Question & Inquiry Form

-AWS Lambda (primary compute) -Amazon API Gateway (REST and WebSocket) -Amazon Aurora PostgreSQL (relational database, Multi-AZ with RDS Proxy) -Amazon DynamoDB (session data, audit events, distributed locks) -Amazon S3 (biometric image storage, configuration, archival) -Amazon CloudFront (CDN for web application delivery) -AWS WAF (web application firewall) -Amazon SQS / SNS (asynchronous messaging) -Amazon EventBridge (event-driven orchestration) -AWS Step Functions (workflow state machines) -AWS Cognito (authentication, MFA, user pools) -AWS KMS (encryption key management) -AWS Secrets Manager (credential storage) -AWS Systems Manager Parameter Store (configuration) -AWS AppConfig (feature flag management) -AWS CloudWatch / X-Ray (monitoring, logging, tracing) -Amazon Route 53 (DNS, health checks, failover) -AWS CDK (infrastructure as code deployment) -Amazon VPC with VPC Endpoints, NAT Gateway, and Site-to-Site VPN -AWS IAM (identity and access management) AWS services themselves are not restricted. However, for authentication, the State requires that all identities be authenticated through State‑managed identity providers — specifically Okta for vendor accounts and Access Indiana for application end users.

Because of this requirement, AWS Cognito cannot serve as a standalone authentication source. Cognito may be used only as a federation layer downstream from the State’s identity providers, not as the authoritative identity store.

1. Would the selected vendor be granted a CI/CD pipeline execution role within the Indiana GovCloud account with sufficient permissions to deploy and update CDK stacks, or does Indiana require all infrastructure changes to be submitted to a state team for deployment?

2. If a pipeline role is permitted, what is the process for defining and approving the IAM permissions boundary for that role?

-Account & Network Administration — Who owns VPC configuration, security groups, subnet management, VPN/Direct Connect connectivity, and DNS?

-IAM & Access Control — Who provisions and manages IAM roles, policies, and permission boundaries for the application workloads?

-Monitoring & Incident Response — Who is responsible for infrastructure-level alerting (CloudWatch alarms, health checks) vs. application-level monitoring and on-call response?

-Patching & Updates — Who manages OS-level/runtime updates (Lambda runtime deprecations, Aurora engine upgrades) vs. application code deployments?

-Backup & Disaster Recovery — Who configures and validates backup policies, cross-region replication, and failover procedures?

-Security & Compliance — Who is responsible for ongoing CJIS audit evidence, vulnerability remediation, and security scanning of deployed resources?

-Cost Management — Who manages resource tagging, budget alerts, and cost optimization for the ABIS solution's workloads?

Is there an existing shared responsibility model or RACI matrix that Indiana uses for vendor-deployed applications in State-owned cloud environments?

The Vendor shall perform all development, maintenance, operation, and hosting of the Solution, including all applications, software, and data within State funded data centers and State funded Cloud environments, unless the State provides prior written approval authorizing an exception. The Indiana Office of Technology (IOT) will provision and maintain a dedicated, State-owned Cloud tenant to support the Vendor’s Solution. IOT will grant the Vendor appropriate tenant level access necessary for implementation, configuration, and ongoing support. The Vendor shall be fully responsible for all activities, configurations, operational tasks, system management, security administration, and maintenance performed within the State-owned tenant. The Vendor shall comply with all State of Indiana data governance, security, privacy, and regulatory requirements applicable to the Solution, including adherence to NIST 800-53 security controls in State approved policy and standards. The Vendor must remediate all identified security issues in a timely manner consistent with industry best practices and State policy. The Vendor shall provide a quarterly Security and Compliance Report to IOT and verify adherence to all required controls, documenting vulnerability remediation status, summarizing audit activity, and identifying any deviations or exceptions.

1. Does the State enforce a permissions boundary policy that all Lambda execution roles must be created under? If so, can we review the boundary policy to confirm it permits the AWS service actions our solution requires (e.g., rds-data:ExecuteStatement, s3:GetObject/PutObject, dynamodb:Query/PutItem, sqs:SendMessage, states:StartExecution, cognito-idp:*)?

2. Are there Service Control Policies (SCPs) at the Organization or OU level that deny specific actions or services outright (e.g., deny iam:CreateRole without a tag, deny access to certain regions)?

3. Can CDK-generated roles use inline policies, or does the state require all policies to be customer-managed policies registered in a central catalog?

4. Is there a maximum policy size or role count limit imposed beyond AWS defaults?

1. Does Indiana's GovCloud environment already have a paired commercial account for edge services, or would the selected vendor need to provision one within the State's AWS Organization?

2. If the State operates its own commercial edge account, can the selected vendor deploy CloudFront distributions and Route 53 hosted zones into it, or does the State manage those resources and provide CNAME/alias delegation?

3. If the selected vendor must use its own commercial account for CloudFront and Route 53 (as we do for other GovCloud deployments), is that acceptable from a security and governance standpoint — given that no CJIS data is stored or processed in the commercial account (it acts solely as a TLS-terminating pass-through to the GovCloud API endpoints)?

Can the State please provide the # of users expected to be trained for each:

The requested extension would allow vendors sufficient time to complete due diligence activities, identify and engage qualified partners, and prepare thorough responses that best support the State's objectives. In particular, we have experienced challenges accessing IVOSB certification information through the links referenced in the RFP, which has made it more difficult to identify and engage qualified partners within the current schedule.

Additionally, several major biometrics industry events occur during the proposal period, including the International Association for Identification conference (August 16–22) and Identity Week America (September 2–3). These events involve many of the subject matter experts, technology providers, and partners who are critical to developing complete and responsive proposals.

Please clarify whether the amounts entered in Attachment D rows 28–33 are intended to represent:

Estimated AWS or Azure consumption charges that will be paid directly by the State for a solution deployed in the State-Owned Cloud Tenant;

Hosting and environment costs incurred by the Respondent and included in the amounts payable to the Respondent when proposing a Vendor Hosted Cloud Tenant; or The applicable type of cost based on the hosting model proposed by the Respondent.

For a proposal using the preferred State-Owned Cloud Tenant, please also confirm whether estimated AWS or Azure consumption charges must be included in the five-year Total Bid Amount and evaluated price, or whether they must instead be provided separately as informational estimates for the State’s total-cost-of-ownership evaluation. Respondents should submit two separate and distinct cost proposals: one for a Vendor Hosted Cloud Tenant solution and one for a State-Owned Cloud Tenant solution. Each cost proposal must include a corresponding comprehensive Cost Proposal Narrative, as outlined in section 2.5 of the RFP, along with detailed Assumptions, Conditions, and Constraints. Respondents should provide thorough costing outlines that clearly explain how total costs are derived for each model. Use the response to question 30, as well as others outlined in this document and the RFP packet, to inform the response for the State-Owned Cloud Tenant solution cost proposal.

The State will review and assess both cost proposals provided and determine which approach best meets the State’s needs.

To permit a meaningful and consistent evaluation, please consider requiring the supporting cost model to identify, at a minimum:

- The cloud provider, region or regions, and proposed Availability Zone and disaster-recovery topology;

- The cloud services, resource types, configurations, quantities, and expected utilization for each environment and contract year;

- Compute and biometric matching capacity;

- Managed database services, editions or tiers, instance sizing, storage, I/O, replication, backup, and recovery configuration;

- Object, file, and block storage by type, including starting volume, retention assumptions, annual growth, backup copies, and disaster-recovery copies;

- Network connectivity, data transfer, ingress, egress, load balancing, and related services;

- Monitoring, logging, cybersecurity, backup, and operational-management services;

- Workload, transaction-volume, concurrency, performance, availability, RPO, RTO, retention, and data-growth assumptions;

- Pricing assumptions, including State enterprise pricing, applicable discounts, reservations, Savings Plans, committed-use arrangements, licensing models, and other cost-optimization assumptions; and

- The estimated cost by environment, service category, contract year, and base or optional contract period.

Please also confirm whether the State will either provide a common cloud-pricing basis for all Respondents—including applicable State enterprise discounts and other relevant State charges—or apply a common pricing basis centrally to each Respondent’s submitted cloud resource bill of materials.

Because these cloud-consumption charges would be paid directly by the State rather than being a fixed-price obligation borne by the Respondent, an unsupported or materially understated estimate could artificially reduce the evaluated total cost of ownership without creating a corresponding financial obligation for the Respondent. To support a fair comparison, please confirm that the State may validate and normalize the State-paid cloud-consumption component used in the TCO or price evaluation when an estimate appears materially inconsistent with the proposed architecture, required service levels, workload, data growth, or other RFP requirements.

Before making any upward or downward normalization, please confirm that the State will:

1. Provide the affected Respondent with the assumptions, calculations, and basis for the proposed adjustment;

2. Allow the Respondent a written opportunity to explain and substantiate its submitted estimate, including any architecture, utilization, licensing, commitment, or AWS/Azure cost-optimization approach that supports a lower cost;

3. Consider the Respondent’s supporting technical and financial evidence before finalizing the normalized estimate;

4. Apply the same review methodology and common pricing assumptions consistently to all Respondents; and

5. Treat any State normalization as an adjustment to the TCO used for evaluation only, without changing the Respondent’s contractual Total Bid Amount unless the Respondent formally revises its Cost Proposal through the permitted clarification or BAFO process.

Att K, Page 19 simply requires the contractor to provide staffing to meet requirements: "The Vendor will provide Maintenance and Operations services for the system after implementation. These services will support the stability, performance, and ongoing functionality of the system for all users. The Vendor will provide staffing, processes, monitoring, and support activities needed to sustain operations and meet the requirements defined by the State. The Vendor will maintain all services at the performance levels required in the contract and described in the Service Levels and Performance Remedies section."

Please clarify if the contractor is required to provide a customer approved level of staffing for M&O support during the contract period or if the contractor has discretion to alter staffing levels necessary to meet contract M&O performance requirements and service levels. The SOW does not require a fixed, pre‑approved M&O staffing level during the contract. Attachment K, page 19 requires the Vendor to provide whatever staffing is necessary to meet all M&O performance requirements, giving the Vendor discretion to adjust staffing as needed as long as service levels are met.

Attachment K, page 22 adds a specific restriction for the turnover period: the Vendor may not reduce operational staffing levels without prior written State approval.

Additionally, the SOW requires State approval for any changes to Key Persons. While the Vendor may adjust general staffing to meet performance needs, any Key Person changes must follow the defined approval process, and the State expects awareness of adjustments that materially affect delivery and operations.

Att K Att P 1 5,7,9 8 Two-finger ID, a.k.a. "Fast ID" Att F, Page 1 labels mobile two-finger search as optional.

Att K, Pages 5, 7 & 9 list 2-finger FAST ID as required, however, Page 8 labels it as optional.

Att P, Row 4 identifies two-finger mobile identification and related workflows as required.

b) configure the 2-finger collection devices,

c) maintain and provide technical support for the 2-finger collection devices,

d) train users in device operation,

e) maintain spares, and

Att P, Requirement P-032 states, “Support integration with state SSO,” is designated optional.