Amendment #4 - Q&A - RFI PMAA 2027_0007.pdf

Amendment #4 - Questions & Answers (Q&A)

RFI PMAA 2027*0007

Wildlife Damage Claim Management System

A. The following questions, and the answer to each, were received:

1. Following this RFI, does CPW anticipate issuing a competitive solicitation

(e.g., an RFP), and if so, what is the estimated timeframe? Will participation in this RFI — including the candidate interviews referenced in the Schedule of Activities — factor into any subsequent solicitation?

i. CPW plans to issue a competitive solicitation at some point in the future following this RFI. At this time, there is not a specified timeframe for a competitive solicitation and ensuing contract. CPW anticipates that the competitive solicitation will take place sometime next calendar year. The RFI serves as a method to obtain preliminary information about a market or type of available service or product when there is not enough information readily available to write an adequate specification or statement of work. The information gathered from this RFI will aid in writing the official scope of work and requirements of a subsequent competitive solicitation, but will not be considered in evaluation of proposals submitted in response to a competitive solicitation as all vendors are provided fair and equitable treatment in review of proposals submitted to a competitive solicitation.

2. To help respondents right-size their solutions and provide meaningful cost estimates for CPW’s market research, does CPW have an established or anticipated budget range (or not-to-exceed) for the initial design/build phase, and separately for the ongoing annual support?

i. CPW does not have a current established or anticipated budget range for any component of this project. CPW will use the information provided through the responses to this RFI to determine a desired budget range for this project.

3. Section 3.5 requests three references from clients resembling CPW in size, scope of mission, and broad user base. Will CPW evaluate demonstrated capability on directly relevant commercial engagements — for example, external-facing claim/application intake portals, case-management workflow automation, and centralized document management — equivalently to public-sector references, provided the referenced work demonstrates the required functional capabilities? Is the

“size and broad user base” characteristic a scored threshold, or contextual background for evaluators?

i. This is for contextual background for evaluators

4. The requirements direct the vendor to provide the hosting architecture.

Will CPW/OIT accept a vendor-managed cloud environment (e.g., AWS or

Azure) that meets State security standards, or is hosting within the

Colorado OIT environment required? What security control baseline applies to this system (e.g., NIST SP 800-53 control level, SOC 2, StateRAMP), and does the CJIS Security Policy apply to any data elements?

i. CPW requests a hosted and managed cloud service. CPW will not be using OIT servers or resources. This will be completely vendor built, hosted, and maintained. This must be accounted for in the yearly maintenance fee structure.

5. The requirements reference an ideal bidirectional integration with CORE and notification of all paid claims across the value tiers ($1–$5,000, $5,001–$20,000, and over $20,000). Will the system be required to initiate payment disbursements, or to capture approvals and export payment-ready data to CORE for processing? Is CORE integration required at launch, or a future-phase objective?

i. Integration with CORE is not required for go-live. At a minimum

CPW would need to have an export or report feature that would allow for entry of the CORE transactions. If possible, provide a cost estimate for integration with CORE separately.

6. The project includes migrating historical data dating to the 1980s. To scope migration accurately, can CPW provide the approximate volume

(record and document counts), the current storage formats (paper vs.

digital, and any source systems), and confirm whether backfile scanning/digitization of paper records is in scope or has already been completed?

i. Approximately 11,200 historical claim records exist on a spreadsheet database, which would require early migration into the system. Additionally, paper documents in 3-4 horizontal file cabinets may be added to the system in the future as CPW works to get them digitized. The scanning/digitization of these records is not in the scope of this RFI.

ii. A small new database of approximately 200-300 investigation records will also be added to the system and these are currently stored in a JotForm database. Each of the 200-300 records contains multiple photos.

iii. Additionally, paper documents, which may include limited photos from 3-4 horizontal file cabinets may be added to the system in the future as CPW works to get them digitized. The scanning/digitization of these records is not in the scope of this RFI.

7. CPW notes openness to an off-the-shelf, customizable, or combination solution. Will the evaluation weight configurable commercial platforms and purpose-built/custom solutions equivalently, or is there a preference CPW can share to help respondents propose the best-fit approach?

i. There is no preference. CPW is open to all options as long as the system is vendor hosted and maintained. The only environment restriction is that CPW requires hosting on a Tier 1 cloud environment.

8. Are there page limits or a preferred submission structure (a single combined PDF versus separate technical, pricing, and workbook files)?

Should the completed Vendor Workbook narratives be provided inline within the workbook, as a separate narrative document, or both?

i. There are not any specific page limits or formatting requirements for a response to this RFI. CPW requests that responding vendors respond to all of the submission requirements outlined in section

3.0 of the RFI while keeping their response a reasonable length.

CPW prefers the narrative responses to be completed within the

Vendor Workbook and the workbook be submitted as its own stand alone document as part of the response.

9. Is there a current vendor providing this service? If so, could you please provide the current contract documents/information?

i. There is not a current vendor providing this service as this would be a new system implementation for CPW. CPW currently utilizes

PDFs and Google Forms/Sheets.

10.Does the department have an estimated timeframe for procurement?

i. See response to question 1.

11.Lastly, does the department have an estimated total contract value?

i. See response to question 2.

12.For the itemized loss valuation, only the livestock calculation is fully worked in the current materials; the other claim types (apiary, fence, growing crops, harvested crops, livestock forage, nursery, orchard, personal property, and the wolf itemized claim) reference their methods in

Chapter 17 but do not include the field lists, rates, or a worked example.

To help scope the calculation engine accurately, it would help to know

CPW's intended approach: will the RFP provide the per-type field lists and a worked example for each type, or does CPW intend these to be finalized jointly with the awarded vendor after contract execution? If it is simplest to leave this for later, we will assume the latter and price a configurable calculation engine that CPW and the vendor populate together post-award, with the livestock example as the format reference.

i. Please price as a configurable calculation engine. This will future proof the application to changes. Regulations change frequently that will impact the the calculations

13.Two questions on in-kind and fence handling: (a) The "Hay in Lieu of

Claim" form and the "Fence Materials in Lieu of Claim" form are referenced as substitutes for the Itemized Loss Statement, but their data fields are not defined in the workbook or appendices — could you provide the field lists for both? (b) Fence-damage eligibility is defined as damage exceeding 10% of the value of the specific fence, and normal-life presumptions are stated (panels 5 years; permanent fencing 20–30 years). Does the fence-damage settlement apply a normal-life depreciation schedule, and if so, what is the exact depreciation formula and how is the 20–30 year permanent-fence range resolved to a specific value for a given claim?

i. This RFI is for market research to inform requirements; CPW is currently seeking both a proposed solution and a price estimate.

CPW is not prescriptive on the specific field lists for 'In Lieu of' forms or the exact depreciation formula at this stage. The "Hay in

Lieu of Claim" form and the "Fence Materials in Lieu of Claim" are not regularly utilized as part of typical processes, but need to be made available. Please provide pricing based on the provided requirements as a baseline. CPW intends to finalize specific logic, field definitions, and workflows collaboratively during the post-award discovery phase.

14.For growing crops, harvested crops, and livestock forage, the average animal count appears to derive from a "percentage of time animals are in the crop" value and a "proportionate count" value, but the operation performed on these inputs is not stated. Could you please provide the exact arithmetic (and, ideally, a completed sample form) for the head-count / proportionate count calculation?

i. This RFI is for market research to inform requirements; CPW is currently seeking both a proposed solution and a price estimate.

CPW is not prescriptive on this specific technical or business logic at this stage. Please provide pricing based on the provided requirements as a baseline. CPW intends to finalize specific logic and workflows collaboratively during the post-award discovery phase.

15.Two points on wolf claims: (a) The Wolf Overview states the ratio for calves and sheep as 7:1 "if techniques are implemented" and 5:1 "if techniques are implemented," which appears to be a typographical error

— could you confirm that the 5:1 ratio applies when nonlethal conflict minimization techniques are NOT implemented? (b) One provision states a claimant may file only one itemized claim annually, while another permits multiple itemized claims when they relate to separate bands, flocks, or herds each with its own confirmed depredation. Could you confirm the governing rule so the system does not incorrectly block a valid multi-herd claimant?

i. Item (a): Ratio claim. Correct, this is a misprint and the 5:1 ratio is applied “if techniques are not implemented.”

ii. Item (b) The governing rule is that a single owner can file multiple itemized claims when that owner can establish that they had losses attributable to gray wolves on separate bands, flocks or herds as established by both geographical separation of the different bands, flocks or herds, and that there is not commingling of individual livestock between these geographically separate bands, flocks or herds.

16.Please clarify the following business rules the system must enforce: (a) the concrete detection logic CPW expects for preventing claimants from consolidating multiple claims into one high-value claim and from artificially splitting a large claim; (b) whether the mandatory onsite inspection threshold for claims over $1,000 applies to all big-game claim types (it is stated explicitly only in the wolf article); (c) how insurance payments and the claimant's duty to mitigate are to be applied against the calculated loss

(for example, subtracted before or after other adjustments); and (d) whether the "unreasonable restriction on hunting" eligibility determination should be recorded as a manager decision only, or must also incorporate the annually set harvest percentages by management area.

i. a) Duplicate Names and email are not acceptable. Multiple businesses should be placed under the same account.

ii. b) There is no $1,000 threshold for Big Game

iii. c) Insurance payments are applied first then Game Damage may cover excess losses.The claimant has a duty to mitigate by both statute and regulations. If they do not, their claim will be denied.

iv. d) The claimant has a duty to provide reasonable hunting access by both statute and regulations. If they do not, their claim will be denied.

17.Regarding the approximately 11,112 historical line items dating back to the

1980s: (a) what portion exists as structured spreadsheets versus semi-structured PDFs versus scanned images or paper requiring OCR or manual keying; (b) can CPW provide a representative sample set

(spreadsheets and PDFs) for profiling; and (c) does a "line item" correspond to a single claim, or may one claim span many line items?

Please also confirm whether uploaded binary artifacts (photos, scanned documents) accompany the historical records, or only tabular data.

i. Approximately 11,200 historical claim records exist on a spreadsheet database, which would require early migration into the system. This spreadsheet consists of one line per completed claim.

The spreadsheet contains PII which will not be released at this time. The headings on the spreadsheet are as follows: Claim #, DWM, Name, Company Name, Home/Mailing Address, City, (State if not CO), Zip Code, Primary Phone, Type, Damage Type, Species, Qty, Unit of Measure, Target, Claim Status, Action, DAU, GMU, Claim Amt, Claim Paid, Pending, Denied Amt, County, Type

Property, Notes, Start Date, End Date, Claim Date, Township, Range, Section, UTM.

ii. A small new database of approximately 200-300 investigation records will also be added to the system and these are currently stored in a JotForm database. Each of the 200-300 records contains multiple photos.

iii. Additionally, paper documents, which may include limited photos from 3-4 horizontal file cabinets may be added to the system in the future as CPW works to get them digitized. The scanning/digitization of these records is not in the scope of this RFI.

18.Migration will require close, ongoing collaboration with CPW, so it would help to understand how CPW expects to staff that partnership: (a) which

CPW role or team the awarded vendor would work with as the designated decision-maker for resolving conflicting or invalid historical values; (b) will

CPW approve the source-to-target field mapping and category crosswalks

(species, area, claim type, accounting codes) before migration executes;

and (c) which CPW role would validate and sign off on the migrated data, and what acceptable error/exception rate and reconciliation criteria would define acceptance for legacy data that may be imperfect at its source?

This question refers to roles, access to them, and the process, not specific individuals.

i. a) Big Game and Wolf Database program managers have been selected and work with other CPW staff to manage this process with the claimant.

ii. b) This RFI is for market research to inform requirements; CPW is currently seeking both a proposed solution and a price estimate.

CPW is not prescriptive on this specific technical or business logic at this stage. Please provide pricing based on the provided requirements as a baseline. CPW intends to finalize specific logic and workflows collaboratively during the post-award discovery phase.

iii. CPW will work with the vendor to create a spreadsheet with validation checks for the data before having the data uploaded to the database. CPW will scrub the records.

19.The requirements describe pushing approved payments to CORE via GAX and, ideally, receiving payment status back, but no interface specification is provided. Could you please clarify: (a) the integration surface the State will expose (documented API, secure file exchange/batch, or none), including the GAX record/field layout, authentication method, error handling, and reconciliation of accepted, rejected, and paid transactions;

(b) who is responsible for the CORE-side configuration and any OIT approvals required; and (c) whether respondents should price a specific integration option (bidirectional, unidirectional, or file-based/manual) or provide pricing for each tier?

i. CPW acknowledges that integration with CORE will be difficult.

CORE does have APIs but mainly it is pushing a structured data file to a specific file location. Integration with CORE is not required but a nice to have. At a minimum CPW would need to be able to manually get data out of the system to enter into CORE and the ability to manually enter claim information into the system from

CORE- Example: information for when a claim is actually paid.

20.Regarding the mapping capability: (a) does CPW have information on whether OnxHunt offers a supported integration API and a commercial license suitable for a government application, or would an equivalent mapping provider (for example Esri, Mapbox, or an open source basemap) be acceptable if OnxHunt integration is not feasible or cost-effective; and (b) what is the authoritative source of the "predator activity and/or environmental factors" and watershed data the system is expected to surface during pre-investigation planning (an internal CPW dataset, a third-party feed, or to be determined)?

i. The use of OnX Hunt is not a mandatory requirement. If OnxHunt integration is not feasible or cost-effective, CPW is open to equivalent mapping providers that offer comparable functionality.

CPW encourages vendors to evaluate the feasibility and propose the best path forward.

The inclusion of predator activity, environmental factors, and watershed data is intended to provide critical situational awareness for field staff, ensuring enhanced safety and investigative accuracy during the pre-investigation planning phase.

CPW does not have a pre-determined authoritative source for this data. CPW expects a hybrid approach leveraging existing internal

CPW datasets and/or relevant third-party data feeds. CPW looks to the successful vendor to propose the most reliable, sustainable, and scalable method to surface this information within the system.

[Reference: RFI Section III.D2.1.3; Section III.E2.10.2]

21.For the electronic signatures captured on claimant attestations and internal approval routing, what level of identity verification does CPW expect — for claimants (for example, an authenticated portal account and attestation) versus internal approvers — and is CPW expecting a specific certified e-signature service (such as DocuSign or Adobe Sign), or is an inapplication UETA/ESIGN-compliant capture with a tamper-evident audit trail acceptable?

i. CPW does not have a preference on product used as long as it is auditable. This application will be subject to CORA (Colorado Open

Records Act) requests that will require providing full audit trails.

22.For statutory notices requiring certified U.S. mail (approval and denial letters), should the system generate and track certified mailings directly

(via a print-and-mail or USPS-integrated service), or only produce the completed letter for CPW to mail manually while recording the tracking number, date sent, and date received? Additionally, does CPW have a preferred or required transactional email service for the system's outbound notifications?

i. . CPW does not have a preference for a transactional email service.

23.For the reporting data that CPW staff will consume in analytics tools such as Tableau, Power BI, and R, what connection method does CPW expect:

scheduled data extracts / file exports (for example CSV or Excel), a direct read-only database connection (ODBC/JDBC), or a read-only reporting

API/OData endpoint served from a governed reporting model? Is a file export capability sufficient for the initial system, or is live connectivity required at launch?

i. CPW would request a CVS export from generated or Ad Hoc reports should be part of the base reporting functionality. Read Only database access over ODBC/JDBC is what data analysts desire.

24.Two workflow points: (a) For denials, is there a single 10-day clock

(flagging the claim as a denial and processing it are the same window, measured from when all case documents are recorded), or two sequential

10-day windows (flag, then process) that could total up to 20 days? (b)

Could you confirm the authoritative, complete list of claim statuses the system must support and display, and the default notification matrix (which roles are notified by default at each status change)?

i. a) The claimant has 10 days to make a claim after experiencing game damage. See sites CCR Chapter 17-Game Damage, Search CO Revised Statutes

ii. b) Please see the RFP Appendices folder for some of this information. CPW will work with the awarded contractor to better establish this area of the Game Damage system.

https://www.sos.state.co.us/CCR/DisplayRule.do?action=ruleinfo&ruleId=3029&deptID=13&agencyID=134&deptName=400%20Natural%20Resources&agencyName=406%20Division%20of%20Wildlife&seriesNum=2%20CCR%20406-17 https://advance.lexis.com/container?config=0345494EJAA5ZjE0MDIyYy1kNzZkLTRkNzktYTkxMS04YmJhNjBlNWUwYzYKAFBvZENhdGFsb2e4CaPI4cak6laXLCWyLBO9&crid=2bac3331-601e-49d4-b818-85bed1d7ff99&prid=53397dd2-b6e1-4f7d-b9a1-19442ae8b82c

25.For the statutory deadline engine: (a) how is a good-cause extension requested, evaluated, and approved within the workflow, and what role has authority to grant it; and (b) for each enforced deadline (for example, the 10-day notice, 90-day proof of loss, 30-day settlement, and 30-day certified-mail pre-Commission notice), should the count use calendar days or business days, and how are weekends and State holidays handled?

i. a) The District Wildlife Managers follow the regulations outlining the good-cause extension procedures. It is a manual process documented in the claim. CPW does have a current Game Damage system so this is not currently automated.

ii. b) Calendar days

26.As we work through the appendices, a few places surface where the provided materials and what a vendor needs to scope the build do not quite line up; aligning on these would help firm up the RFP: (a) the complete, authoritative claim-type list would be helpful to confirm —

Appendix D enumerates nine, while Personal Property appears elsewhere, which suggests ten in total; (b) it would help to have the nursery-claim valuation and eligibility specifics, to match the type-specific overviews already provided for the other types; and (c) the workbook notes CPW is "considering" requiring higher-level manager approval to reassign a claim between areas — would CPW prefer this be built now as a configurable option, or deferred until the process is finalized?

i. To clarify, this is a Request for Information (RFI), NOT a Request for Proposals (RFP). See response to question 1 clarifying the goals of this RFI and when a competitive solicitation, such as an

RFP, would follow. See section 1.2 & 1.4 of the amended main RFI document posted with this Amendment 4 Q&A titled “Amendment

#4 - RFI PMAA 2027*0007 - Wildlife Damage Claim Management

System” describing the goals and purpose of this RFI.

ii. a) This is correct. There are ten (10). Nine (9) for big game and one

(1) for wolf.

iii. b) Please see appendix D for information about the nursery packet.

This information can also be found in the following regulations:

CCR Chapter 17-Game Damage, Search CO Revised Statutes.

Further information will be provided to the awarded contractor following a competitive solicitation.

iv. Defer until the process is finalized.

27.When a claimant and CPW negotiate the loss value, and when a claim is denied or an offer is unacceptable, how much of this should the claimant do through the portal? Specifically: (a) should the claimant be able to accept, reject, or submit a counter-offer to an offered value online, or is all negotiation conducted off-system with staff recording the result; and (b) should the claimant elect their review path (Commission review, arbitration, or small claims) and submit the required written waiver in the portal, with a portal-displayed countdown of the 10-day waiver window, or is that election recorded by staff?

i. a) Off-system with staff recording the result.

ii. b) Off-system with staff recording the result.

28.Should the system support a claimant (or staff on the claimant's behalf) withdrawing or cancelling a claim after it is opened — for example, when the damage was over-reported or otherwise resolved? If so, from which points in the process is withdrawal permitted, does it require CPW confirmation, and how should a withdrawn claim be represented for reporting purposes?

i. The system should allow for cancellation of a claim at any time up until payment.

29.For claims that go to the Parks and Wildlife Commission (all denials and claims over $20,000): (a) should the system schedule and manage the

Commission meeting date and bind claims to a meeting agenda, or only store a meeting date that staff enter; (b) since the required certified notice must be sent at least 30 days before that meeting, should the system validate this lead time automatically against the meeting date; and (c) how https://www.sos.state.co.us/CCR/DisplayRule.do?action=ruleinfo&ruleId=3029&deptID=13&agencyID=134&deptName=400%20Natural%20Resources&agencyName=406%20Division%20of%20Wildlife&seriesNum=2%20CCR%20406-17 https://advance.lexis.com/container?config=0345494EJAA5ZjE0MDIyYy1kNzZkLTRkNzktYTkxMS04YmJhNjBlNWUwYzYKAFBvZENhdGFsb2e4CaPI4cak6laXLCWyLBO9&crid=2bac3331-601e-49d4-b818-85bed1d7ff99&prid=53397dd2-b6e1-4f7d-b9a1-19442ae8b82c should the Commission's signed determination be returned to and stored in the system, given the Commission reviews an exported packet outside the application?

i. a) A separate system exists that is required for scheduling. CPW desires a process workflow checklist that includes regulatory compliance with rules.

ii. b) Yes that is the desired functionality

iii. c) An outside process exists that must be used. CPW must be able to mark in the workflow that it is complete.

30.For the statutory annual report and the aging and period metrics, on what fiscal-year basis should a claim be counted — the fiscal year of the damage, the fiscal year the claim was filed, or the fiscal year the claim was finalized or paid? This matters especially for wolf claims that may be deferred to December 31 or remain open into the following year for calving or lambing proof, where the damage year, filing year, and paid year can differ.

i. Under Colorado Revised Statutes § 33-3-111 (Annual report due by

January 31 annually to the general assembly), CPW’s Game

Damage Program is legally required to report.:

"The number of claims for damages submitted under this section, how many of those claims were settled and the monetary amounts of the settlements, the number of claims pending at the time of the report, the number of claims denied, and the reasons for denial."

31.It is clear CPW wants to manage its own forms without waiting on a code deployment. To size this correctly, it would help to know how far that self-management should reach: (a) Wording and layout — edit labels, help text, and how a form is arranged; (b) Fields — add or remove fields, and set each field's type, size, and whether it is required; (c) Logic and modifiers — edit the values and rules behind a form, such as calculation multipliers, thresholds, and workflow or routing settings. Which of these levels does CPW expect to manage directly, and which would be acceptable to handle as a maintenance request?

i. CPW will place a maintenance/change request for changes to any of this information.

32.The duplicate-detection requirement refers to comparing a "landowner's unique identifier" against historical claims. What is that unique identifier

(for example, a CORE Vendor Code, a tax identification number, or a system-assigned ID), and what match tolerance does CPW expect — should any single matching data element flag a potential duplicate, or should matching be weighted across identity, location, date, and species/type to avoid over-flagging?

i. CPW has not determined this yet.

33.For the reference data the system needs to operate at launch — the 4 regions and 18 areas with their office routing, the user levels and role/permission definitions, claim-type configuration, covered-species lists, notification and denial letter and form templates, and CORE accounting/fiscal codes — which of these values will CPW provide, and which does CPW expect the vendor to derive and submit for approval?

i. CPW will provide all reference data. CPW expects this to exist as a line item in the project plan to effectively manage vendor and CPW expectations on delivery.

34.For internal CPW staff single sign-on, will CPW or the Governor's Office of

Information Technology (OIT) provide an identity provider — for example, Microsoft Entra ID (Azure AD) — that the system federates against, and does CPW require SAML 2.0 or OpenID Connect (OIDC)? If a State identity provider is available, can its published federation metadata (entity

ID, sign-in/sign-out endpoints, and signing certificate) be shared with the awarded vendor for configuration?

i. Internal staff single sign on is not required. User management of both internal CPW staff and external claimants can happen fully in the new application. Multi Factor Authentication is desired but not required.

35.Two support questions: (a) The workbook states help-desk/support hours as Monday - Friday 9:00 a.m.–5:00 p.m. MST in one section and 8:00 a.m.–5:00 p.m. Mountain Time in another — could you confirm the intended support window? (b) By "dedicated, full-time support team," does

CPW mean named staff assigned exclusively to CPW, or a support team with guaranteed availability and response times? For the text and chat channels specifically, what response-time SLA does CPW expect — for example, a target time within which a text or chat message is answered during support hours?

i. Monday - Friday 9:00 a.m.–5:00 p.m. MST will be the support hours.

ii. Support team with guaranteed availability and response times.

Strictly dedicated is not necessary. CPW to have a critical application issue that someone will be able to respond to quickly.

For context, on similar projects, CPW usually works with the same vendor Project Manager that assists CPW with working the backlog and provides operational reporting.

36.The hosting requirements mandate redundancy, off-site storage, and disaster recovery but do not state recovery objectives. What are CPW's target Recovery Point Objective (maximum acceptable data loss) and

Recovery Time Objective (maximum acceptable time to restore service), and is periodic disaster-recovery / restore testing expected?

i. Any of the tier 1 cloud environments like Google, AWS, Azure, provide the redundancy, backup and recovery that CPW requires.

37.Regarding the SLA and performance requirements: (a) the Medium and

Low incident goals describe "requested changes to address inefficiencies" and "requested changes for convenience," which read as enhancement requests rather than incidents — should these be handled under the incident SLA or drawn from the monthly support-hour allocation; and (b) the requirement for a "responsive application" and "health and performance expectations" is stated without a quantified target. So that every respondent prices to the same realistic standard for a system of this size and transaction volume, would the following be acceptable as the performance and availability baseline: 99.5% availability measured annually during the agreed support window; typical page loads completing in under 3 seconds and routine interactive actions in under 2 seconds under normal load; and standard maintenance performed in a prenotified off-hours window?

i. The medium and low issues should be placed in the backlog and worked as time allows. High issues also pull from the 50 hours but may push out some planned medium and low priority. Critical issues that impact the usability of the system or prevent workflows from executing will be defined in the SLA.

ii. CPW desires to see suggested approaches and language as part of the responses submitted to the RFI for market research. Please include any suggested language or approaches as part of the response for CPW to review following the submission deadline.

38.To help size storage and design the offline field-capture feature, it would help to understand CPW's expectations for evidence files — and rough estimates are perfectly fine if exact figures are not known: (a) a typical and maximum file or video size per upload; (b) roughly how many evidence files, and about how much total data, a typical investigation and a full year might involve; and (c) how long a field device might need to work offline before it can sync. If it is easier, we are glad to propose sensible defaults

— for example, per-file size limits and a supported offline duration — for

CPW to confirm, so this does not require gathering precise numbers now.

i. a) CPW does not currently share video files. CPW desires to have videos in the system and is open to recommendations for limiting/reducing filesize.

ii. b) Each investigation has 5 to 10 photos. The file size is whatever is on the phone. CPW desires to reduce the file size to a reasonable amount (1 to 2 MB). Please see previous answers on the average number of investigations per year.

iii. c) Field staff could potentially be offline for multiple days at a time, but more commonly would be offline for less than a day. Field staff averages 1 to 2 investigations per day.

39.Acceptance is stated to require fixing all severity 1 and 2 defects and meeting "minimum viable requirements" with no critical issues. Does CPW have an existing defect-severity classification (definitions of severity 1 through 4), or should the vendor propose one for mutual agreement, and how does CPW distinguish "minimum viable requirements" from the full

Statement of Work for release purposes?

i. Provide one for mutual agreement. Depending on the nature of the system, CPW has different definitions. Example: Law enforcement applications have different severity requirements than say a water quality lab application.

40.Beyond the relatively low annual claim volume described in the RFI (on the order of a couple hundred claims per year), what is CPW's expectation for peak concurrent system users — for example, the number of internal staff and external claimants likely to be active at the same time during seasonal peaks — and are there any anticipated bulk or event-driven load events (such as a large depredation event, or migration and reporting cycles) that the hosting environment should be sized to absorb?

i. The most claims are submitted in the fall. There 18 CPW area offices. At peak usage, all 18 area office users could potentially be in the system at once either entering claims or managing the claim.

41.The Vendor Workbook describes a 10-year engagement (an initial one-year term plus nine one-year extensions), while the State IT Model

Contract §2 states the total duration including extensions shall not exceed five years absent Chief Procurement Officer approval. (a) Could you confirm the intended maximum contract term and how these two provisions are reconciled? (b) For the annual extensions, what governs whether each one-year extension is granted — a defined set of performance measures (for example, SLA attainment, uptime, and defect resolution targets), or CPW's discretion? If CPW uses an established rubric or scorecard for the extension decision, understanding it up front would help us align our service commitments to the standard being measured.

i. The Mandatory Provisions require that a contract that is subject to the procurement code may not exceed 5 years in length. However, a contract may exceed 5 years in length if prior approval is granted by the Chief Procurement Officer before the solicitation is posted.

Before conducting a competitive solicitation, CPW anticipates submitting a request to the Chief Procurement Officer for the contact following the solicitation to be 10 years in length. The competitive solicitation, including the model contract attached to the competitive solicitation, will reflect the approved contract length by the Chief Procurement Officer once.

ii. CPW’s discretion, including monitoring a defined set of performance measures, available CPW budget year to year, etc.

Reporting and Performance measures and monitoring will be outlined in the final contractual Statement of Work for clear deliverables and guidelines that must be met annually and through the duration of the contract. CPW expects monthly operational reports and an associated meeting to discuss the report as well as planning what items to work on next month’s backlog. The meetings surrounding these reports and creation of these reports can come out of the 50 hours per month.

42.Separately from the contract term above, the materials cite several data-retention periods for the records the system holds — a 3-year minimum in the payment workflows and Model Contract, at least 10 years for claims and documentation, and indefinite (approximately 50-year) document archiving. Could you confirm the authoritative records-retention and archiving requirement the system must meet, and whether the indefinite / 50-year archive applies to all records or only specific document types? We interpret the long-term (approximately 50-year) retention requirement as an obligation to keep the records in a modern, non-proprietary, and portable storage format that can be exported and handed to a successor caretaker in a standard, mutually acceptable form

— with the handover format and method agreed at the outset of the contract — rather than a commitment by the vendor to host or support the system for the full retention period. Could CPW confirm this interpretation is acceptable?

i. Please provide the suggested approach for CPW to consider as part of the market research resulting from the responses submitted to this RFI. This interpretation is acceptable.

43.For a system of this size and function: (a) does CPW/OIT anticipate requiring an annual SOC 1 Type II report (that is, will this system be deemed to impact the State's financial reporting); and (b) for the SOC 2

Type II requirement, would an alternative such as an independent penetration test plus vulnerability scanning satisfy the requirement, as

Exhibit C appears to allow at the State's discretion?

i. Annual SOC1 type II report is needed.

ii. Independent penetration testing is acceptable. OIT has recently started performing penetration testing of Vendor websites. OIT’s penetration testing will satisfy this requirement.

44.The cyber-liability insurance limits scale with the total number of records held (under 1,000,000 records maps to the $1M/$2M tier). Based on current and projected claim volumes, can CPW confirm the expected total record count over the contract term so the appropriate insurance tier can be sized?

i. See response to question 6 (200 claims per year times 10 years =

2000 records).

45.To scope the applicable security and compliance obligations: (a) could

CPW confirm that wildlife damage claims do not involve Protected Health

Information, so that the Exhibit E HIPAA Business Associate Agreement can be marked not applicable; and (b) are claimant tax identification numbers collected for reimbursement treated as Federal Tax Information

(FTI) under the Model Contract, or solely as PII?

i. Protected Health Information will not be applicable to this contract and that provision will be removed for the model agreement, posted with the competitive solicitation.

ii. Solely PII. The “Tax Information” provision in the OIT Model

Contract will not be included as part of the agreement with the awarded contractor following the competitive solicitation.

46.Does CPW want any AI-assisted capabilities in the baseline system (for example, automated claim triage, document classification, OCR beyond basic text extraction, or natural language reporting/charting), or should AI features be excluded from the initial scope to avoid the Colorado AI Act high-risk-system obligations?

i. No AI feature can be included as part of this project. . AI may be used for code generation if desired.

47.For public-records (CORA) production: (a) what output format does CPW require for released records (for example, a PDF bundle, redacted native documents, or a spreadsheet for line-item requests); (b) must the system produce a released/withheld disclosure log citing the statutory basis for any withholding; and (c) must redaction of claimant personal information reach into free-text narratives, letter bodies, and evidence-image metadata, or is it limited to structured data fields — with the understanding that payout and line-item pricing amounts are open records and are never redacted?

i. a) A CORA request could be for general summated information

(number of cases, number of dollars paid out, and it could be by area offices) or it could be for specific individual records.

ii. b) The awarded contractor will not have to keep a disclosure log. A separate system and team exists in CPW for this purpose.

iii. c) CPW will handle redactions.

iv. This will generally fall under a general ad hoc reporting functionality that can be exported to a spreadsheet.

48. Sections 3.1 and 3.1.1 appear to conflict on the response submission channel: §3.1 states that hardcopy and email responses will not be accepted, while §3.1.1 provides specific instructions for submitting a response by email (including a required subject line and a 1–2 business-day acknowledgment). So the final RFP is unambiguous for all respondents, could you confirm the authoritative channel for the quote response — Vendor Self Service (VSS) only, or is email also accepted?

i. Email responses are acceptable. See section B below outlining the correction made as part of this amendment to clarify this error.

49.How many backend users do you anticipate being in the system at the same time?

i. Please see response to question 40.

50.Is there a requirement for the system to have offline mobile capabilities?

i. See response to question 38. Offline is needed as the Wildlife

Officers entering Claim damage may often have no cell coverage or

WIFI. A Progressive Web App (PWA) is acceptable.

51.For Data migration: What is the current database size? What type of database? Or is all the data currently contained only in PDF and

Spreadsheet form?

i. See response to questions 6, 17 & 18.

52.For Digital Signature is having a user re-enter their password acceptable, or is CPW looking for an integration with Docusign or something similar for a true digital signature?

i. CPW desires to see suggested solutions provided by vendors as part of the responses submitted to this RFI. The solution suggested in the question is acceptable. CPW will need to be able to audit approvals for potential CORE requests or legal disputes.

53.How many claims are received on an annual basis?

i. Low volume. In FY25, the program settled 218 total damage claims with compensation costs that amounted to $698,704. In FY25, CPW denied five claims, which equates to 2.2% of claims filed.

54.Landowners/Producers: Please confirm the assumption that they are just reporting claims and uploading damage packets and submitting forms

i. There is an approval workflow for Landowners. By error of DNR, the SOW was not posted when this RFI was released. Amendment

#1 was posted in VSS on 7/31 adding a link to the SOW in the RFI additional attachments in section 1.9. Please refer to the document labeled “Wildlife Damage Claim Management System RFI Draft

Scope of Work”.

55.Internal users: Please advise how many fall into each of these categories:

i. Full Access, Read-Write Users: 25

ii. Light Access Users (Read access with the ability to update/add notes, add documents): There are many wildlife officers in CPW.

Officers will all need to be able to add a claim as well as move the claim through the process. This will require about 200 users due to the additional functionality.

iii. Read/Only, Reporting Users: 40

56.Requirement A-3 directs respondents to “see more Cyber Security requirements in the Cyber Security Requirements section.” Having reviewed the Draft Scope of Work in full, we do not find a Cyber Security

Requirements section in that document or elsewhere in the posted package. Will CPW publish that section prior to the response deadline, or should respondents treat Requirement A-3 — compliance with OIT requirements concerning State Information — as the complete statement of cyber security scope for purposes of this RFI?

i. By error of DNR, the SOW was not posted when this RFI was released. Amendment #1 was posted in VSS on 7/31 adding a link to the SOW in the RFI additional attachments in section 1.9. Please refer to the document labeled “Wildlife Damage Claim Management

System RFI Draft Scope of Work”.

57.Requirement A-5 directs respondents to “refer to the Accessibility

Requirements section” for details on CPW’s accessibility requirements.

We do not find an Accessibility Requirements section in the Draft Scope of

Work or elsewhere in the posted package. Will that section be published, or should respondents rely on RFI Section 4.7 and the accessibility provisions of the attached Model Contract as the governing statement?

i. By error of DNR, the SOW was not posted when this RFI was released. Amendment #1 was posted in VSS on 7/31 adding a link to the SOW in the RFI additional attachments in section 1.9. Please refer to the document labeled “Wildlife Damage Claim Management

System RFI Draft Scope of Work”.

58.In the absence of a Cyber Security Requirements section, can CPW confirm the expected security control baseline? Specifically: (a) whether compliance with OIT’s published security policies and standards constitutes the governing baseline, or whether an additional framework such as NIST SP 800-53, SOC 2 Type II, StateRAMP, or FedRAMP authorization is required; and (b) whether any of the conditional exhibits referenced in the Model Contract — IRS Publication 1075 for Federal Tax

Information, the CJIS Security Policy, or the HIPAA Business Associate

Agreement — will attach to the resulting contract.

i. By error of DNR, the SOW was not posted when this RFI was released. Amendment #1 was posted in VSS on 7/31 adding a link to the SOW in the RFI additional attachments in section 1.9. Please refer to the document labeled “Wildlife Damage Claim Management

System RFI Draft Scope of Work”.

ii. See response to question 45 clarifying part (b) of this question 58.

59.The claimant forms require collection of a completed IRS Form W-9, including the Taxpayer Identification Number, and require the system to validate W-9 field values against the Proof of Loss form. Does CPW classify the TIN or SSN data collected on the W-9 as Tax Information subject to a specific safeguarding standard, or is it treated as PII under

§§24-73-101 et seq., C.R.S.? Does CPW require that this data be tokenized, encrypted at the field level, or logically segregated from the primary claim record?

i. See response to question 45.

ii. The State requires the data be encrypted during transport and at rest.

60.Comparing the Draft Scope of Work against the Vendor Workbook, the requirement counts align section by section, but the requirement text differs in several places and the Draft Scope of Work carries substantive content the Workbook omits. Three examples: Requirement A-6 in the

Draft Scope of Work additionally requires that system or program administrators be able to add or change the species compensated for and the timelines and information required for compliance; Requirement A-13 additionally requires that CPW staff be able to override claimant form deadlines with a documented reason drawn from a CPW-defined list; and

Requirement G-3 includes an extensive “Users’ Key Tasks” matrix mapping ten named role groups to the five user levels, including that

Wildlife Damage System Administrators may enter data after a claim is closed and may close claims to prevent further entry by other users. None of that appears in the Vendor Workbook. Where the two documents differ, which governs for purposes of responding — and for the scope of a subsequent solicitation?

i. By error of DNR, the SOW was not posted when this RFI was to the SOW in the RFI additional attachments in section 1.9. Please refer to the document labeled “Wildlife Damage Claim Management

System RFI Draft Scope of Work”.

61.Section III of the Draft Scope of Work states that the requirements presented are high-level and that more detailed requirements will be defined after an awarded contract has been established. Respondents are separately asked to price the initial phase to design, develop, test, and implement the system. How does CPW envision reconciling a firm price developed against high-level requirements with a detailed requirements definition that occurs post-award? Specifically, does CPW anticipate (a) a separately scoped discovery and requirements definition phase preceding a priced build, (b) a not-to-exceed or time-and-materials structure for the initial phase, or (c) a firm fixed price for the build with detailed requirements governed through the change management process described in Section VI?

i. See responses to questions 1 & 2. The purpose of this RFI is to gain an understanding of what the costs may be to build it. With regard to requirements, once the vendor is awarded resulting from the competitive solicitation and work begins following execution of a contract, there will be a discovery phase where CPW and the awarded contractor will review in more detail (Field level detail/data types for example) and the findings of the discovery phase will need to be documented. If major changes arise after requirements are finalized during discovery, then the change management process will need to be followed.

62.The Draft Scope of Work describes a recent cross-functional Lean process improvement initiative that mapped the current depredation investigation process, identified challenges and redundancies, and produced recommendations including developing a claim management database, streamlining claim forms, and developing damage…