Addendum #4-Questions and Answers.pdf

Page 1 | Pre-Qualified Providers of IT Goods & Services Request for Proposals

For Pre-Qualified Providers of Information Technology

Goods and Services

Addendum #4

QUESTION AND ANSWER

The following is a list of responses to questions submitted by prospective respondents to the RFP for Pre- Qualified Providers of Information Technology Goods and Services, available here:

https://esd.ny.gov/doing-business-ny/requests-proposals/pre-qualified-providers-information-technology-goods-and

No. Question Answer

Information Technology

Will vendors be categorized by specific service offerings (e.g., Data Analytics, Business Analysis, Application Development, Data Migration, Project

Management), or will all pre-qualified firms be considered equally for future engagements?

Firms will be qualifed under the catorgories they respond to in the RFP.

Will ESD permit vendors to perform consulting, data analytics, business analysis, software development, reporting, and project management services remotely when appropriate?

Work can be remote. Offshore is not permitted. All work needs to be done within North America.

Will ESD permit vendors to perform consulting, data analytics, business analysis, software development, reporting, and project management services offshore when appropriate?

Offshore is not permitted. All work needs to be done within North America.

Is it expected that respondents demonstrate capabilities across all technology categories listed in the Scope of

Work, or may respondents focus on their areas of specialization?

Vendor can submit for only one area or for as many as the vendor is qualified for.

Will ESD consider expertise in AI-assisted software development, business intelligence, automation, and advanced analytics when evaluating respondents for future engagements?

Yes

May respondents submit references that demonstrate successful delivery across multiple technology disciplines, even if the engagements differ in size and industry?

Yes https://esd.ny.gov/doing-business-ny/requests-proposals/pre-qualified-providers-information-technology-goods-and https://esd.ny.gov/doing-business-ny/requests-proposals/pre-qualified-providers-information-technology-goods-and

Page 2 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

Will ESD anticipate future work involving data migration, data governance, reporting modernization, dashboard development, ETL documentation, business intelligence, and data quality initiatives?

Yes

Will future work orders include modernization of legacy applications, migration of desktop applications to web-based platforms, and workflow automation initiatives?

Yes

May respondents demonstrate proprietary software platforms and internally developed applications as evidence of technical capability, even when those applications are not commercial off-the-shelf products?

Yes

For future task orders, will ESD encourage teaming arrangements between pre-qualified vendors possessing complementary capabilities?

This is up to the vendor

May respondents identify multiple service specialties within a single proposal to maximize consideration for future task orders?

Yes

Since the purpose of this procurement is to establish a pool of qualified technology providers, will ESD maintain a searchable capability matrix identifying each pre-qualified vendor's areas of expertise so that future project managers can efficiently identify firms with specialized capabilities such as business process analysis, data migration, analytics, cloud modernization, and application development?

ESD will establishe a list of providers. The firms will be qualifed under the catorgories they respond to in the RFP.

Can ESD provide guidance regarding the anticipated mix of onsite, hybrid, and remote work for future assignments?

Work can be remote. Offshore is not permitted. All work needs to be done within North America.

The RFP requests certification of products mentioned in the Scope of Work. Could ESD clarify whether this refers to manufacturer authorizations, reseller certifications, partner certifications, or simply identifying the products and technologies that the respondent supports?

This refers to all the above

To confirm, will a Respondent's overall scoring on the

Technical Approach (30 points) or Experience (30 points) categories be negatively impacted or penalized if they choose to state "no response is being provided" for non-core capabilities, such as Oracle PeopleSoft

Financials , hardware procurement , or HVAC services?

No

Page 3 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

Given the extensive breadth of Scope of Work items (a through r, plus items 1 and 2), is there a minimum number or minimum category of scope items a

Respondent must affirmatively address in order for its proposal to be deemed responsive and eligible for pre-qualification?

Alternatively, is a Respondent that addresses only two or three scope categories—with "no response" provided for all others—considered equally eligible for pre-qualification in those addressed categories?

Vendor can submit for only one area or for as many as the vendor is qualified for.

For software consulting, application development, and cloud infrastructure scope items (Scope Items 2, 3e, 3f, 3g), will ESD require contracted personnel to be physically present on-site at ESD offices in New York, or will fully remote and/or near-shore delivery models be acceptable for the execution of individual work orders? If on-site presence is required for certain categories, please clarify which specific scope items mandate it.

Are the specific staff members named and credentialed in the proposal binding commitments for the duration of the panel contract, or may equivalent personnel with comparable qualifications be substituted when individual work orders are issued? If substitution is permitted, is prior written approval from ESD required, and what documentation must be submitted to evidence equivalency?

Vendors can supply a summary of profiles if availabe but not require.

Can a respondent submit qualifications for only the specific Scope of Work categories in which it has expertise, or is it mandatory to respond to all service categories identified in the RFP?

Vendor can submit for only one area or for as many as the vendor is qualified for.

For future engagements under this pre-qualified contract, does ESD anticipate services to be performed onsite, remotely, or through a hybrid delivery model?

Additionally, are offshore resources permitted for applicable services, provided all security, confidentiality, and contractual requirements are met?

Without disclosing procurement-sensitive information, are there any anticipated major technology initiatives or strategic modernization efforts planned during the term of this pre-qualified contract that respondents should consider when describing their capabilities?

We cannot anticipate expected projects at this time.

Does ESD require resumes for proposed personnel as part of the pre-qualification proposal? If so, should respondents submit complete resumes or summary profiles of representative resources?

Vendor can supply a summary of profiles if availabe but not required.

Page 4 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

May pre-qualified vendors establish new teaming arrangements or engage additional subcontractors after award of the pre-qualified contract when responding to future task orders, provided all contractual requirements are satisfied?

Yes. Offshore is not permitted. All work needs to be done within North America.

Section V (Required Proposal Contents), Part B.1, p. 5

– Please confirm that Respondents electing not to propose on certain Scope of Work items (marked "no response provided") will not be penalized in the scoring of the items they do pursue, and that evaluation occurs on a per-category basis rather than across the full scope.

Vendor can submit for only one area or for as many as the vendor is qualified for.

Section IV (Scope of Work), Item 2, p. 3 – Would

AI/ML solution development and integration services

(e.g., AI assistants, document intelligence, workflow automation built on Azure or AWS) be considered within scope under Item 2 or Item 3(g), or should

Respondents address these capabilities elsewhere?

Item 3g.

Section V, Part A.4, p. 5 – Regarding "Certification of all products mentioned in the Scope of Work," can ESD clarify what is meant by certification? Does this refer to vendor partnership certifications (e.g., Microsoft

Solutions Partner, AWS Partner tier) held by the

Respondent, and is it required only for the scope items the Respondent addresses?

Any of the above.

The Scope of Work includes a wide range of IT goods and services. Could you please clarify whether vendors are expected to provide all listed services, or if it's acceptable to propose only those that align with our company's expertise?

Vendor can submit for only one area or for as many as the vendor is qualified for.

May respondents qualify for only selected scope areas, or is ESD expecting capability across all categories in the revised scope?

Vendor can submit for only one area or for as many as the vendor is qualified for.

Does ESD anticipate future task orders involving identity verification, fraud prevention, applicant verification, employment verification, or income verification services under this vehicle?

We cannot anticipate expected projects at this time.

Can ESD provide examples of anticipated use cases for the newly added Artificial Intelligence, Intelligent

Automation, and Microsoft Copilot service categories?

We cannot anticipate expected projects at this time.

Can vendors respond only to the service categories in which they have expertise, or is experience expected across all listed categories?

Vendor can submit for only one area or for as many as the vendor is qualified for.

May commercial/private-sector references be used, or does ESD prefer government references?

Commerical/private is accepted.

Is there a preferred project size or timeframe for the three required references?

Page 5 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

What documentation is required to demonstrate certification for products and technologies referenced in the Scope of Work?

Any certifications held by vendor for products and services mentioned

Will partner certifications (e.g., Microsoft, Oracle, AWS, VMware) satisfy this requirement?

Any certifications held by vendor for products and services mentioned

Does ESD anticipate issuing AI-focused work orders during the initial contract period?

We cannot anticipate expected projects at this time.

Who are the current providers and where can we find their rates?

N/A

Can ESD confirm that a firm that has deep experience performing consulting services, project execution and assurance support for PeopleSoft Financials 9.2 or newer, including procurement/sourcing support services, as well as Independent Verification &

Validation (IV&V) services would be considered as a relevant bidder for this RFP?

Yes

Can respondents qualify for only specific areas of the

Scope of Work, or is ESD seeking providers capable of delivering all technology categories identified in the

RFP and Addendum #1?

Vendor can submit for only one area or for as many as the vendor is qualified for.

Will ESD maintain category-specific pre-qualified vendor pools, such as networking, cybersecurity, cloud, or application development, or will all approved vendors be placed into a single statewide pool?

Firms will be qualifed under the catorgories they respond to in the RFP.

Does ESD intend for distributors, value-added resellers, and procurement-focused firms to participate independently, or does ESD expect such firms to partner with service integrators for qualification?

Either

Can a respondent leverage manufacturer certifications, partner designations, and subcontractor relationships to demonstrate capabilities in areas where direct delivery resources may not exist?

Yes

Will ESD evaluate supply-chain capabilities, fulfillment capacity, inventory management, and procurement expertise separately from consulting and implementation services?

Yes.

Following vendor qualification, will individual project opportunities require additional competitive bidding among the pre-qualified vendors?

ESD will release mini-bids as needed.

Will future opportunities be awarded based on best value, lowest cost, technical qualifications, or another evaluation methodology?

ESD will release mini-bids as needed.

Page 6 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

Are joint ventures, teaming arrangements, and subcontractor relationships permitted after qualification, or must all partners be identified during the qualification process?

It can be done after. Offshore is not permitted. All

Will respondents be evaluated only on technologies and services they propose to provide, or against the full scope of technologies listed in the RFP?

Vendor can submit for only one area or for as many as the vendor is qualified for.

Several scope items conclude with the phrase "and procurement of all related hardware and software." Our company primarily provides software development, system integration, hosting (through third-party cloud providers), and related IT professional services. Can vendors respond only for the professional services portion of these scope items, or is the ability to procure related hardware and software a mandatory requirement for qualification?

Vendor can submit for only one area or for as many as the vendor is qualified for.

The RFP indicates that vendors may respond only to the scope areas for which they seek consideration. If a vendor provides only a subset of services within a particular scope item (for example, Cybersecurity

Audits and Security Program Management under Item

3(b), without covering all items listed under that scope item), may the vendor describe only those applicable capabilities, or is experience across the complete scope item expected?

Vendor can submit for only one area or for as many as the vendor is qualified for.

Will ESD establish a single pre-qualified vendor pool for all technology categories, or will separate panels be maintained by service area?

Firms will be qualifed under the catorgories they respond to in the RFP.

May respondents propose qualifications for selected

Scope of Work categories only, or are vendors expected to demonstrate capabilities across all listed goods and services?

Vendor can submit for only one area or for as many as the vendor is qualified for.

If respondents qualify for only certain Scope of Work categories, will they be eligible to receive task orders limited to those categories?

Vendor can submit for only one area or for as many as the vendor is qualified for.

Are there any major technology initiatives or anticipated projects that ESD expects to procure shortly after the panel is established?

We cannot anticipate expected projects at this time.

Can ESD provide guidance regarding the expected work model for future engagements (onsite, hybrid, or fully remote)?

If onsite support is required, what are the anticipated work locations (e.g., Albany, New York City, Buffalo, or other ESD offices)?

Work can be remote. Offshore is not permitted. All work needs to be done within North America. The exact location will be determined at the time of the request.

Page 7 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

Should respondents anticipate requirements for after-hours support, weekend work, scheduled maintenance windows, or on-call support for certain task orders?

Yes

Will resumes or named personnel be required with this proposal, or only when responding to future task orders?

Vendor can supply a summary of profiles if availabe but not required.

Is the agency open to a hybrid delivery model utilizing a combination of onshore and offshore resources?

Work can be remote. Offshore is not permitted. All work needs to be done within North America. The exact location will be determined at the time of the request.

Will the work be performed onsite, remotely, or through a hybrid arrangement?

Work can be remote. Offshore is not permitted. All work needs to be done within North America. The exact location will be determined at the time of the request.

Are there any challenges, gaps, or pain points with the current solution or contractor that the agency is looking to address through this procurement?

We cannot anticipate expected projects at this time.

Is it mandatory to provide certifications? If we do not have them, is that a reason for disqualification? RFP

Reference: Required Proposal Contents, §A

“Respondent Information,” item 4 (p. 6) and §B

“Technical Proposal,” item 6 (p. 7); and §VI “Selection

Criteria” – Experience (30 pts) and Staffing Plan (15 pts) (p. 8).

No, it is not mandatory. You can provide it if available.

Certification of products (Required Proposal Contents, §A.4, p. 6): Does ESD accept OEM/partner certifications (e.g., AWS Consulting Partner, Microsoft, Drupal) as “certification,” and is it required only for the items being bid? RFP Reference: Required Proposal

Contents, §A “Respondent Information,” item 4 (p. 6).

(Note: this item appears in the Required Proposal

Contents block, not §VII.A.4.) See also §B “Technical

Proposal,” item 1, regarding a “no response” notation for items not sought (p. 6).

Either but provide if available.

What credentials are required for key personnel? Do we need to provide certifications for our key personnel?

RFP Reference: §VI “Selection Criteria” – Staffing

Plan (15 pts) (p. 8); Required Proposal Contents, §B

“Technical Proposal,” item 6 (p. 7); §VII.i “Technical

Proposal,” item D “Staff Experience and

Qualifications” (p. 9); and §IX “General Provisions” –

“Contractor Staff” (pp. 12–13).

Vendor can supply a summary of profiles if availabe but not required.

General question - Is the intent of the contract to have the selected vendors provide products or services throughout the entire state or would they have the ability to provide products and services in particular regions?

Products will be for ESD inititivatives throughout NY

State.

Page 8 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

It is understood that this is a framework deal(Human

Resource outsources) and scope is limited to deliver headcount. Manages services is not part of this RFP.

Please confirm if this is the correct assumption.

Managed services can be part of the RFP.

Resources can operate from offshore location like India.

Please confirm.

Offshore is not permitted. All work needs to be done within North America.

Number of Servers, Storage, Backup and Network -provide DC wise breakup and platform wise breakup N/A

177 List out all operating systems running in environment N/A

Number of end users supported through existing Data

Center N/A

It is assumed that support required in English language only. Please confirm.

Yes

Please provide make and model of each storage asset including SAN/NAS distribution N/A

Which software you are using for managing the Storage and Switches?

N/A

Pls share backup environment detail like make, model

& software detail.

N/A

List out databases running on the servers along with size and clusters details if applicable ( Active - Active /

Active - Passive) N/A

184 What are the tools used to manage the databases? N/A

185 Which replication technologies are used currently? N/A

Provide a list of all relevant tools, duly customized and implemented in the existing IT environment N/A

Please share the number of datacenters with location detals in scope N/A

Please specify the virtualization technology which is currently being used N/A

Please state the existing virtualization percentage in the production and non production environments N/A

How many virtual machines on an average have been deployed per physical host?

N/A

Is the primary usage of this contract intended to be for

ESD internal use or to provide services to businesses investing in New York (ESD clientele)?

Both

Scope of Services: Can respondents be selected for specific service categories within the Scope of Work, or is preference given to firms that respond to multiple categories?

Page 9 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

Utilization of Services: Which areas within the Scope of Work are most frequently utilized by ESD today

(e.g., staff augmentation, cloud services, cybersecurity, infrastructure)?

All of the above

Staffing vs. Project-Based Work: Does ESD anticipate using this contract primarily for staff augmentation

(time & materials resources) or for project-based / managed service engagements?

Both

Staffing Model Preferences: Does ESD have a preferred delivery model (e.g., dedicated long-term staffing, on-demand augmentation, or hybrid models)?

No

Onsite vs Remote Work: What is the expected split between onsite work in New York and remote delivery for contracted services?

Work can be remote. Offshore is not permitted. All work needs to be done within North America.

Innovation and Differentiation: How does ESD evaluate innovative approaches or emerging technologies within responses to this prequalification?

ESD will release mini-bids as needed. Proposals will then be reviewed and evaluated based on criteria set-forth in mini-bids.

On System Interoperability (Section IV, Item 1):

Regarding support for Oracle PeopleSoft, how does

ESD envision managing the integration of this legacy

ERP with modern cloud-native service layers? We are interested in whether ESD intends to utilize middleware or API-first approaches to harmonize these disparate data ecosystems.

On Performance Metrics (Section IX): To ensure transparency and audit readiness, is ESD looking for pre-qualified firms to implement standardized real-time reporting dashboards for all deliverables, or does ESD prefer a more traditional milestone-based project management cadence?

On Operational Objectives (Section I): As ESD looks to create economies of scale, are there specific operational bottlenecks—such as manual data entry or non-compliant vendor processes—that the Corporation is prioritizing for automation under this new panel?

Understanding these primary pain points would allow us to better align our technical approach with ESD’s highest-priority efficiency objectives.

Regarding the “Required Proposal Contents” section, A.

Respondent Information on page 7, question 4 requests, “certification of all products mentioned in the Scope of

Work”. Can you please clarify what type of certification you are looking for?

services mentioned.

Page 10 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

Regarding Microsoft/Azure, several scope items reference Microsoft licensing and procurement of related software (O365, Dynamics/Power Apps, Azure

Data Services, Copilot). Please confirm whether

Microsoft and Azure licensing currently procured under existing NYS OGS centralized contracts will continue through those vehicles?

Lisences are procured by ESD through OGS for these specific technologies.

Regarding Network Infrastructure, does "monitoring" contemplate ongoing managed network monitoring services (NOC), or configuration of monitoring tools

ESD operates itself?

Both

Regarding Server/Storage/Backup, what is ESD’s current environment mix—on prem datacenter, Azure, hybrid? Is there an active cloud migration initiative this panel is expected to support?

N/A

Regarding Server/Storage/Backup, is backup/DR management in scope (ongoing administration, testing) or implementation only?

Backup/DR is in scope.

Regarding Endpoint and Helpdesk, does “Helpdesk” contemplate outsourced/co-managed helpdesk services with defined SLAs, or staff augmentation supplementing ESD’s internal service desk?

Both

Regarding AI, is ESD’s preference for solutions within its existing Microsoft tenancy (Copilot, Azure Open

AI)?

ESD currently uses the items listed in the RFP.

Will vendors be evaluated and selected by individual service category, or will selection be based on the entire scope of work?

Are resumes of proposed personnel required as part of the initial pre-qualification proposal, or will key personnel be requested only when responding to future task orders?

Vendor can supply a summary of profiles if availabe but not required.

Will offshore or hybrid delivery models be acceptable, provided project requirements are met?

Work can be remote. Offshore is not permitted. All work needs to be done within North America.

Is there a minimum staffing level required to qualify for the vendor pool?

No

RFP Section: Section V, A. Respondent Information

(page 5): "Certification of all products mentioned in the

Scope of Work” Question: What does certification mean in this context? Is it individual staff certification or attestation of hands-on experience.

services mentioned.

Page 11 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

RFP Section: Section VII.i Technical Proposal (page 8):

"D:Staff Experience and Qualifications: Question:

Should this be a narrative summary of the firm's staff qualifications and roles, or should we include individual resumes or CVs for each specific staff member proposed to work under the contract?

Vendor can supply a summary of profiles if availabe but not required.

Section II, Overview, Page 2 ESD is soliciting proposals from qualified contractors to provide consulting services/purchasing options for technical projects. From among the Proposals received, ESD intends to select a list of qualified firms to perform consulting services related to the ESD’s Information

Systems infrastructure (both hardware and software systems). The anticipated duration of the list is three (3) years with an option to extend for up to one (1) year, at which point ESD anticipates that it will issue a new solicitation for pre-qualified firms. Can ESD clarify if there is a limit on the number of contracts that will be awarded based on successful proposals? Since many technology product and services firms are already holding contracts such as the OGS Umbrella Contract, The Hourly Based Information Technology Services

Contract, and the Project Based Information

Technology Contracts. Will ESD be using those contracts to compliment the contracts created by this solicitation? Is remote work acceptable in performance of the services solicited?

There is no limit on the number of contracts that will be awarded within the duration of the list.

ESD will release mini-bids as needed.

Could ESD please confirm that vendors may choose between the services of is it mandatory to provide all the categories?

Vendor can submit for only one area or for as many as the vendor is qualified for.

How many departments will benefit from the MSA?

Could ESD please share the list of those departments?

N/A

Could ESD please confirm if the preferred services under this solicitation are a custom scope solution or a

COTS solution, software, and/or specific products?

All of the above

Could ESD please confirm if firms are required to provide 3 references per category?

Three references overall.

Could ESD please confirm if firms are bidding for several categories, are firms required to provide separate key personnel per category?

All of the categories are listed in Addendum #1-

Revised Scope of Work.Vendor can supply a summary of profiles if availabe but not required.

Is this solicitation more oriented to software or hardware?

Both

Are firms required to have experience providing hardware consulting services in order to be responsive?

No

Are references from services provided by a subcontractor allowed in order to meet the three references requirements in the technical proposal?

Yes

Page 12 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

Will firms be able to provide additional resources on a task order level in the event the current needs require personnel/job roles firms have not submitted along with the cost proposal?

Yes

Could ESD kindly elaborate what specific information is being requested in section D. Staff Experience and

Qualifications of the i. Technical Proposal?

Vendor can supply a summary of profiles if availabe but not required.

Could ESD kindly elaborate what specific information is being requested in section E. Project Plan and

Approach of the i. Technical Proposal?

Descirbe how the products would be delieverd.

Is it required to provide full actual resumes for all proposed personnel?

Vendor can supply a summary of profiles if availabe but not required.

In the even personnel become unavailable at a Task

Order level, are firms allowed to replace the proposed personnel for equally qualified personnel?

Yes with ESD approval

For subcategory F, in category 3 of the scope of services, the following is requested: "products and vendors such as but not limited to: Microsoft, KingswaySoft, Synapse Analytics, Synapse Link for

Dataverse Lake database." Could ESD please clarify if firms providing services under this category would be required to sell their COTS/SaaS solutions?

No

284 Is ESD looking for firms to resell official licenses? Yes

Could ESD please clarify if firms can provide implementation for the SaaS solutions required

(Microsoft, oracle, etc.)?

Yes

Does ESD allow offshore staff on this contract, or must all staff be based in the U.S.?

Offshore is not permitted. All work needs to be done within North America.

For the 'certification of all products' requirement, do you mean formal vendor certifications (like a Microsoft or AWS partner status), and only for the categories we actually bid on?

Any certifications held by vendor for products and services mentioned

If we use a subcontractor to deliver a category instead of our own staff, is that acceptable, and do we need to disclose it in our proposal?

Yes you can use a subcontractor. Offshore is not permitted. All work needs to be done within North

America.

Is there a minimum or maximum number of scope categories a firm must respond to in order to be considered for pre-qualification? (Section IV)

Vendor can submit for only one area or for as many as the vendor is qualified for.

Could ESD share projects or scopes of work anticipated under the resulting contract? We are interested in learning about the more specific objectives and drivers for this contract.

We cannot anticipate expected projects at this time.

Does ESD have a preference for remote or on-site work?

Page 13 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

Can ESD confirm that this is not for staff augmentation?

ESD will use this list for project development, purchases and staff augmentation

Does ESD has defined list of software’s they currently use and can share with us?

N/A

Does ESD prefer to have the same partner who can procure licenses and can also provide services as well?

ESD does not have a preference.

With respect to Item 3(s) “Artificial Intelligence (AI), Intelligent Automation, and Emerging Technologies,” can ESD provide examples of anticipated AI-related initiatives or business functions that may utilize these services during the term of this contract?

We cannot anticipate expected projects at this time.

Item 3(s) references “Microsoft Copilot technologies.”

Can ESD clarify whether this includes Microsoft 365

Copilot, Copilot Studio, Security Copilot, GitHub

Copilot, and other Microsoft AI offerings currently available under the Copilot portfolio?

TBD

Item 3(s) references procurement of related hardware, software, cloud services, and licensing. Please confirm whether respondents may provide AI software subscriptions, cloud consumption services, and licensing in addition to consulting and implementation services.

Yes

Does ESD have identified or anticipated AI use cases or a roadmap for the contract term? What are ESD’s highest-priority AI use cases for the first 6–12 months?

We cannot anticipate expected projects at this time.

For generative AI and agentic AI, does ESD have preferred or approved platforms, such as Microsoft

Azure, Microsoft Copilot, AWS Bedrock, Google

Gemini, OpenAI ChatGPT, Anthropic, open-source models, or other state-approved AI services?

The AI tools listed in the RFP are the ones currently used by ESD.

Is ESD seeking vendors that can provide ongoing managed AI services after implementation, or is the expected scope limited to advisory, design, and project-based implementation support?

Both

Does ESD expect vendors to provide business process assessment and redesign, or only technology configuration and implementation?

Both

Is ESD open to custom-built AI solutions, COTS/SaaS

AI products, vendor-owned accelerators, and hybrid approaches, depending on the use case? Please clarify whether ESD has a preference for build, buy, or configure/integrate approaches.

Both

Page 14 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

Section V.B.1 requests respondents provide qualifications corresponding to each Scope of Work item. Please confirm whether respondents may seek qualification for selected service categories and technologies, or whether ESD expects demonstrated capabilities across all categories listed in the Scope of

Work.

Vendor can submit for only one area or for as many as the vendor is qualified for.

Will task orders be evaluated primarily on price, technical capability, past performance, or a combination of factors, and will these criteria be standardized?

Firms will be qualifed under the catorgories they respond to in the RFP.

The Technical Approach evaluation criterion states that the proposals will be evaluated on “…completeness of proposed approach.” Is there a minimum number of scope items for which vendors should provide responses to achieve “completeness” in this context?

For example: If a firm chooses 'no response is being provided' for a particular item, will that vendor be scored lower or penalized in the evaluation process compared to vendors who respond to all sections?

Vendor can submit for only one area or for as many as the vendor is qualified for.

Regarding “Certification of all products mentioned in the scope of work” – Is ESD seeking vendors that are certified to re-sell these products or that have resources certified to implement and support these products?

Any certifications held by vendor for products and services mentioned.

How does ESD intend to evaluate "team expertise" including requisite certifications? Is the expectation that named resources will be identified for each scope item and sample resumes provided?

Any certifications held by vendor for products and services mentioned.

Scope of Work & pre-qualification — Partial responses

(Sec. IV, p.3, Addendum #1): May a respondent seek pre-qualification for only a subset of the Scope of Work items, and will pre-qualification be awarded on a per-item basis?

Vendor can submit for only one area or for as many as the vendor is qualified for.

May a Respondent seek pre-qualification for a subset of the Scope of Work items rather than all of them, and does bidding on more categories improve evaluation standing? Confirm that a firm is only scored on the areas it elects to pursue.

Vendor can submit for only one area or for as many as the vendor is qualified for.

3.e — Does ESD have current or planned Dynamics

365 / Power Platform / O365 initiatives (migrations, new apps, GIS/Portal), and is support sought as project delivery, managed service, or both?

Both

3.f — What is ESD's current data-warehouse/BI environment (on-prem MSSQL vs. Azure Synapse/Data

Services), and is a modernization or Power BI rollout anticipated?

N/A

Page 15 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

3.m / 3.n (new) — For communications infrastructure and deployment/"remote hands" support, is a New York on-site presence required, and are these expected as ongoing managed services or as-needed work orders?

Work can be remote. Offshore is not permitted. All work needs to be done within North America.

3.a / 3.c — Is ESD seeking design/implementation, ongoing managed operations, or staff augmentation for its virtualization (VMware/VDI) and network environments?

Work can be remote. Offshore is not permitted. All work needs to be done within North America.

Section A.4 requires 'Certification of all products mentioned in the Scope of Work.' Does this mean

OEM/partner or reseller certifications for every listed product, or only for the products within the categories a firm elects to bid? What form of certification evidence is acceptable?

Any certifications held by vendor for products and services mentioned.

What is ESD's current Oracle PeopleSoft Financials version, hosting model (on-premises vs.

cloud/managed), and is an upgrade, reimplementation, or migration anticipated during the contract term?

Cloud. Migration is not needed.

IV.2 — Current technology environment (versions): To the extent available, can ESD provide the versions and hosting model (on-prem vs. cloud) for the technologies in scope item 2 — e.g., Drupal, SQL Server, IIS, .NET

(Framework vs. Core/.NET 8+), Power Platform, SharePoint (on-prem vs. Online), Power BI, and any remaining Crystal Reports — along with the Azure vs.

AWS split and which workloads run where? If a full inventory is more appropriate at the work-order stage, please confirm.

N/A

Across the technical categories, is ESD seeking staff augmentation, managed/outcome-based services, discrete project delivery, or all of the above? This materially affects rate structure and staffing plans.

All of the above.

Does ESD maintain a library of the defined list of the software and platforms it currently licenses and uses that it can share with Respondents, so proposals can reflect the actual environment?

N/A

What is ESD's current cloud posture (primary platform, workloads already migrated), and is there an active cloud migration or modernization roadmap the panel would be expected to support? What cloud platform(s) providers does ESD contract with?

Cloud. No migration is needed.

With AI and Emerging Technologies added to scope

(Addendum #1), does ESD have current or planned

AI/GenAI initiatives (e.g., Microsoft Copilot rollout, chatbots, RPA) that the panel would support, and how will AI capability be weighed within the 'Experience' criterion?

TBD

Page 16 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

With AI and Emerging Technologies added to scope

(Addendum #1), does ESD have current or planned

AI/GenAI initiatives (e.g., Microsoft Copilot rollout, chatbots, RPA) that the panel would support, and how will AI capability be weighed within the 'Experience' criterion?

TBD

IV.3.s / IV.3.e — AI licensing & existing agreements:

Does ESD currently hold enterprise agreements or licenses with AI/agentic-AI providers (e.g., Microsoft

Copilot / Copilot Studio, Azure OpenAI, Google

Gemini, OpenAI, or the named tools ChatGPT, Zoom

AI, Monday.com AI)? For the AI scope, does ESD expect pre-qualified firms to procure/resell AI licenses through this panel, to deliver services on top of ESD's existing agreements, or both? Are there approved models or data-handling terms firms must build within?

N/A

For Section 3(s), is ESD seeking advisory and governance services, technical implementation services, or both for Artificial Intelligence and Intelligent

Automation?

Both

Please share existing pain points or priority initiatives driving the addition of Artificial Intelligence and

Intelligent Automation services in Addendum #1.

N/A

Please confirm if public-sector transformation, PMO, data and reporting, and technology advisory projects can be used as relevant experience for Sections 2, 3(f), 3(g), and 3(s)?

Yes

Could you please confirm whether the work associated with the RFP will be performed using ESD-provided equipment, or if contractors will be required to supply their own equipment to perform the work in support of

ESD?

Both

Is ESD interested in Appian responding to this solicitation? Our software (platform) and Consulting

Services relate to several categories listed in the solicitation including (but not limited to): item #2, item

#3, and categories F & G.

Firms will be qualifed under the catorgories they respond to in the RFP.

p. 2, Section II – Overview Please clarify how many firms ESD expects to select for the pre-qualified provider list, whether awards will be made by service category, and whether a Respondent may be selected for only certain categories rather than the full scope.

Page 17 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

pp. 3–4, Section IV – Scope of Work The Scope of

Work includes a very broad range of goods and services. Will ESD evaluate Respondents separately for each Scope item, or will each proposal receive one overall score regardless of which Scope items the

Respondent is pursuing?

Firms will be qualifed under the catorgories they respond to in the RFP.

pp. 3–4, Section IV – Scope of Work For Scope items involving product procurement, software licensing, cloud services, hardware, telecom, AV equipment, HVAC, or specialized delivery, may Respondents rely on authorized resellers, subcontractors, or strategic partners to satisfy category qualifications, provided those entities are identified in the proposal or approved before work order execution?

Yes

p. 5, Required Proposal Contents – A. Respondent

Information, item 4 Please clarify what is meant by

“Certification of all products mentioned in the Scope of

Work.” Is ESD requesting manufacturer authorization/reseller certifications, product compliance certifications, technical staff certifications, or another form of certification? Also, is this required for every product listed in the Scope of Work or only for products the Respondent proposes to provide?

Any certifications held by vendor for products and services mentioned.

Is the group looking for a vendor to provide in-person and/or virtual instructor-led training classes, in a traditional classroom format (live students, live trainer, synchronous learning)? Our company offers classes in a

Monday-Friday, 9am-5pm (or similar time) format, on both a public class schedule and as a private class.

Yes

Is the group looking for a vendor to provide in-person and/or virtual instructor-led training classes, in a traditional classroom format (live students, live trainer, synchronous learning)? Our company offers classes in a

Monday-Friday, 9am-5pm (or similar time) format, on both a public class schedule and as a private class. Is that the type of product and/or service the group is looking to have access to through this bid process?

Yes

Our organization explicitly holds an active, globally recognized ISO/IEC 27001 certification covering our core engineering infrastructure. Will a certified ISO

27001 framework, paired with our internal data security, risk assessment, and incident logging policies, be accepted as satisfying the requirement for ISO 27005 and 27035, or does the CISO require distinct, standalone certifications for those specific subsets?

Vendors do not need to be ISO Certified; they need to follow the guidelines outlined in the Standards.

Page 18 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

Is GDPR compliance required as a blanket pre-qualification condition applicable to all vendors regardless of scope, or is it a conditional requirement that applies only to vendors whose contracted work under a specific work order involves the collection or processing of data from EU-based individuals? For vendors focused exclusively on domestic-facing application development and data warehouse services for NYS constituents, please clarify whether demonstrating GDPR compliance is a mandatory qualification criterion.

GDPR is only for web projects.

Must vendors demonstrate full compliance with ISO

27001, 27005, and 27035 (or approved equivalents) as part of the proposal submission in order to be pre-qualified, or is compliance certification a post-award obligation to be established within 30 days of contract signing, as suggested by the phrasing in Appendix A?

Please clarify the specific documentation format ESD expects at the proposal stage versus at contract execution.

Vendors do not need to be ISO Certified; they need to follow the guidelines outlined in the Standards.

Regarding the AI services added via Addendum #1, are there preferred AI governance frameworks or security standards ESD expects vendors to follow?

Reference NYS AI Policy.

Will all future work orders require separate security reviews and onboarding?

Yes

For vendors primarily providing hardware, software licensing, and procurement services, which portions of the Information Security Brief apply versus those intended for managed services, application-hosting providers, or vendors accessing ESD systems or data?

TBD

Will ESD accept industry-standard security certifications, such as SOC 2, ISO 27001, manufacturer security programs, or comparable standards, as evidence of compliance with the security requirements outlined in Appendix A?

Vendors do not need to be ISO Certified; they need to follow the guidelines outlined in the Standards.

Our organization utilizes a global delivery model combining U.S.-based client-facing resources with US based and off/near shore teams. Are vendors permitted to use this hybrid delivery model? If so, are there any restrictions on offshore personnel performing software development, testing, AI development, maintenance, or support, or any data residency/security requirements that would require certain services to be performed exclusively within the United States?

Offshore is not permitted. All work needs to be done within North America.

Page 19 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

Must vendors demonstrate compliance with Appendix A security requirements (including ISO 27001, ISO

27005, and ISO 27035 or equivalent standards) at proposal submission, prior to contract execution, or only before commencing applicable project work?

Vendors do not need to be ISO Certified; they need to follow the guidelines outlined in the Standards.

If we are not ISO 27005 or 27035 certified, is that a reason for disqualification? Please confirm whether it is mandatory and what the impact would be on our response. RFP Reference: Appendix A – ESD

Information Security Brief (Version 6), “Security

Compliance” section (ISO 27001, 27005, and 27035 bullets).

Vendors do not need to be ISO Certified; they need to follow the guidelines outlined in the Standards.

ISO 27005/27035 (Appendix A): Will ESD’s CISO accept documented comparable standards (e.g., NIST

800-53/CSF, ISO 27001 SoA mapping) in lieu of formal 27005/27035 certification, and what is the approval process? RFP Reference: Appendix A – ESD

Information Security Brief (Version 6), introductory paragraph (“…utilizing comparable Security Standards if approved by ESD’s CISO”) and the “Security

Compliance” section.

Vendors do not need to be ISO Certified; they need to follow the guidelines outlined in the Standards

GDPR: Given ESD’s NYS-citizen data, in what circumstances does ESD consider GDPR in scope for this panel? RFP Reference: Appendix A – ESD

Information Security Brief (Version 6), “Security

Compliance” section, GDPR bullet (“…applicable when developing or using a system that is collecting or storing information from entities or citizens that fall within the scope of GDPR governance”).

GDPR is only for web base projects.

Please state the compliances required to be taken into account while consolidation for eg data residing with the US cannot be moved out of the US N/A

List any regulatory compliance policies and procedures that are integrated into your environment?

N/A

Please provide the current network and security architecture with diagram for all locations in scope N/A

Are their any regulations or compliance criterias to be followed during transformation of network and security through virtualization/sharing or storage convergence technologies across multiple BU's or locations? Please specify

N/A

Is there any compliance or legal requirements with context to security? Please specify

ISO

Security Requirements: Are there specific background check, clearance, or data residency requirements for personnel performing under this contract?

All work needs to be done within North America.

Backgroud checks are the respobsnilitiy of the vendor.

Page 20 | Pre-Qualified Providers of IT Goods & Services

No. Question Answer

On Cybersecurity & Data Governance (Section IV, Item

3b): Does ESD have a preferred roadmap for integrating Zero-Knowledge Architecture or end-to-end encryption layers for sensitive state financial and personal datasets? As a firm that prioritizes data sovereignty through decentralized processing, we are interested in how ESD balances the need for robust forensic auditing with individual data privacy mandates.

N/A

Regarding Cyber Security Infrastructure, does "Cyber

Security audits" include compliance-framework assessments (NIST CSF, CIS Controls, NYS-P03-002 state security policy alignment), or technical assessments only (pen testing, vulnerability scanning)?

Includes all

Regarding Cyber Security Infrastructure, is incident response in scope, retainer-based IR, forensic analysis post-breach. Or only preventive infrastructure?

Includes both

Regarding Cyber Security Infrastructure, does ESD operate an internal SOC, or is managed detection and response / 24x7 monitoring an anticipated need?

Yes

Regarding AI, does ESD have an existing AI governance framework or acceptable-use policy that solutions must align to?

Refer to NYS AI.

Item 3(s) references AI governance, policy development, and AI security. Are there existing ESD standards, policies, or governance frameworks that respondents should consider when describing their AI capabilities and approach?

Refer to NYS AI.

Vulnerability management is not listed as a separate scope item. Should respondents include vulnerability assessment, prioritization, remediation tracking, and reporting under cybersecurity services?

Yes

For cybersecurity services, is ESD looking only for project-based consulting and implementation support, or should respondents also include managed security services such as SOC, MDR, threat monitoring, and incident response retainers?

All of the above.

Are there specific security frameworks or standards that

ESD expects respondents to align with, such as NIST

CSF, NIST 800-53, CIS Controls, ISO 27001, NYS ITS standards, CJIS, or HIPAA where…