Addendum No. 1 Q&A - DEP RFI No. 2027001.pdf

DEP Solicitation No. 2027001 July 24, 2026 Addendum No. 1 Page 1 of 40

ADDENDUM No. 1

FLORIDA DEPARTMENT OF ENVIRONMENTAL PROTECTION

DEP Procurement Section

3800 Commonwealth Boulevard, MS#93 Tallahassee, Florida 32399-3000

July 24, 2026

Addendum To: DEP RFI No. 2027001, entitled

“Volunteer Management System”

The Department hereby answers questions posed by interested entities. This addendum does not need to be returned with the response. The Department hereby answers the following questions:

Question # Solicitation Section Solicitation Page # Question / Answer

1. - - Will the Department consider a response from a SaaS Volunteer Management System provider teamed with a Florida-based implementation, onboarding, training, helpdesk, or managed services partner?

Answer: Yes.

2. - - Will the Department consider a response structure where the SaaS platform vendor provides the Volunteer Management System and a partner organization provides Florida-facing support services such as implementation coordination, training support, data migration coordination, documentation support, and L1/L2 helpdesk assistance?

Answer: See answer to question #1.

3. - - The RFI states that the Department anticipates a need for 300 licenses, consisting of 5 system administrator licenses and 295 administrator licenses. Should vendors interpret this 300-license figure as applying only to administrative/coordinator users, with volunteer-facing accounts handled separately?

Answer: Please provide pricing estimates congruent with your licensing scheme with the understanding that we anticipate approximately 30k active volunteers and 300 internal users.

4. - - Should vendors provide estimated pricing for volunteer-facing accounts used by approximately 31,000 volunteers, or should pricing be based only on the 300 administrative licenses listed in Section 4.00, Part A?

Answer: See answer to question #3.

Addendum No. 1 Page 2 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

5. - - For SaaS responses, should vendors complete Section 4.00, Part A using separate line items for licensing, implementation, migration, training, maintenance, and support, or should those costs be consolidated into a single fixed-price estimate?

Answer: Complete all cells on Section 4.00, Part A, to provide a breakdown of pricing.

6. - - Does the Department prefer a SaaS solution already available through an existing cooperative purchasing vehicle, such as a Florida Alternative Contract Source, State Term Contract, GSA, or another cooperative agreement?

Answer: The Department has not made a decision regarding the preferred procurement method or hosting model at this time. The purpose of this RFI is to gather market information to identify options that meet agency requirements and provide the best overall value for the State. Vendors are encouraged to identify if their solutions are available on any existing cooperative purchasing vehicles (e.g., State Term Contract, Alternative Contract Source, GSA) for the Department's informational and planning purposes.

7. - - If a SaaS vendor uses subcontractors or teaming partners for implementation, training, support, or data migration services, should those partners be identified in the RFI response?

Answer: Yes.

8. - - For the Keycloak integration requirement, is the Department seeking confirmation that the proposed solution supports standards-based OIDC/OAuth 2.0 integration, or does the Department expect vendors to describe prior direct Keycloak implementation experience?

Answer: The former – it must support OIDC/OAuth 2.0.

9. - - Does the Department expect the proposed solution to include native Esri ArcGIS integration, or would an API-based integration approach that can expose, consume, or visualize relevant volunteer and opportunity data be acceptable for RFI purposes?

Answer: Spatial data representing the project should be accessible in the Department’s existing Esri ArcGIS Online / Enterprise organizational account in addition to any other solutions the vendor suggests.

Addendum No. 1 Page 3 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

10. - - For background checks and credential verification, is the Department seeking an integrated background-check provider within the VMS, or is it acceptable for the system to track, document, and optionally integrate with background-check or FDLE-related systems during a later implementation phase?

Answer: Refer to Section 2.09(g), Data Sharing & Integrations, and 2.10(a), Background Checks & Credential Verification of the

RFI.

11. - - Should vendors provide a proposed phased implementation approach, such as discovery, configuration, migration, pilot, training, production launch, and post-launch support?

Answer: Vendors can provide the approach as they see fit of the provided Requirements within Section 2.00 of the RFI.

12. - - For public records purposes, should vendors place any confidential, exempt, or trade-secret information on separate pages marked according to Section 1.06, or should vendors avoid submitting confidential technical/security details in the RFI response?

Answer: Refer to Section 1.06 Public Records of the RFI.

13. - - Does the Department intend to use RFI responses to identify vendors for possible demonstrations, and if so, should vendors include a proposed demonstration outline or sample agenda in their response?

Answer: Refer to Section 1.05, Submittal of Response.

14. - - Is the Department interested in learning about options for ongoing Florida-based support, training, documentation updates, and administrator enablement after implementation?

Answer: If these options and services are available, please include them as a separate line item.

15. - - DATA & MIGRATION

Existing Data Migration Will the Department provide an export of current volunteer data (profiles, hours, opportunity history) from the existing SaaS implementations? If so, what format(s) will be provided, and what is the approximate total record count across all current systems?

Answer: Exports are available in .csv. There are approximately 105,000 records. The source systems include Vsys and Volgistics.

Addendum No. 1 Page 4 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

16. - - Data Retention Policy Section 2.11.a references data retention requirements. What is the minimum retention period for volunteer records, time logs, and background check results?

Are there different retention requirements for different data types?

Answer: Retention periods may be different for different data types. Minimum periods are not appliable to the scope of this RFI and will not be provided at this time.

17. - - Current System Inventory The RFI mentions "disjointed SaaS implementations." How many separate systems are currently in use, and do they need to be migrated simultaneously or can migration be phased?

Answer: See answer to question #15. The Department anticipates a phased migration of the different implementations.

18. - - TECHNICAL & INTEGRATION

Keycloak Version & Configuration What version of Keycloak is currently deployed? Are there custom user attributes, federated identity providers, or specific authentication flows (e.g., MFA, password policies) that the solution must support?

Answer: The version currently deployed is 26. See answer to question #8.

19. - - ArcGIS Integration Scope Section 2.09 references Esri ArcGIS integration. Is this limited to displaying park locations on a map, or does it include bidirectional data sync (e.g., pushing volunteer assignments to ArcGIS, pulling spatial data for reporting)? Which specific ArcGIS products are licensed (Online, Enterprise, Pro)?

Answer: Includes bidirectional. See answer to question #9.

Addendum No. 1 Page 5 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

20. - - FDLE Background Check Integration Section 2.10 mentions FDLE integration as optional. If implemented, is there an existing API or web service available for automated background check submission and results retrieval? What is the expected volume of background checks per year?

Answer: Currently, this is done via the online and publicly available FDLE database, and we check the National Sex Offenders Public Website (NSOPW). Expected volume is around 7,500 per year.

21. - - SMS Communications Section 2.06 lists SMS as a communication channel. Does the Department have an existing SMS gateway provider, or should the proposed solution include SMS service procurement? Are there preferred carriers or short code requirements?

Answer: We do not have an existing SMS gateway provider, and the proposed solution should include SMS service procurement. We have no preferred carrier or short code requirements.

22. - - USPS Mail Integration Section 2.06 references USPS letters. Is this a print-and-mail service requirement (e.g., integration with a mailing vendor), or does the Department handle physical mailing internally with system-generated templates?

Answer: Mailing is handled within the system via managed templates, we do not require integration with a mail provider.

23. - - Hosting Environment For custom-built solutions, does the Department prefer hosting on State of Florida infrastructure (e.g., CloudFirst, AWS GovCloud), or is vendor-hosted acceptable provided it meets the data residency and security requirements specified in Section 2.11?

Answer: A custom-built solution would be hosted and maintained by the Department.

Addendum No. 1 Page 6 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

24. - - FUNCTIONAL & SCOPE

License Count Clarification The RFI specifies 300 licenses (5 admin + 295 coordinator). Is this based on concurrent active users or total registered accounts? Are volunteers (the approximately 31,000 individuals) included in this license count, or are they separate and unlimited?

Answer: See answer to question #3.

25. - - Mobile Requirements Is a responsive web application sufficient for field use by coordinators and volunteers, or are native mobile applications (iOS/Android) expected? Is offline functionality required for areas with limited connectivity at remote park locations?

Answer: The website should be fully optimized and responsive for mobile devices – we do not require a mobile app. Offline functionality is not required.

26. - - Presentation Requirement The RFI mentions scheduling presentations. Is a live demo required as part of the RFI response, or will presentations be requested only from shortlisted vendors?

What is the expected duration and format?

Answer: A live demonstration is not required as part of the initial written RFI response. Per Section 1.05, the Department may, at its discretion, invite select vendors to provide demonstrations. If the Department moves forward with demonstrations, they are tentatively planned to be approximately ninety (90) minutes in duration and may be conducted virtually or in person. Invited vendors will be contacted directly with finalized logistics, schedules, and agendas.

27. - - Bilingual Scope For the English/Spanish requirement, is this limited to UI localization, or does it extend to all system generated content (email templates, SMS messages, reports, notification alerts, training documentation)?

Answer: This is limited to the UI.

Addendum No. 1 Page 7 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

28. - - Custom Reporting Section 2.07 mentions custom reporting with drilldowns. Does the Department have existing reporting tools (e.g., Power BI, Tableau) that the solution should integrate with, or should the custombuilt solution include its own reporting engine?

Answer: Qlik is the Department’s existing Enterprise Data Reporting Tool. The product should support integrations with Qlik.

29. - - Cooperative Purchasing If our organization is not currently listed on a Florida State Term Contract or GSA schedule, can we still submit a response under Part B? Are there alternative contracting vehicles the Department would accept?

Answer: Vendors not on a State Term Contract, GSA, or Alternate Contract Source may submit a response to this RFI. If a vendor has a current contract with any County, Municipality, or other local Public Agency in the State of Florida that contains piggyback language, vendors are encouraged to list those Contracts in Section 4.00, Part B.

30. - - Is the Department primarily seeking a commercial off-the-shelf SaaS platform, or is it equally interested in custom-developed cloud-native solutions that satisfy all functional requirements?

Answer: The Department is interested in reviewing both SaaS and custom-built solutions.

31. - - Does the Department have a preferred cloud hosting environment, or will any U.S.-hosted cloud platform meeting the published security requirements be considered?

Answer: For custom builds, see answer to question #23. For SaaS solutions, any continental U.S.-hosted cloud platform will meet the requirement.

32. - - Beyond the required Keycloak integration, are there additional enterprise identity, GIS, or document management platforms currently in use that the Department anticipates integrating with a future Volunteer Management System?

Answer: Additional enterprise platform integrations have not yet been determined. The scope of future integrations will be defined in any subsequent procurement. For the purposes of this RFI, please provide details on your system's standard integration architecture and framework.

Addendum No. 1 Page 8 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

33. - - Does the Department envision a phased implementation and data migration strategy from the existing volunteer systems into a unified enterprise platform?

Answer: See answer to question #17.

34. - - Will vendors have an opportunity to demonstrate user experience concepts, workflow automation, mobile capabilities, dashboards, and reporting functionality as part of the Department's evaluation process?

Answer: See answer to question #13.

35. Sec. 2.11.b.xv - Please confirm the specific Keycloak realm/endpoint details, supported OIDC scopes, and whether a test/staging IdP environment will be made available to respondents prior to contract award.

Answer: See answer to question #18.

If the Department moves forward with a future competitive procurement, access to testing environments will be evaluated and determined at that stage. Environments will not be made available to Respondents.

36. Sec. 2.09.g / 2.10.e - Sections 2.09.g and 2.10.e both describe FDLE integration as "optional." Please clarify whether FDLE integration is a scored/required capability for evaluation purposes or a true optional add-on.

Answer: See answer to question #10.

37. Sec. 4.00 - No contract term length is specified. Please confirm the intended initial contract term and renewal structure so licensing/support cost estimates can be scoped accurately.

Answer: Vendors shall provide pricing based on an annual rate.

If pricing varies for a 1-year vs 3-year term, vendor may provide additional details, as well as renewal information, on Section 4.00, Cost Information.

The Department is only gathering information on available solutions during this time. This RFI will not result in a contract.

38. Sec. 2.11.c.i - The referenced DEP Application/Database/Data Modeling Standards are hosted externally (floridadep.gov/otis). Please confirm no additional access, NDA, or credentials are required to review these standards prior to response submission.

Answer: Confirmed.

39. Sec. 2.09.i - Please confirm whether DEP already operates an Esri ArcGIS Enterprise or ArcGIS Online organization the VMS must integrate with, or whether the vendor should propose/provision this component.

Answer: See answer to question #9.

Addendum No. 1 Page 9 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

40. Sec. 2.02 / Sec. 4.00 - Please identify the current source system(s) housing the approximately 31,000 existing volunteer records, and confirm whether API or bulk-export access will be made available to the awarded vendor for data migration purposes.

Answer: See the answer to question #15.

41. Sec. 2.02.c / 2.03.n - How many distinct volunteer types exist today beyond the four named (individual, group, resident/campground host, CSO), and what is the anticipated rate of new volunteer-type creation post-launch?

Answer: We have various types needed. It is unknown how many are needed post Go-Live.

42. Sec. 2.02.k–n - Should visibility/edit access for each configurable note type (General, Performance, Training, Background Check, Incident) be admin-configurable per role, or does DEP require fixed, predefined access rules per note type?

Answer: Admin-configurable per role.

43. Sec. 2.03.i - For segmented volunteer types requiring distinct public URLs and QR codes (e.g., campground hosts), does DEP have a preference or existing standard for subdomain-based vs. path-based routing, and are there DNS/certificate provisioning constraints the vendor should be aware of?

Answer: Yes, there are specific DNS requirements. We have multiple domains to support, volunteers.floridastateparks.org, rookerybay.org/make-a-difference/volunteer/, and https://gtmnerr.org/volunteer/ are our three primary domains, with volunteers.floridastateparks.org being a subdomain of floridastateparks.org.

44. Sec. 2.03.q–s - Does DEP have an existing training/LMS system that training modules, quizzes, and certifications should integrate with, or is native training-content authoring within the VMS expected?

Answer: We do not have an existing LMS integration, though certificates are retained within the system.

45. Sec. 2.05.i - Does DEP maintain location open/closed status and hours-of-operation (holidays, seasonal closures, maintenance days) in an existing system the VMS should integrate with, or should the VMS be the source of truth for this data?

Answer: The VMS should not be the source of truth for this information.

46. Sec. 2.09.c - Which third-party site(s) should posted opportunities be syndicated to (e.g., Volunteer.gov, VolunteerMatch, a statewide portal), and is a specific feed format (RSS, JSON) required or preferred?

Addendum No. 1 Page 10 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

Answer: The third-party sites are listed below. RSS is the specific feed format.

• https://www.volunteerflorida.org/

• https://floridaaquaticpreserves.org/

47. Sec. 2.09.e - Please identify the specific existing document management system(s) and badge/credentialing tool(s) the VMS is expected to integrate with under this section.

Answer: Laserfiche Cloud is the Enterprise Electronic Document Management System. Our solutions do not currently integrate with badging/credentialing tools.

48. Sec. 2.10.j - Is driver's license API-based verification in scope for this response, and if so, does DEP have a preferred/required verification provider (e.g., a state DMV-linked service)?

Answer: No.

49. Sec. 2.11.a.viii - Please provide DEP's visual branding standards/style guide (logos, colors, typography) to be reflected in the VMS UI.

Answer: Due to the nature of this RFI, the Department’s branding standards are not within scope to be provided.

50. Sec. 2.11.a.xiii - Beyond applicable Florida statutes, please identify the specific DEP security policies the VMS must comply with (e.g., an internal IT security policy document).

Answer: Specific security policy documentation cannot be shared at the RFI stage, as these documents are considered sensitive and, in some cases, exempt from public disclosure under Florida law.

51. Sec. 2.11.c.ii - Please describe the FDEP Portal referenced in Section 2.11.c.ii

— its purpose, technical interface, and the nature of the required integration.

Answer: Refer to https://www.fldepportal.com/.

52. - - Data Migration & Legacy Systems How many distinct source systems currently contain in-scope volunteer records, and can the Department share approximate record counts and data formats for each? Will the Department be responsible for obtaining data exports from incumbent vendors, or is the responding vendor expected to perform extraction?

Answer: See answer to question #15.

53. - - Data Migration & Legacy Systems What approximate volume of documents and attachments (agreements, waivers, photographs, certifications) is expected to migrate, and how many years of historical data must be retained under Section 2.11.a.vii?

https://www.volunteerflorida.org/ https://floridaaquaticpreserves.org/ https://www.fldepportal.com/

Addendum No. 1 Page 11 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

Answer: Both Vsys and Volgistics support document upload.

We have 11 years of historical data, which may include applications, resumes, agreements, etc. Roughly 6 documents per registered volunteer. That is roughly 105,000 volunteers in the last ten years.

54. - - Technical Standards & Hosting (Custom-Built Solutions) Do the FDEP IT Standards referenced in Section 2.11.c.i mandate specific technology platforms (e.g., application framework or database platform), and are current versions of those standards available to Interested Entities?

Answer: Yes. Refer to Section 2.11(c)(i) Technical System Requirements for the link.

55. - - Technical Standards & Hosting (Custom-Built Solutions) For a custom-built solution, would the system be hosted in a Department-managed cloud subscription, the State Data Center, or a vendor-managed environment, and which party would bear ongoing cloud consumption costs?

Answer: See answer to question #23.

56. - - Identity & Integrations Regarding Keycloak SSO (Sections 2.11.b.xv and 2.11.c.ii): is single sign-on required only for the approximately 300 administrative users, with volunteers authenticating via solution-native accounts? Will the Department provide a non-production Keycloak realm and integration documentation during implementation?

Answer: All users should utilize for authentication and Keycloak SSO is used for only the 300 administrative users.

Documentation would be provided to an awarded vendor.

57. - - Identity & Integrations Regarding Esri ArcGIS (Section 2.09.i): does the Department intend for the solution to publish to its existing ArcGIS Online / ArcGIS Enterprise organization, and will the Department provide required Esri licensing, or should vendors include Esri licensing in cost estimates?

Answer: See answer to question #39.

58. - - Identity & Integrations Regarding background screening (Sections 2.09.g and 2.10.e):

does the Department maintain an existing FDLE interface or a contracted screening provider that the solution would integrate with, and which party bears per-check screening fees?

Answer: The Department does not currently have an existing FDLE interface.

Addendum No. 1 Page 12 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

59. - - Communications Scope For USPS-formatted physical letters (Section 2.06.a): is the requirement limited to generating print-ready, merge-formatted letters and mailing labels, or does the Department expect the vendor to provide print-and-mail fulfillment services?

Answer: See answer to question #22.

60. - - Communications Scope Should vendors include SMS/text messaging costs in estimates, and can the Department share expected or historical annual message volumes?

Answer: See answer to question #21. Pricing can be provided in estimates.

61. - - Functional Scope Clarifications Does the English/Spanish bilingual requirement (Section 2.11.a.v) apply to the full administrative interface and all system-generated communications, or primarily to volunteer-facing interfaces? Are professionally translated training materials required?

Answer: Translation service should be for the UI only, and we do not expect the system to translate materials.

62. - - Functional Scope Clarifications Regarding accessibility (Section 2.11.a.iv): will the Department require third-party accessibility audit documentation (e.g., VPAT/ACR), and which party is responsible for conducting acceptance accessibility testing?

Answer: We require an attestation that the solution is compliant to the WCAG 2.1 Level A and Level AA standards or greater.

63. - - Functional Scope Clarifications For Documentation & Training (Section 2.13): should vendors assume virtual training delivery, or is on-site training expected?

If on-site, at approximately how many locations?

Answer: On-site training is not necessary. Virtual training delivery is acceptable.

64. - - Licensing & Program Planning Are the 300 administrative licenses referenced in Section 4.00 named users or concurrent users, and does the Department anticipate growth in administrator or volunteer counts that estimates should account for?

Answer: See answer to question #1.

Addendum No. 1 Page 13 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

65. - - Licensing & Program Planning Does the Department have a target implementation or go-live timeframe, or an anticipated fiscal-year funding window, that vendors should assume for budgetary purposes?

Answer: The Department is utilizing this RFI only to review options for solutions within the vendor community, at this time.

66. Section 2.11.b - Hosting and operation of a custom-developed solution Section 2.11.b (high availability and disaster recovery, data residency within the continental United States, threat detection, multifactor authentication) and Section 2.12 (helpdesk hours, after-hours triage, service level agreements, a 4-hour Recovery Time Objective and a 1-hour Recovery Point Objective) appear under headings for hosted and SaaS solutions. For a custom-developed solution under Section 2.11.c, does the Department intend to host and operate the delivered system in its own environment, or does it expect the vendor to host and operate the system and meet these same availability, recovery, and support obligations?

Answer: See answer to question #23.

67. - - Hosting and operation of a custom-developed solution Also for a custom-developed solution, is the Department seeking a build-and-transfer engagement, an ongoing operate-and-maintain arrangement, or both priced separately?

Answer: See answer to question #23.

68. Section 2.11.c.i - FDEP IT Standards and deployment environments Section 2.11.c.i requires adherence to the Department's published Application Development, Database Object Coding, and Data Modeling standards. Beyond those standards, does the Department require a formal security assessment or authorization before go-live, and will the Department provide development, test, and production environments for the vendor to deploy into?

Answer: See answer to question #50.

69. Section 2.11.b.xv and Section 2.11.c.ii

- Identity and portal integration Section 2.11.b.xv and Section 2.11.c.ii reference single sign-on through the Department's Keycloak identity provider and integration with the FDEP Portal. Will the Department provision the OIDC and OAuth

2.0 client credentials and the portal integration points, and is a published integration specification or a development sandbox available for vendors to build against?

Answer: See answer to question #56. The Department will not provide a development sandbox or integration specifications during this RFI process.

Addendum No. 1 Page 14 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

70. Section 2.01 - Data migration Section 2.01 notes that the Department currently uses various and disjointed SaaS implementations. For migration planning, how many distinct source systems are in scope, and can the Department indicate approximate record volumes and the export formats available from those systems?

Answer: See answer to question #53.

71. Sections 2.09.g and 2.10.e

- Background checks and FDLE Sections 2.09.g and 2.10.e describe integration with background-check providers and Florida Department of Law Enforcement systems as optional and available when requested. Does the Department currently hold an interface or data-sharing agreement with FDLE or an approved provider that a solution would connect to, or would establishing that connection be the awarded vendor's responsibility?

Answer: See answer to question #58.

72. Section 2.09.i - Esri ArcGIS Section 2.09.i calls for integration with Esri ArcGIS platforms.

Does the Department operate an existing ArcGIS Online or ArcGIS Enterprise organization the solution should integrate with, and is that integration expected at initial delivery or as a later phase?

Answer: See answer to question #9.

73. Section 2.11.a.iv - Accessibility conformance Section 2.11.a.iv requires demonstrated compliance with Section 508 and WCAG 2.1 to Levels A and AA. At delivery, does the Department require third-party accessibility validation or a completed Accessibility Conformance Report, or is vendor conformance testing and attestation acceptable?

Answer: See answer to question #62.

74. Section 2.11.a.v - Bilingual scope Section 2.11.a.v requires English and Spanish support. Does this apply to all administrator-facing and volunteer-facing interfaces, or to volunteer-facing interfaces and system-generated communications only?

Answer: See answer to question #61.

75. - - Procurement path Following this market research, does the Department anticipate issuing a competitive solicitation such as an Invitation to Negotiate, and if so, is there an anticipated timeframe?

Answer: See answer to question #65.

Addendum No. 1 Page 15 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

76. - - Purpose of RFI / next procurement path Does the Department anticipate using responses to this RFI to develop a subsequent competitive solicitation, or is the Department also considering cooperative purchasing, existing state term contracts, alternate contract sources, GSA, or other procurement vehicles?

Answer: See answers to questions #6 and #65.

77. - - SaaS vs. custom-built preference The RFI invites both SaaS and custom-built solutions. Does the Department have a preference between a configurable commercial SaaS platform and a custom-developed solution, assuming both can satisfy the functional and technical requirements?

Answer: See answer to question #30.

78. - - Current systems / replacement scope The RFI references various disjointed SaaS implementations currently used for volunteer management. Can the Department identify the current systems/modules being replaced and whether they must be fully retired at go-live?

Answer: See answer to question #15. Implementations would be fully retired after go-live.

79. - - Data migration size Approximately how many existing volunteer profiles, service-hour records, documents, applications, training records, background check records, agreements, and location/opportunity records would need to be migrated?

Answer: See answer to question #53.

80. - - Volunteer user licensing Section 4 references 300 licenses for administrators/coordinators.

Should vendors assume that the approximately 31,000 volunteer accounts are included as public/portal users outside the 300 license count, or should volunteer accounts be included in the licensing model?

Addendum No. 1 Page 16 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

81. - - Internal user roles Can the Department provide a desired breakdown of internal users by role: system administrators, statewide administrators, district/regional staff, park/location managers, volunteer coordinators, read-only users, and reporting-only users?

Answer: A more defined list of internal user roles can be provided at a later date. Please confirm that the system allows role-based access and that we can create and define such roles.

82. - - Keycloak / identity provider scope The RFI requires administrator SSO integration with the Department’s Keycloak identity provider using OIDC/OAuth

2.0. Is SSO required only for Department staff/admin users, or should volunteers also authenticate through Department identity infrastructure?

Answer: See answer to question #56.

83. - - Public volunteer portal authentication For volunteer-facing accounts, does the Department prefer vendor-hosted identity management, social login, email/password accounts, MFA, or integration with an existing State of Florida citizen identity provider?

Answer: See answer to question #56.

84. - - Bilingual support English and Spanish are required. Should all volunteer-facing content, administrator screens, system-generated notifications, reports, forms, and documentation be bilingual, or only public/volunteer-facing workflows?

Answer: See answer to question #61.

85. - - Accessibility validation Will the Department require a formal VPAT, third-party accessibility audit, or WCAG 2.1 A/AA attestation with the RFI response or only during a future solicitation?

Answer: No attestation is required to submit with this RFI response.

86. - - ArcGIS integration What specific ArcGIS use cases are most important: public map display of opportunities, internal map dashboards, GIS-based volunteer activity reporting, data export to ArcGIS, real-time API integration, or all of the above?

Answer: Once authoritative quality spatial data is made available, the Department will leverage that data in multiple ways as needed to meet our mission.

Addendum No. 1 Page 17 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

87. - - Background check / FDLE integration The RFI references optional integration with background check providers and FDLE systems. Are these integrations expected for initial launch, or would manual tracking/document upload be acceptable initially with integration as a later phase?

Answer: See answer to question #10.

88. - - SMS and QR check-in Should QR code and SMS/text check-in be available statewide at launch, or are these desired capabilities for high-volume events only?

Does the Department have an approved SMS provider or messaging policy?

Answer: Refer to section 2.06(a) Communications & Notifications.

See answer to question #21.

89. - - USPS-formatted physical letters For communications, does the Department require actual mail fulfillment/printing integration, or only generation/export of USPS-formatted letters, mailing labels, and contact lists?

Answer: See answer to question #22.

90. - - Document storage volume Can the Department provide expected document storage volume, maximum file sizes, retention periods, and required file types for volunteer records, applications, background checks, agreements, and training documents?

Answer: See answer to question #53.

91. - - Reporting priorities Which reports are mission-critical at launch: hours by location/type, volunteer participation, applications, missing time entries, missing background checks, awards, engagement, statewide roll-ups, or custom ad hoc reports?

Answer: All reports under section 2.06 Communications & Notifications are minimum requirements for a solution to Go- Live.

92. - - Security/compliance documentation For SaaS vendors, will the Department expect SOC 2, ISO 27001, penetration test summaries, cyber insurance, cloud security documentation, or other security artifacts in the RFI response or later procurement?

Answer: No security documentation is required to be submitted with this RFI response.

Addendum No. 1 Page 18 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

93. - - Data residency The RFI requires all data to reside within the continental United States. Are specific cloud providers or State of Florida hosting environments preferred or prohibited?

Answer: There are no other minimum requirements outside of Section 2.11(b)(xiii).

94. - - RTO/RPO

The RFI lists RTO of 4 hours and RPO of 1 hour. Are these hard minimum requirements for any future solicitation, or are vendors encouraged to state achievable recovery targets and associated cost impacts?

Answer: Please specify recovery targets achievable.

95. - - Implementation phasing Would the Department consider a phased implementation, such as: Phase 1 core volunteer profiles/applications/hours, Phase 2 scheduling/communications/reporting, Phase 3 integrations/ArcGIS/background check automation?

Answer: See answer to question #11.

96. - - Demonstrations Does the Department anticipate requesting vendor demonstrations after reviewing RFI responses? If yes, should demonstrations emphasize volunteer portal workflows, coordinator/admin dashboards, reporting, integrations, or technical/security architecture?

Answer: See answer to question #13.

97. - - Budget / price expectations Is the Department seeking budgetary estimates only at this RFI stage, or should vendors provide firm fixed-price estimates for SaaS/custom-build options?

Answer: Pricing should be a precise estimate considering all requirements and information provided in this RFI.

98. - - Confidentiality / public records Since responses become public records, should vendors avoid including proprietary architecture diagrams, detailed security controls, or trade-secret pricing methodology unless clearly segregated as confidential/exempt?

Answer: See answer to question #12.

Addendum No. 1 Page 19 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

99. - - Delivery model The Application Development Standards, Appendix B, state that permitted frameworks are compiled into the container image by the Agency’s CI/CD pipelines and run in the Agency-provided runtime that may not be modified. RFI §2.12 limits support and maintenance obligations to hosted solutions.

a. Does the Department permit a custom-built solution that is vendor-hosted and operated, or is custom development limited to code deployed into the Agency’s pipeline and runtime?

b. For a custom-built solution, does the Department assume operations and maintenance at delivery, or does that responsibility remain with the vendor? If the vendor retains it, do the §2.12 service levels apply, and where in Part B should that scope be priced?

c. Beyond the four standards cited in §2.11.c, do any other items in the IT Standards Library apply to a custom build? If any standards are not publicly accessible, will the Department provide them to respondents?

Answer: For questions a and b above, see answer to question #23. For question c, see answer to question #54.

100. - - Platform and standards variance Appendix B of the Application Development Standards lists permitted languages and frameworks, but does not name any database platforms. The Database Object Coding Standards provides Oracle-specific conventions.

a. Which database platform or platforms are permitted or provided for custom development?

Answer: Oracle 19c is the platform.

b. What is the process and timing for approving an unlisted technology under Appendix B, or a variance from the standards? Is approval available before a solicitation response, or only after award?

Answer: Unlisted technologies would not be approved.

Addendum No. 1 Page 20 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

101. - - Basis of estimate Part B prices labor only. Several requirements in the RFI and the Application Development Standards carry costs that have no line item on that form.

a. Where should custom-build respondents account for non-labor costs, such as third-party licensing, infrastructure, and post-implementation maintenance?

Answer: See Revised Section 4.00 Cost Information: Custom- Built Solution Pricing for Part B, attached separately.

b. §6.3 of the Application Development Standards requires the vendor to monitor components for vulnerabilities for the life of the application. Part B has no maintenance line, and §2.12 covers only hosted solutions. What is the duration of this obligation for a custom build, and where should it be priced?

Answer: See answer to question #23.

c. §5 requires Agency approval before an application connects to a third-party service. The RFI requires integrations with SMS, physical mail, Esri ArcGIS, FDLE, and background-check systems. Which of these does the Department expect the vendor to license and integrate, and does the Agency already hold any of them?

Answer: See answers to questions #9, #20, #21, and #22.

d. Part A asks for implementation length; Part B does not.

Should custom-build respondents provide an estimated duration and phasing? Does the Department have target dates or external constraints that should inform the estimate?

Answer: See Revised Section 4.00 Cost Information: Custom- Built Solution Pricing for Part B, attached separately.

e. To scope migration: which systems currently hold volunteer data, and roughly how many historical records would migrate?

Answer: See answer to question #53.

102. - - Current systems: Which volunteer management systems does the Department currently use, and approximately how many separate instances or implementations are in operation across locations?

Answer: See answer to question #15.

103. - - Data migration: Is migration of data from the current systems expected to be within the scope of the eventual solicitation?

Should vendors assume volunteer records, service history, and associated documents will migrate in full?

Answer: See answer to question #53.

Addendum No. 1 Page 21 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

104. - - Hosting for custom-built solutions: For a custom-built solution, would the Department host the solution on FDEP infrastructure, or does the Department expect vendor-provided cloud hosting within the continental United States?

Answer: See answer to question #23.

105. - - Background check and FDLE integration: Should cost estimates assume integration with a specific approved background-check provider and the FDLE system, or should these be treated as optional line items?

Answer: Optional line items.

106. - - Communication volumes: Can the Department share estimated annual volumes for SMS/text messages and USPS-formatted letters, to support accurate estimation of third-party usage costs?

Answer: Integration with USPS is not needed. We currently do not use SMS and would like to understand the pricing model for leveraging SMS. Please provide estimates as available and include any tiers there may be.

107. - - Budget and duration: Does the Department have a target budget range or an anticipated contract duration for the eventual procurement?

Answer: See answer to question #65.

108. - - Place of performance: Does the Department anticipate any restrictions on development work performed outside the continental United States, provided that all data, environments, and hosting remain within CONUS?

Answer: Everything must remain within the continental United States, all data and all environments. No development work should be performed outside the continental United States.

109. - - Esri ArcGIS environment: For the ArcGIS integration requirement (Section 2.09.i), does the Department maintain an existing ArcGIS Online or ArcGIS Enterprise environment that the solution should publish to and consume from, or is the vendor expected to provide mapping infrastructure?

Answer: The Department does maintain an Esri ArcGIS Online organizational account including ArcGIS Online and Enterprise and related infrastructure.

110. - - Bilingual scope: Should the English/Spanish bilingual requirement (Section 2.11.a.v) be understood to cover administrator-facing interfaces as well as volunteer-facing interfaces?

Answer: See answer to question #61.

Addendum No. 1 Page 22 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

111. - - What volunteer management system(s) does the Department currently use, and how many separate implementations referenced in Section 2.01 are in production today?

Answer: See answers to questions 15.

112. - - Regarding the optional FDLE and background-check integrations (Sections 2.09 and 2.10): will the system be required to store or transmit criminal history record information, and if so, is CJIS compliance required?

Answer: No.

113. - - Does the Department require a specific security attestation (e.g., SOC 2, StateRAMP, or FedRAMP), and will a VPAT be required to substantiate the WCAG 2.1 AA / Section 508 compliance in Section 2.11?

Answer: See answers to questions #85 and #92.

114. - - Section 2.11 requires administrator SSO via Keycloak (OIDC/OAuth 2.0). Is SSO also required for the approximately 31,000 volunteers, or do volunteers authenticate natively within the solution?

Answer: See answer to question #82.

115. - - What depth of Esri ArcGIS integration is expected under Section 2.09 — read-only visualization of volunteer data, or bidirectional data exchange?

Answer: See response to question #19.

116. - - Can the Department characterize the approximate volume and current format of the data to be migrated from the existing systems?

Answer: See answer to question #53.

117. - - Will submitting a response to this RFI be considered in, or serve as a prerequisite for, any subsequent competitive solicitation, and does the Department anticipate requesting product demonstrations?

Answer: See answers to questions #6 and #13.

118. Section 4.00 Part A p.14 Licensing Section 4.00 Part A references "300 licenses (5 system administrator + 295 administrator licenses)" for SaaS pricing.

For vendors proposing a custom-built solution (Part B), should pricing be based on the same 300 administrative user accounts, and are the approximately 31,000 volunteer end-users expected to be unlimited/unlicensed within the custom solution?

Answer: See answer to question #23.

Addendum No. 1 Page 23 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

119. Section 2.11.b.xv / 2.11.c.ii p.12 Integrations Please provide technical specifications (version, deployment model – cloud or on-premises, existing OIDC/OAuth2 configuration) for the Department's Keycloak identity provider referenced in Sections 2.11.b.xv and 2.11.c.ii, so vendors can accurately scope the SSO integration effort.

Answer: Due to the nature of this RFI, the Department’s technical documentation is not within scope to be provided.

120. Section 2.11.c.ii p.12 Integrations Section 2.11.c.ii requires integration with the "FDEP Portal."

Can the Department provide documentation, API specifications, or a technical point of contact describing this portal and its integration requirements?

Answer: See answer to question #51.

121. Sections 2.09.g, 2.10.e p.10-11 Integrations Sections 2.09.g and 2.10.e reference optional integration with FDLE systems and approved background check providers. Is there an existing approved integration/API, or would the vendor need to establish a new interface agreement with

FDLE?

Answer: See answer to question #58.

The vendor would not be responsible for establishing an interface on the Department’s behalf.

122. Section 2.09.i p.10 Integrations Section 2.09.i requires integration with Esri ArcGIS. Does the Department have an existing ArcGIS Enterprise or ArcGIS Online license, and can vendors access API documentation or a sandbox environment during the response/demo phase?

Answer: See answer to question #9.

Vendors will not be able to access the Department’s sandbox environment during the RFI demo or response phases.

123. Section 2.01 p.6 Data Migration Section 2.01 states the Department currently uses "various and disjointed SaaS implementations." How many separate systems are currently in use, what is the approximate volume of historical volunteer records/hours to migrate, and in what format would that data be made available?

Answer: See answers to questions #15 and #53.

Addendum No. 1 Page 24 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

124. Section 2.11.b p.11-12 Technical Section 2.11.b appears to apply specifically to "Hosted Solutions." For a custom-built solution that is not delivered as multi-tenant SaaS, which sub-requirements of 2.11.b (e.g., cloud-based hosting, HA/DR) are mandatory versus which may be satisfied through an equivalent architecture (e.g., dedicated cloud hosting within the continental U.S.)?

Answer: Section 2.11.b are not applicable to custom build proposals.

125. Section 2.11.a.iv p.10 Compliance Section 2.11.a.iv requires WCAG 2.1 Level A/AA compliance.

Does the Department require a formal VPAT (Voluntary Product Accessibility Template) or third-party accessibility audit as part of the response, or is a compliance narrative sufficient at this stage?

Answer: See answer to question #85.

126. Section 2.11.a.xiii p.11 Compliance Section 2.11.a.xiii references compliance with "Florida statutes and DEP security policies." Can the Department share the specific security policy documentation referenced, so vendors can accurately scope compliance efforts in their response?

Answer: See answer to question #50.

127. Section 2.12 p.12 Support/SLA Section 2.12 defines support requirements (helpdesk hours, SLAs, RTO of 4 hours / RPO of 1 hour) under "Hosted Solution Support & Maintenance Requirements." Do these same SLA and support requirements apply identically to a custom-built solution hosted by the vendor, or does the Department anticipate different terms for custom-built delivery models?

Answer: No.

128. Section 4.00 Part B p.15 Pricing Section 4.00 Part B asks for a "Total Estimated Cost" by labor category. Should this total include only initial development/implementation, or should it also incorporate ongoing annual maintenance, hosting, and support costs for budgetary planning purposes?

Answer: See answer to question #23.

129. Section 4.00 Part B ("Length of typical implementation") p.15 Schedule Does the Department have a target go-live date or expected project duration in mind for the eventual solicitation, to help vendors scope a realistic implementation timeline in their response?

Answer: See answer to question #65.

Addendum No. 1 Page 25 of 40

Question # Solicitation Section Solicitation Page # Question / Answer

130. Section 2.03.i p.7 Scope Section 2.03.i mentions distinct public URLs and QR codes for specific volunteer types (e.g., campground hosts). Does the Department require a fully custom public-facing volunteer portal in addition to the administrative system, or is a configurable…