Amendment__1_Vendor_Q_A__EV969.pdf

OMES FORM CP011 (11/2024) AMENDMENT OF SOLICITATION | Page 1 of 8

Central Purchasing

AMENDMENT OF SOLICITATION

GENERAL INFORMATION

Date of issuance

09/28/2026 Solicitation/Event # EV00000969 for SW1043M

Requisition # 0900020796

Amendment # 1

Hour and date specified for receipt of offers is changed:

No Yes, to this date: this time: 3:00 PM CST

Pursuant to OAC 260:115-7-30(d), this document shall serve as official notice of amendment to the solicitation identified above. Such notice is being provided to all suppliers to which the original solicitation was sent.

Suppliers submitting bids or quotations shall acknowledge receipt of this solicitation amendment prior to the hour and date specified in the solicitation by doing one of the following:

1. Sign and return a copy of this amendment with the solicitation response being submitted.

2. If the supplier has already submitted a response, this acknowledgement must be signed and returned before the solicitation deadline. All amendment acknowledgements submitted separately shall have the solicitation number and bid opening date printed clearly in the subject line of the email.

Return to:

Contracting officer Cini Zacharia

Phone 405-522-9078

Email cini.zacharia@omes.ok.gov

DESCRIPTION OF AMENDMENT

a. This is to incorporate the following:

On behalf of the State of Oklahoma, OMES gives notice of the following questions concerning this solicitation, received during the Q&A period, which closed on 09/22/2026 at 3PM. All questions and procurement /agency responses are detailed below:

Question 1:

Document: Portal Section: General Question 12, Exhibit 5 General Question 12 in the portal requires

Bidders to attach a completed Exhibit 5 - Security Assessment.

Question: The solicitation files did not include Exhibit 5. Can the State confirm whether

Exhibit 5 - Security Assessment is required?

Answer:

Fixed in our portal, there is no Exhibit 5. We have only 2 Exhibits for this solicitation.

Exhibit 1 – Technical Response Exhibit 2- Pricing Bidders are required to submit an Authority to Operate (ATO) or confirmation that an ATO has been requested using Bidder Instruction (7.6.5) An IT acquisition, attach security assessment review form. - See Attachment D.

Please note ATO is required.

Question 2:

Document: Attachment A mailto:cini.zacharia@omes.ok.gov

OMES FORM CP011 (11/2024) AMENDMENT OF SOLICITATION | Page 2 of 8

Section: 3.2.2 The bid response shall show the ability of the bidder to meet or exceed the following mandatory specifications.

Attachment A, Section 3.2.2 states that our response must demonstrate how we meet or exceed the “following” mandatory specifications. However, no mandatory specifications are provided in the attachment. Please clarify which mandatory specifications we are required to address in our response.

Answer:

Please disregard section 3.2.2 in Attachment A as there aren't any mandatory specifications listed under this section. Exhibit 1 - Technical Response and Attachment A contain all other requirements pertaining to this RFP.

Question 3:

Document: Bidder Instructions Section: 7.3.4 Disclosure Question: Please confirm where in the portal we should provide our response to the disclosures required under Solicitation Cover Page, Section 7.3.4 - Disclosures.

Answer:

You can submit with your bid response. For the submission of bid response – see Bidder Instruction Section 8.

bid shall be submitted solely via the Oklahoma Supplier Portal.

https://oklahoma.gov/omes/services/purchasing/supplier-portal.html

For help with the portal, please reach out to oksuppliers@omes.ok.gov

Question 4:

Document: Bidder Instructions Section: 7.6.5 For all IT solicitations, bidders are required to submit an Authority to Operate (ATO) or confirmation that an ATO has been requested using the steps below with their response.

Question: Bidder Instructions specifies that, "A copy of the ATO or confirmation of submission must be included in the bidder's response," however, the portal does not include a corresponding question to upload this attachment. Can the State clarify whether the ATO or confirmation of a submitted ATO Request Form is required with our response?

Answer:

You can submit ATO with your bid response.

For the submission of bid response – see Bidder Instruction Section 8.

Bid shall be submitted solely via the Oklahoma Supplier Portal link:

For help with the portal, please reach out to oksuppliers@omes.ok.gov

Question 5:

mailto:%20oksuppliers@omes.ok.gov mailto:%20oksuppliers@omes.ok.gov

OMES FORM CP011 (11/2024) AMENDMENT OF SOLICITATION | Page 3 of 8

Document: Bidder Instructions Bidder Instructions: Additional Terms 7.4.4 Requested exceptions should not be excessive, specifically not more than 10% of the terms and conditions provided by the State of Oklahoma in the solicitation. This may factor into the evaluation.

Question: Can the State please clarify if the Additional Bidder Terms in Bidder Instructions 7.5.1 count towards the 10% exception limit referenced in Bidder Instruction 7.4.4?

Answer:

The 10% limit referenced in section 7.5.4 of the Bidder Instructions applies only to a bidder's requested exceptions to the State's terms and conditions. Section 7.6.1 is in reference to additional terms submitted by the bidder.

Question 6:

Document: Portal Section: Line-Item Table; Line 5 Question: The Line-Item Table shows line 5 as Exchange Component CODEC Interfaces as Bid Mandatory. Will the State please clarify what Exchange Component CODC Interfaces means and if it is a mandatory requirement?

Answer:

The item labeled “Exchange Component CODEC Interfaces” appears to reference technology that was used in older versions of the statewide system. This type of hardware/software was historically used to transfer large data files between systems so they could be processed and used on the receiving end. Any mandatory requirements for this type of technology are detailed in Exhibit 1 - Technical Response.

Question 7:

Consistent with Bidder Instructions 7.6.2, for requirements written around a specific hardware form factor, will functionally equivalent approaches that meet or exceed the stated intent be accepted?

Answer:

This will need to be reviewed for each situation. Not all “meet or exceed” state intent will be accepted.

Question 8:

Attachment A (Purpose) and Exhibit 1 generally: Does the State have any requirement or restriction on where the Livescan application server and captured biometric data reside, for example on-premises at each agency, on a centralized state-hosted server, or in a CJIS-compliant vendor-hosted environment?

Answer:

The Livescan application and data must be resided on the livescan machine (on-premises).

Question 9:

Attachment A, Section 3.2.1 asks bidders to indicate whether each requirement is met by an out-of-the-box solution or requires customization. Will a response of 'met through configuration or customization' be treated as fully compliant and responsive, and is out-of-the-box capability weighted for any items?

Answer:

OMES FORM CP011 (11/2024) AMENDMENT OF SOLICITATION | Page 4 of 8

The Livescan must meet the “Standard Livescan Specification Document – 2026 Revision 07-08-2026”. If the livescan already meets this requirement out-of-the-box, customizations are not needed. If the out-of-the-box livescan does not meet the requirement, the vendor must make a customization change to the livescan / application to meet the requirement. Then, the vendor must work with OSBI to make sure the customization on the livescan meets State AFIS requirement and get certified by OSBI before the livescan will be allowed to submit fingerprint to State AFIS.

Question 10:

Attachment D and Exhibit 1 generally: Does the State provide or require a specific operator identity provider, such as a state Entra ID tenant or agency Active Directory, and does it require CJIS advanced authentication at the capture station?

Answer:

State does not provide an identity provider for the livescan. A vendor may work with local IT agency if this is needed or required by local IT policy.

Question 11:

Exhibit 1 (Standard Livescan Specification), Section 2.0, item 4 requires foot pedal switches for capturing prints. Would a hands-free, voice-activated capture control that performs the same print-capture function be acceptable as an alternative to, or in combination with, a foot pedal?

Answer:

Foot pedal switches are required. A hands-free, voice-activated capture control would be considered as an adds on feature.

Question 12:

Exhibit 1, Section 2.0 specifies a hardened metal cabinet with particular features.

Consistent with Bidder Instructions 7.6.2, are bidder-proposed cabinets meeting the security, ADA, and mounting intent acceptable, and does OSBI or OMES have a preferred or standardized cabinet specification?

Answer:

No specific. As long as cabinet meets requirement for Security (has key, lock, etc.)

ADA compliance, and place to mount camera, all equipment are secure inside.

Question 13:

Exhibit 1 distinguishes Type-1 (jail) stations (Section 2.0) from Type-2 (non-jail) stations (Section 3.0). Would the State clarify the intended distinction between the two station types, including the deployment scenarios each is meant for and which requirement sections apply to each?

Answer:

The application and software to capture the fingerprints and workflow are the same for both. The differences are the hardware, cabinet, etc.

The Jail (Type-1) will be more tough and secure since it will be in the Jail / Booking area. It will have more security, lock, etc. to prevent unauthorize to the equipment inside.

The Non-Jail (Type-2) can be more like desktop + scanner + camera. This is used for fingerprinting civil applicants. Can be used at Police Department, for capturing fingerprints for civil applicants. This type-2 doesn’t have to be “all-in-one” unit the same as Type-1 (Jail use).

OMES FORM CP011 (11/2024) AMENDMENT OF SOLICITATION | Page 5 of 8

Question 14:

Exhibit 1, Sections 4.1.1 and 5.5 require local printing at the capture station via a networked two-tray printer. Where an agency uses centralized or remote printing (Section 4.1.2), is local per-station printing still required at every site, or may centralized printing serve as the primary method with local printing optional?

Answer:

The livescan must be able to print fingerprint and/or necessary forms to printer. The printer can be connected to livescan directly via USB or IP address (called local printing). If this “local printing” is not available, livescan must have the ability to print to printer via “remote printing”. Remote printing may be accomplished by utilizing a centralized print server. The print server may be provided by vendor or local IT. State will not provide centralized print servers. If livescan can print via “local printing”, then “remote printing” is not necessarily needed.

Question 15:

Exhibit 1, Sections 4.1.2 and 5.13: What print server technology does the remote queue use, and who provides it? Is the FBI civilian card in Section 8.7 required for LVA or LVC, since 5.13 lists six form types and the appendix has seven? For 7.3.1, is a PDF emailed from the server acceptable?

Answer:

The print server may be provided by vendor or local IT. State will not provide centralized print servers. If livescan can print via “local printing”, then “remote printing” is not necessarily needed.

The FBI civilian card would only be required for LVC. Not LVA.

The PDF emailed from the server is not acceptable.

Question 16:

Exhibit 1, Sections 4.2.3 and 4.2.4: Does the Livescan submit only to OSBI, with OSBI forwarding to FBI NGI, or must the Livescan also generate FBI EBTS transactions for any workflow, such as police applicant or handgun license?

Answer:

Livescan ONLY submit to OSBI (using OSBI requirement). OSBI will be the one who forwards fingerprints to FBI NGI. Livescan is not allowed to submit directly to FBI NGI.

Question 17:

Exhibit 1, Section 5.4 specifies redundant Fast Ethernet cards with TCP/IP and NFS capability. Would alternative redundant, secure network connectivity that meets the same availability and CJIS requirements be acceptable if it does not use NFS specifically?

Answer:

YES

Question 18:

Exhibit 1, Sections 5.4, 5.15 and 5.19: What is the transport for submitting a transaction to state AFIS, for example file drop to an NFS share, SFTP, secure email or a web service?

Answer:

The transport will be via email. Livescan will email with attached NIST file to OSBI.

The connection between livescan and OSBI will be securely handle via VPN application provided by OSBI.

OMES FORM CP011 (11/2024) AMENDMENT OF SOLICITATION | Page 6 of 8

Question 19:

Exhibit 1, Sections 5.8 and 10.0: Is a vendor-published API that jail management systems push descriptor data into acceptable, or must the Livescan pull from each system? Must results such as OTN, TCN, SID and Hit or No-Hit be returned to the jail system? Is an interface specification for ODIS available?

Answer:

The livescan must provide the capability to interface and import data from Jail Management System (RMS) the jail uses for booking / release. How the livescan interface with the Jail RMS is up to the livescan vendor and RMS system. Most of the time, the RMS system will have provided the file exported from RMS and livescan will import those files into the livescan application.

The result, Hit, No-Hit is not required to be sent back to Jail / RMS system.

All the ODIS agencies have XML files that export from ODIS system for livescan to consume. It will be in the folder, and this folder will be shared to the livescan machine if needed.

Question 20:

Exhibit 1, Section 5.9: Is a scanner-SDK sequence check that matches rolled prints to slaps and detects duplicate fingers acceptable, or does OSBI require a specific minutiae extraction output?

Answer:

The scanner-SDK Sequence check that matches the rolled prints to slaps and detects duplicate fingers is acceptable.

Question 21:

Exhibit 1, Section 5.10 requires a provision for OSBI remote access using remote support tools. Which specific remote-access tools does OSBI require the device to support?

Answer:

Currently OSBI uses BOMGAR. With local IT agency approval, OSBI will work with vendors to get the BOMGAR access install on the livescan. This will allow OSBI access to the livescan for the audit purposes. This BOMGAR client access is provided by OSBI and only OSBI can use it. If vendors need access to livescan for remote support, vendors will need to use their own remote access application.

Question 22:

Exhibit 1, Sections 5.15 and 5.25: Does OSBI provide an AFIS test environment, sample transactions and sample responses, and a defined vendor certification process for a new Livescan supplier? What is the typical timeline, and are there any fees from the state AFIS vendor?

Answer:

Yes, OSBI has AFIS Test environment. If vendors need to work with OSBI to get a livescan certification, they will be working with OSBI AFIS IT. Normally it could take up to 6 months to get a new livescan certification. This depends on how fast the vendor makes changes to livescan application. The certification process is free. There is no fees involved.

Question 23:

OMES FORM CP011 (11/2024) AMENDMENT OF SOLICITATION | Page 7 of 8

Exhibit 1, Section 5.17 requires storage of at least 4,000 compressed bookings in case of network problems. For a server-based solution, would centralized server-side retention combined with local store-and-forward at the capture station during outages satisfy this requirement?

Answer:

It doesn’t have to be 4,000. OSBI would like the fingerprint to be saved on the livescan for a minimum of 3 months. Longer than 3 months is okay. This will help OSBI with the audit purposes. Those 4,000 numbers are a number that we assume for a 3-month period. It can be less.

Question 24:

Exhibit 1, Section 5.18 describes retrieving AFIS search results via secure email to a dedicated mailbox per Livescan. Would an alternative secure result-retrieval method that delivers the same Hit, No-Hit, or In-Progress result and operator acknowledgment be acceptable, or is the email-to-dedicated-mailbox method required? For example, in Missouri, we used a shared emailbox and had the software filter based on the ORI in the NIST Packet response. Would this be an acceptable alternative?

Answer:

NO. OSBI State AFIS will send response to specific livescan. Each livescan will have a dedicated mailbox assigned to it. Therefore, email-to-dedicated-mailbox method is required.

Question 25:

Exhibit 1, Section 5.19 requires support for a software VPN such as Juniper. Would an alternative secure, CJIS-compliant connection to the state AFIS be acceptable in place of a software VPN?

Answer:

Yes, OSBI will supply the VPN software. The VPN software will allow livescan to connect to OSBI AFIS network. Currently OSBI AFIS uses Absolute Secure Access.

But this could change in the future.

Question 26:

Exhibit 1, Section 5.24 requires a mirrored disk drive with RAID at the device for backup and restore. Would server-side redundancy with backup and restore satisfy this requirement in place of a mirrored disk at each capture station?

Answer:

No. We need all data kept on site at the agency. The data, fingerprint shall not be kept outside agency (cloud, vendor data center, etc.)

Question 27:

Exhibit 1, Sections 5.32 and 5.38: Does "software control for adjusting" mean pan, tilt and zoom driven from the Livescan software, or is a physically adjustable mount with software capture acceptable?

Answer:

This should be software control for adjusting. This will make taking a picture or mugshot or SMT easier. If this cannot be done via software, please state it in response.

Question 28:

Exhibit 1, Sections 5.33 and 7.2.2: In what format and by what channel does OSBI distribute charge code and applicant code updates, how often, and is a current copy available to bidders?

Answer:

The charge code normally gets updated once a year. We provided in PDF and Excel format. We normally post on OSBI AFIS website once it gets updated. There is some

OMES FORM CP011 (11/2024) AMENDMENT OF SOLICITATION | Page 8 of 8 situation that we may contact vendor to have some charge code added to livescan when we see the charge code is missing or needed.

Question 29:

Exhibit 1, Section 5.34 requires each capture station to be installed with Microsoft Windows 11. For a server-based solution where processing and data reside centrally, would a thin or browser-based capture client that meets all security and image-quality requirements be acceptable in place of a full Windows 11 workstation at each station?

Answer:

The livescan data must be kept on local agency. The data, fingerprint shall not be kept outside agency (cloud, vendor data center, etc.)

Question 30 Exhibit 1, Section 7.6 lists full palm capability (distal fingertips to wrist bracelet) as an added-value item. Is this scored as a present capability, or is a documented development and upgrade path acceptable for the added-value consideration?

Answer:

This is for future consideration. We are aware that currently, a “FULL” palm capture is not quite available. Most livescan will capture “upper” and “lower” palm. The best they can do are to “stich” them together to make it full palm. If a vendor can a “scanner” the larger enough to capture a “full palm” without stitching upper and lower palm together, this will be an added-value.

b. All other terms and conditions remain unchanged.

SIGNATURES

Supplier company name

Date

Authorized representative name

Authorized representative signature