this week is a holiday and several team members will be out for Thanksgiving, we’d like to make sure we have enough time to respond thoroughly. Would it be possible to extend the deadline?

Prospective Proposers have until 3:00 PM Pacific Time on December 19, 2025 to submit their security compliance verification plan by sending via email to the Single Point-of-Contact

(SPC).

2 We understand that a copy of our SOC 2 report is required for Round

2. Blackboard is hosted on AWS, and clients can request the SOC 2 report under an NDA directly with Amazon, as outlined here:

https://aws.amazon.com/artifact/g etting-started/. AWS requires institutions to submit these requests themselves; they cannot be made on behalf of an organization. Could Oregon DCBS confirm that they are willing to request our SOC 2 report from

AWS?

As outlined in Section 2.4 of the RFP the SOC 2 Type 2 report is for both the hosting environment and the LMS software.

If the proposers have FedRAMP, StateRAMP, or GovRAMP instead of SOC 2 Type 2, the same reports would also apply to those as well.

If the Agency is required to request a SOC 2 Type 2 report from a proposer’s hosting vendor, the proposer must provide specific details to enable the Agency to ask for and receive the hosting vendor SOC 2 report for their solution.

The details may include but not be limited to;

hosting vendor name, contact information (email address, phone number, etc.) of the hosting vendor, and any details to assist DCBS in requesting and receiving the SOC 2 report. In addition, the proposers will need to provide the SOC 2 report for their LMS solution.

*Reminder: The Agency is not simply asking for the hosting vendor and LMS solution SOC 2 reports (or FedRAMP, StateRAMP, or GovRAMP reports), we are also asking that proposers provide a Security Compliance Verification plan. In the plan, please describe how the proposed solution will meet and continue to meet the required security deliverables, including:

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Faws.amazon.com%2Fartifact%2Fgetting-started%2F&data=05%7C02%7CJulie.A.Curry%40das.oregon.gov%7C9918e6eb85bd4f979d3208de2c5e3fb5%7Caa3f6932fa7c47b4a0cea598cad161cf%7C0%7C0%7C638996980486904413%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=xHw1%2BWNJNP%2F5pe8FVDUybAOyIxVzOSN%2FCPfm7kbkAD0%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Faws.amazon.com%2Fartifact%2Fgetting-started%2F&data=05%7C02%7CJulie.A.Curry%40das.oregon.gov%7C9918e6eb85bd4f979d3208de2c5e3fb5%7Caa3f6932fa7c47b4a0cea598cad161cf%7C0%7C0%7C638996980486904413%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=xHw1%2BWNJNP%2F5pe8FVDUybAOyIxVzOSN%2FCPfm7kbkAD0%3D&reserved=0

12/3/2025 Page 2 of 3

Question #: Question: Agency Response:

• Safeguarding Level 2 data. As defined by State of Oregon, Department of Administrative Services (DAS), Information Asset Classification Policy 107.004.050.

http://www.oregon.gov/das/Policies/107- 004-050.pdf

• Completing required penetration testing with remediation prior to go-live

• Providing annual penetration tests and SOC 2 Type 2 assessment results to the Agency

• Meeting the State of Oregon Statewide Security Standards (State of Oregon Information Security requirements ) outlined in Section 3.2.1.8 of the RFP

Proposers can certainly reference that their LMS solution and hosting environment are SOC 2 Type 2 or FedRAMP, StateRAMP, or GovRAMP.

3 To ensure we’re adequately prepared for the upcoming demonstration, could you share the anticipated date? Additionally, is there a demo script or any specific guidance on what we should prepare?

Demonstrations are scheduled to take place in January 2026. A list of demo content and related questions will be posted in OregonBuys as Addendum 4, once proposers have been confirmed to have successfully passed the Security Compliance Verification Plan.

4 Will DCBS accept GovRAMP Authorization in lieu of responses to the State of Oregon Statewide Security Standards (State of Oregon Information Security requirements ) outlined in Section 3.2.1.8 of the RFP? (Blackboard GovRAMP Authorization:

https://govramp.org/product-list/)

The State will accept GovRAMP. Proposers must include the current status of such authorization.

5 Does OR have reciprocity with any other State security authorizations (ie: TX-RAMP, AZ-RAMP) and would DCBS accept in lieu of responses to the State of Oregon Statewide Security Standards (State of Oregon Information Security requirements) outlined in Section 3.2.1.8 of the

RFP?

No. These are not acceptable in lieu of responses to State of Oregon Statewide Security Standards.

6 For the “providing annual penetration tests and SOC 2 Type 2 assessment results to the Agency.” – Does the Agency just need our approach to providing this outlined in our response or do you need access to the annual penetration tests + SOC 2 Type 2 assessment results at the time of our submission?

Provide your approach and plan for how these will be completed annually, and how the results of the penetration tests and SOC 2 Type 2 assessment results will be provided to the Agency annually. Providing the most current results of both with your Security Compliance Verification Plan is preferred.

7 Is there any format you require for our Security Compliance Verification Plan? Or can we leverage any materials/links/response format as

No, there is no required format. Agency expects that each Proposer will provide an electronic copy of the Security Compliance Verification Plan, and not a link to it. Proposer may use any http://www.oregon.gov/das/Policies/107-004-050.pdf http://www.oregon.gov/das/Policies/107-004-050.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgovramp.org%2Fproduct-list%2F&data=05%7C02%7CJulie.A.Curry%40das.oregon.gov%7C8efd8aaa19974d016db208de2c5f15f4%7Caa3f6932fa7c47b4a0cea598cad161cf%7C0%7C0%7C638996984065095811%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=aE3qZeNQC3WT7YL1H32RWHB0OccXVznIj2T%2Fxud2j64%3D&reserved=0

12/3/2025 Page 3 of 3

Question #: Question: Agency Response:

needed as long as it addresses the below?

other Materials or links in the document as long as it describes your approach and plan for meeting each of the below:

• Safeguarding Level 2 data. As defined by

State of Oregon, Department of Administrative Services (DAS), Information Asset Classification Policy 107.004.050.

http://www.oregon.gov/das/Policies/107- 004-050.pdf

• Completing required penetration testing with remediation prior to go-live

• Providing annual penetration tests and SOC 2 Type 2 assessment results to the Agency

• Meeting the State of Oregon Statewide Security Standards (State of Oregon Information Security requirements ) outlined in Section 3.2.1.8 of the RFP

8 This includes the proposers approach to safeguarding Level 2 data, meeting the State of Oregon Statewide Security Standards (State of Oregon Information Security requirements) outlined in Section

3.2.1.8 of the RFP, completing required penetration testing with remediation prior to go-live, and providing annual penetration tests and SOC 2 Type 2 assessment results to the Agency.

In the Addendum Section 3.2.1.8 is referenced, but this looks like the “Experience Questionnaire” section

– can you please confirm what section we should be referring to?

Proposer shall complete and submit the Experience Questionnaire - Attachment I the State of Oregon Information Security requirements that was outlined in Section

3.2.1.8 of the RFP.

2. Extension of Security Compliance Verification Plan (Due Date for submissions).

Prospective Proposers have until 3:00 PM Pacific Time on December 19, 2025 December 8, 2025 to submit their security compliance verification plan by sending via email to the Single Point-of-Contact (SPC) listed below.

The Single Point-of-Contact (SPC) for the procurement remains:

Julie Curry State Procurement Analyst julie.a.curry@das.oregon.gov

(971) 446-8169

Prospective Proposers have until December 10, 2025 by 3:00 PM PT to submit written concerns or questions via email only to the SPC regarding the content in Addendum 3 to the RFP.

http://www.oregon.gov/das/Policies/107-004-050.pdf http://www.oregon.gov/das/Policies/107-004-050.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf mailto:julie.a.curry@das.oregon.gov

SECTION 1: PURPOSE