Amendment_1_Q_Cs_for_RFP_TSB_Integrated_Library_System_FY27-FY31.pdf
PDF 653 KB Posted
- Solicitation number
- RFP 33101-26040FAS5
- Issued by
- Davidson County, Tennessee
About this file
Amendment #1 to RFP #33101-26040FAS5 for TSB Integrated Library System
This document is Amendment #1 to a Request for Proposals issued by the State of Tennessee Department of Education for procurement of an Integrated Library Management System (ILMS) to support the Tennessee School for the Blind's Resource Center for the Visually Impaired (RCVI) for fiscal years 2027-2031. The amendment updates the RFP schedule and provides state responses to sixteen bidder questions and comments. Key dates established by this amendment include a Pre-response Conference on March 24, 2026, a Notice of Intent to Respond deadline of March 25, 2026, a Written Questions & Comments deadline of April 1, 2026, a Response Deadline of May 14, 2026, completion of technical evaluations by June 3, 2026, and a Notice of Intent to Award release scheduled for June 9, 2026. The ILMS must support cataloging, circulation, user account management, vendor ordering, Federal Quota program data exports in XLSX format, reporting capabilities, and WCAG 2.1 Level AA accessibility compliance for blind and low vision users. The contract term is sixty months with optional negotiations scheduled for June 5-8, 2026, and contractor signature deadline of June 22, 2026.
The amendment clarifies critical requirements through state responses to bidder inquiries regarding information security, software ownership, data migration, and system specifications. The state confirms acceptance of AWS SOC 2 Type 2 certification with FIPS 140-2 encryption and contractor commitments to CSA CAIQ completion and documented Information Security Management Systems in lieu of separate application-layer SOC 2 examination. The state accepts a Software-as-a-Service delivery model for the ILMS platform where the contractor retains ownership of underlying software and custom development remains contractor-owned unless discrete software deliverables are created outside the platform. Current system parameters include approximately 1,300-1,400 active user accounts, 150 participating Local Educational Agencies with 150-450 active user accounts, an estimated 2,000-3,000 annual transactions, five state staff members requiring back-end access, and data currently stored in Progress OpenEdge Database. The state confirms no requirement for FedRAMP hosting, external financial system integration, or third-party system integrations; however, strong preference exists for Microsoft Entra ID single sign-on integration for user access, and all state data must be housed in the continental United States with FIPS 140-2/3 encryption standards maintained throughout the contract term.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
09-20-18 RFP-AMEND
RFP #33101-26040FAS5 – Amendment #01 Page 1 of 6
STATE OF TENNESSEE
DEPARTMENT OF EDUCATION
REQUEST FOR PROPOSALS #33101-26040FAS5
AMENDMENT #01
FOR TSB INTEGRATED LIBRARY SYSTEM (FY2027-
FY2031)
DATE: April 22, 2026
RFP # 33101-26040FAS5 IS AMENDED AS FOLLOWS:
1. This RFP Schedule of Events updates and confirms scheduled RFP dates. Any event, time, or date containing revised or new text is highlighted.
EVENT
TIME
(Central Time
Zone)
DATE
1. RFP Issued March 13, 2026
2. Disability Accommodation Request Deadline 2:00 p.m. March 18, 2026
3. Pre-response Conference 9:00 a.m. March 24, 2026
4. Notice of Intent to Respond Deadline 2:00 p.m. March 25, 2026
5. Written “Questions & Comments” Deadline 2:00 p.m. April 1, 2026
6. State Response to Written “Questions & Comments”
April 22, 2026
7. Response Deadline 2:00 p.m. May 14, 2026
8. State Completion of Technical Response Evaluations
June 3, 2026
9. State Opening & Scoring of Cost Proposals 8:00 a.m. June 4, 2026
10. Negotiations (Optional) June 5-8, 2026
11. State Notice of Intent to Award Released and RFP Files Opened for Public Inspection
2:00 p.m. June 9, 2026
12. End of Protest Period June 16, 2026
13. State sends contract to Contractor for signature
June 17, 2026
14. Contractor Signature Deadline 2:00 p.m. June 22, 2026
RFP #33101-26040FAS5 – Amendment #01 Page 2 of 6
2. State responses to questions and comments in the table below amend and clarify this RFP.
Any restatement of RFP text in the Question/Comment column shall NOT be construed as a change in the actual wording of the RFP document.
RFP SECTION
PAGE
QUESTION / COMMENT STATE RESPONSE
RFP Attachment 6.6.
Pro Forma Contract Section E.8.a.(3) Information Technology Security Requirements
page
1. Question 1 —Information Security and Data Protection Assurance [Contractor’s Solution] deploys a dedicated, state-specific AWS installation for each customer. All Tennessee student PII and PHI would be stored and processed exclusively within that AWS environment, which holds SOC 2 Type 2 certification covering Security, Availability, Confidentiality, and Processing Integrity. Ensuring the primary data security risk surface is already covered by a CPA-examined engagement. Tennessee's installation is provisioned exclusively for the State, with no shared infrastructure with other customers. Under this proposal, Tennessee's dedicated [Contractor’s Solution] installation would be delivered with the following security controls:
AWS SOC 2 Type 2 certification covering Security, Availability, Confidentiality, and Processing Integrity FIPS 140-2 validated encryption at rest and in transit AWS KMS Customer Managed Keys exclusive to Tennessee's installation, not shared across other customers All data hosted and processed within the continental United States, with access restricted to US-based personnel only [Contractor’s Solution] does not currently hold a separate CPA-examined SOC 2 engagement at the application layer as outlined under E.8.a.3. In lieu of this, and specific to this Contract, the Contractor commits to: Completing and annually maintaining a CSA Consensus Assessment Initiative Questionnaire
(CAIQ)
Developing and maintaining a documented Information Security Management System with controls mapped to the SOC 2 Trust Services Criteria
Please confirm we should proceed on this basis.
The State finds this approach acceptable.
RFP Attachment 6.6.
Pro Forma Contract Section E.6.b.(1.), (2.), (4.)
Transfer of Ownership of Custom Software Developed for the State
page
2. Question 2 — Pro Forma Contract, Transfer of Ownership of Custom Software Developed for the State
Where engagement with RCVI requires custom development outside of the [Contractor’s Solution] platform - for example, bespoke integrations, standalone reporting tools, or other discrete software deliverables - we will comply fully with the Transfer of Ownership provisions set out in the Pro
The State finds this approach acceptable.
RFP #33101-26040FAS5 – Amendment #01 Page 3 of 6
QUESTION / COMMENT STATE RESPONSE
Forma Contract, including source code delivery obligations and the State's rights over Custom-Developed Application Software as defined therein.
[Contractor’s Solution] itself, however, operates under a different delivery model that the Transfer of Ownership provisions do not directly address, and we wish to flag this for clarification before submission.
[Contractor’s Solution] is a commercially deployed, multi-state library materials management SaaS (Software as a Service) platform. Under NIST Special Publication 800-145, SaaS is software delivered over a network where the consumer uses the provider's applications but does not manage or control the underlying infrastructure or application. Tennessee would access [Contractor’s Solution] as a managed cloud service hosted entirely within the Contractor's AWS environment, in the same way state agencies access platforms such as Salesforce. The State accesses the service - it does not receive, install, or independently operate the underlying software.
Under the Pro Forma Contract's own definitions, [Contractor’s Solution] constitutes Contractor-Owned Software, commercially available software developed independently and not using State funds. Given this, a number of the Transfer of Ownership provisions warrant flagging:
The source code delivery obligations in E6.b(2) do not apply, as no software is delivered to the State
The perpetual license grant in E6.b(1) is inconsistent with subscription-based service access
Work Product ownership under E6.b(4) does not apply - implementation work (workflow configuration, data mapping, report templates) remains within the Contractor's infrastructure, is never delivered as a discrete artifact, and cannot function independently of the [Contractor’s Solution] platform. Therefore, the State receives service outputs and not software deliverables
Feature enhancements requested by the State remain within the Contractor's managed platform as Contractor-Owned Software, consistent with the rights reserved under E6 Section c
The Transfer of Ownership provisions do not address a delivery model in which no
RFP #33101-26040FAS5 – Amendment #01 Page 4 of 6
QUESTION / COMMENT STATE RESPONSE
software is transferred to or independently operable by the State.
Please confirm we should proceed on this basis.
RFP Attachment 6.6.
Pro Forma Contract Section A.3.
page
3. Does the State currently export Federal Quota data electronically to APH, and if so, in what format?
Yes, the current contractor’s system exports data as a .CSV file. The State then saves that file as a .XLSX file, which is what APH’s FQ website (SRS) accepts.
The State prefers the new ILMS system to export data directly to .XLSX format according to the template APH uses.
RFP Attachment 6.6.
Pro Forma Contract Section A.3.
page
4. Can the State provide the current APH Federal Quota export template, including field definitions, data types, and any formatting requirements?
Yes, the State will share this template with the selected contractor after contract award.
RFP Attachment 6.6.
Pro Forma Contract Section A.3.
page
5. Can the State provide a description of the annual Federal Quota census workflow, specifically how data is collected, from whom, and at what points in the academic year?
The Federal Quota census officially begins/opens up on January 1st each year.
Throughout each year, stakeholders (school districts, State staff, parents of homeschooling students, etc.) are encouraged to access the current contractor’s system and maintain current records of students, including but not limited to an accurate roster and current educational data (grade, federal quota eligibility, etc.). The State will distribute messages to stakeholders prior to each January as general reminders of the census.
Once the census begins, State staff will contact these stakeholders to conduct reviews of data already in the current contractor’s system to ensure the data is actually updated.
Once reviewed by State staff, most stakeholders designate a staff member to certify that the data is accurate.
Once stakeholders review and confirm accuracy, the data is exported from the system and uploaded to the APH SRS website.
RFP Section 1.1.
Statement of Procurement Purpose
6. In what format is the existing catalog, user account, and transaction history data stored? Can the State provide any available documentation describing the structure of the existing system's data, such as a data dictionary, export schema, or sample data export, to assist with migration planning?
The current contractor’s system data and schema are stored in a Progress OpenEdge Database. With the correct drivers, the database is SQL compatible. The State will make data dictionary documentation, which is current as of October 2023, available to the selected contractor.
RFP Section 1.1.
Statement of Procurement Purpose
7. Approximately how many catalog records, user accounts, and active student records does the current system contain?
The State estimates there are between 1,300 and 1,400 active user accounts, inclusive of student records and teachers/administrators with ordering access.
RFP #33101-26040FAS5 – Amendment #01 Page 5 of 6
QUESTION / COMMENT STATE RESPONSE
It is unclear how many catalog records are in the current system.
General 8. What is the approximate volume of annual transactions (orders, shipments, returns) processed through the RCVI?
The State estimates between 2,000 and 3,000 transactions per year in the current system.
General 9. How many LEAs currently participate in the RCVI program, and approximately how many individual LEA user accounts are active?
The State approximates one hundred and fifty
(150) LEAs currently participate in the RCVI program. The State estimates between one hundred and fifty (150) and four hundred and fifty (450) active authorized LEA user accounts that place orders.
RFP Attachment 6.6.
Pro Forma Contract Section A.3.
page
10. How many RCVI staff members will require back-end access to the system, and what are the distinct roles and permission levels needed?
The State currently has five (5) RCVI staff members that require back-end access. For these State staff members, there are no distinct permissions/roles required.
General 11. Are there any third-party system integrations currently in use or anticipated — for example, with APH's systems, TN DOE systems, or shipping and logistics platforms?
The State currently does not have third-party integrations in use. The current contractor claims a level of integration with APH is available, but the State has not used the integration. The State does not anticipate any integrations with the new ILMS system due to the complexity of cross-system agreements.
RFP Attachment 6.2.
Section C.11.
page
12. Section C.11 references reporting on costs accrued against various funds accounts, including state/school funds and Federal Quota accounts. Will this require integration with an external financial system or accounting platform?
No, external integration is not required. The State is seeking the ability to run reports of varying detail on the new ILMS system.
General 13. Does the State have any requirements for Single Sign-On (SSO) integration — for example, for LEA stakeholder access to the ordering portal or for RCVI staff access to the back-end system?
The State uses Microsoft Entra ID for SSO and strongly prefers contractors to support integration with Entra ID using standard federation protocols. For workforce users accessing the application, SSO through Entra ID shall be supported within the selected contractor’s system unless the selected contractor clearly identifies a technical limitation.
Any proposed exception must be explicitly described in the Respondent’s technical response.
General 14. Does the State require the ILMS to be hosted on a FedRAMP-authorized cloud platform, or is commercial cloud hosting acceptable provided FIPS 140-2/3 encryption requirements are met?
FedRAMP-authorized cloud hosting is not required. Commercial cloud hosting is acceptable, provided the selected contractor’s ILMS system meets all applicable State security requirements, including but not limited to required encryption standards, and maintains those controls throughout the Contract Term.
RFP Attachment 6.6.
Pro Forma Contract Section E.8.a.(3) Information Technology Security Requirements
page
15. Section E.8.a.(3) states that the SOC 2 Type 2 requirement applies to the Contractor and any subcontractor "used to host State data." Section E.8.a.(4) references "each of its Subcontractors" more broadly. Does the SOC 2 Type 2
The SOC 2 Type II requirement will apply to the selected contractor and to any subcontractors that will host, process, store, transmit, or otherwise access State data, or that are involved in operating or supporting the selected contractor’s ILMS system. If the
RFP #33101-26040FAS5 – Amendment #01 Page 6 of 6
QUESTION / COMMENT STATE RESPONSE
examination requirement apply only to subcontractors who host State data, or to all subcontractors regardless of role?
selected contractor uses subcontractors who will not host, process, store, transmit, or otherwise access State data, then this requirement would not apply.
RFP Attachment 6.6.
Pro Forma Contract Section E.8.a.(3) Information Technology Security Requirements
page
16. Is the State's SOC 2 Type 2 requirement applicable from the contract effective date, or is there a grace period for new vendors to complete their first audit?
The selected contractor shall maintain SOC 2 Type II compliance on an ongoing annual basis. At initial contract execution, the State will accept documentation confirming that the SOC 2 Type II audit is in progress, including the expected completion date. The completed report shall be provided to the State upon completion and thereafter maintained on a current annual basis.
General 17. What is Tennessee Instructional Resource Center's anticipated average number of simultaneous IRC staff account log-ins?
The State’s typical use involves three (3) staff members actively in the system at the same time.
RFP Attachment 6.6.
Pro Forma Contract Section E.8.b.(1) Information Technology Security Requirements
page
18. Pro Forma Contract E.8 b (1) states, “The Contractor and all data centers used by the Contractor to host State data, including those of all Subcontractors, must comply with the State’s Enterprise Information Security Policies as amended periodically.” Those policies enumerate restrictions on login procedures. As a result, will the contractor’s solution be required to integrate with a TN Identity and Access Management system, and if so what technology drives that system?
For the selected contractor’s or any subcontractor’s administrative access to the hosting infrastructure for the new ILMS system, the State does not require use of the State’s IAM platform, provided the selected contractor’s and subcontractors’ access controls and authentication methods meet applicable State security requirements and the requirements of the Enterprise Information Security Policies.
For State user access to the new ILMS system, the State strongly prefers authentication through its existing Microsoft Entra ID SSO environment.
Authorization within the new ILMS system may be managed by the system itself. If the system supports integration with Entra ID for authorization or role assignment, the State is open to evaluating that approach with the selected contractor.
3. Delete RFP # 33101-26040FAS5 Attachment 6.6 Pro Forma Contract, in its entirety, and replace it with RFP # 33101-26040FAS5 Attachment 6.6 Pro Forma Contract, Release # 2, attached to this amendment. Revisions of the original RFP document are emphasized within the new release.
Any sentence or paragraph containing revised or new text is highlighted.
4. RFP Amendment Effective Date. The revisions set forth herein shall be effective upon release. All other terms and conditions of this RFP not expressly amended herein shall remain in full force and effect.
File details come from the government source that posted it. Updated .