RFP 26-85939

Purpose:

The purpose of this solicitation is to select a vendor that can satisfy the State’s need to provide a fully functional learning management system (LMS) to meet State and Federal requirements by administering numerous agency specific training courses for the FSSA Privacy & Security Office (PSO) and the Division of Family Resources (DFR).

The FSSA PSO utilizes custom, agency specific training modules to comply with privacy and security standards for CMS ARC_AMPE, the Social Security Administration, HIPAA, State and FSSA policies and procedures, and numerous Federal requirements under 45 CFR §164.530 (b)(1-2).

The DFR utilizes custom, division specific modules to train staff on services provided by DFR to qualifying Hoosiers.

Objectives:

• Procure a solution that provides a user friendly interface for management staff and trainees. Ensure the tool can easily load FSSA developed training modules and retain all historical training modules from the current solution.

• Provide quick access to audit logs for management to prove user training compliance and completion.

• Ensure seamless retention of historical user training records with the ability to audit in real time, and robust reporting.

Solution Configurability and Customization Preference:

The State prefers a solution that meets requirements of out of the box functionality with minimal customization. The State expects the selected Respondent to act as a partner to help identify potential business process changes that leverage out of the box or configuration options and reduce or eliminate the need for custom code. To help facilitate this, the selected Respondent must document the out of the box configuration options evaluated before proposing any customization and must demonstrate why configuration cannot satisfy the requirement.

Customizations should be considered only when one or more of these criteria apply: the requirement is necessary to meet a federal reporting requirement or regulation; the requirement is necessary to meet a state law, regulation, or rule; the requirement is necessary to satisfy state security requirements; the requirement is necessary to interface or integrate with state systems; or the requirement will produce a material improvement in service delivery, partner interactions, or utilization of state resources. Material improvements must be documented, justified, and presented to the Project Steering Committee for review.

All customizations require written approval from the Project Steering Committee before work begins. Each customization proposal must include a configuration first analysis, a functional specification, a technical design, an impact analysis addressing maintenance, upgrade compatibility, security, performance, accessibility, total cost of ownership, a test plan, a rollback plan, schedule impact, and itemized pricing if applicable. Approved customizations must pass the same acceptance tests as core functionality, be upgrade compatible or provide a documented migration path, and meet State security standards.

The Vendor will deliver source code, developer and user documentation, and a perpetual royalty free license for any custom code. Additionally, the State expects the Vendor to consider approved and implemented customizations for incorporation into the Vendors core solution going forward so that they become out of the box functionality.

Independent Verification and Validation

Independent Verification and Validation Engagement

If the State decides to add Independent Verification & Validation (IV&V) services as part of this engagement, the vendor will copy the Indiana Department of Administration (IDOA) – Independent Verification & Validation (IV&V) team member(s) on all project related communications (emails, meeting invites, collaboration tools, etc.) and will grant access to all documents and deliverables throughout the term of the contract.

IV&V Payment Approval

If IDOA elects to deploy Independent Verification and Validation (IV&V) services in connection with this engagement, the IV&V Team shall review and assess all Deliverables to determine compliance with the State’s requirements as set forth in the Contract and/or applicable Statement(s) of Work. For contracts entered into, renewed, or amended after June 30, 2026, IV&V shall serve as an approving authority, and no payment shall be issued to the Vendor unless and until IV&V has provided such approval.

Background and Current State

Current Description Overview

The current e-learning management system is an out of the box solution, that allows FSSA to load FSSA created training modules into the tool. Learning paths are used to set educational milestones for users. The current solution includes built-in analytics to track course status and completion. It allows for verifying compliance, scheduling reports, and has a searchable, cloneable, fully customizable system reports. FSSA can keep track of license usage, onboarding progress, exam scores, phishing click-through and report rates.

The current solution also provides a Security Awareness training package, containing curated ready to use training modules.

The current system is intuitive and easy to use, with little engagement with the vendor outside of helpdesk support. FSSA staff creates training modules, loads modules into the solution, and enrolls users.

Desired Future State

FSSA is seeking to have very minimal disruption from the current state and a minimal learning curve for this procurement. FSSA would like the ability to drill down further in some areas for method improvement, including but not limited to; lesson data, curricula data, individual user quiz results (not just aggregate for the whole module). FSSA would also like the ability to set limits on module rounds between different users, currently limits are only set on registration.

Project Management

Project Management Plan (PMP)

The Vendor shall develop an overall PMP that addresses the approach and execution of duties, delivered within 15 days after Contract start. The PMP shall be developed according to industry standards and best practices, including the Project Management Institute’s (PMI) latest Project Management Body of Knowledge (PMBOK) and IEEE system and software processes where applicable. Once approved, the Vendor shall maintain and modify the PMP to reflect evolving schedules, priorities, and resources.

At a minimum, the PMP shall include:

• Project Schedule: With milestones and tasks on a timeline for project delivery and enhancements.

• Project Organization and Resource and Staffing Plan: Including vital personnel by name, title, job function, location, and employment type (Vendor or subvendor).

• Requirements Traceability Matrix (RTM): Tracking requirements (ID, description, source, type) to ensure all are met.

• Issue Management Plan: Defining how to identify, assess, and manage project issues.

• Risk Management Plan: Outlining processes for identifying, assessing, and mitigating risks.

• Communication Plan: Defining information dissemination to the project team and stakeholders.

• Quality Management Plan: Defining quality standards, practices, resources, and responsibilities.

• Training Plan: Outlining training requirements, objectives, and methodologies.

• Deployment Plan: Outlining steps, resources, and timeline for deploying the technical solution.

• Implementation Plan: Describing step-by-step activities and schedule for system integration.

• Descriptions of any tools used to manage Project Plan components.

Document Management

The State maintains a standard suite of software (e.g., Microsoft Word, PowerPoint, Excel, Access, SharePoint, Adobe Acrobat) and expects the Vendor to ensure uniformity. The State will establish an electronic project library (e.g., Microsoft SharePoint, Azure DevOps) that will serve as the primary access point for all deliverables and documents, including administrative information.

Status Updates and Reporting

The Vendor shall submit Weekly Status Reports including updated Risk Logs with mitigation strategies, Issues Logs, and the latest Project Schedules and status updates. Monthly meetings will be held to provide project updates and review these reports. The Vendor shall also provide Quarterly Business Reviews detailing work conducted, strategy for coming months, and performance improvements, including written analyses and graphics.

Solution Training

The purpose of training activities is to ensure all users receive training on the System and associated business process changes. The Vendor shall develop a comprehensive Training Plan for each group receiving training prior to System implementation and throughout the life of the Contract. The plan includes methodology, activities for various phases (analysis, design, development, implementation, evaluation), required staff and resources, definition of user roles, curriculum, delivery models, and assessment with remediation. The plan will also address creating and maintaining training environments ("sandbox environments") and user profiles. Training surveys will be developed to measure effectiveness directly after training and post-go-live. The Vendor will update the plan annually.

Deliverables:

1. LMS User Access and LMS User Accounts: The Awardee must provide a minimum of 7,800 active user licenses that can be reset and managed by FSSA staff at any time, with role-based access. The Awardee must also meet the following requirements for user accounts and access:

a. Support LMS access for both FSSA credentialed users and FSSA authorized users credentialed by other agencies and/or using personal accounts via:

1. FSSA credentialed Users: a single sign-on platform (i.e., federated with the State's instance of Microsoft Azure Active Directory (AD) For State credentialed users to access the LMS.

2. Non-FSSA credentialed users: access for authorized not dependent on a State network ID or state credentials. For Non-FSSA credentials, the system would be required to create and manage. Use of social login authentication methods for logon is not permitted.

b. Retain a complete user transcript history (including active and unlimited inactive users) to meet state and federal retention requirements that can be accessed by FSSA admin users at any time. Requirements are guided by CMS, SSA, IRS, and FNS to demonstrate compliance for new initiatives and Quality Control federal findings. For example, it is presumed that CMS will be asking for Big Beautiful Bill readiness, which will include a demonstration that all applicable workers/stakeholders have been sufficiently trained in how to process in compliance with the new federal law.

c. Provide special permissions and roles and realms to designated individuals (for example: admin, supervisors, and staff roles, and FSSA PSO, DFR, and sub-vendor realms).

d. Ability for FSSA admin users to update or change users account details without disrupting the user’s history (e.g., email ID, password, supervisor, last name, etc.) without disrupting the user’s history and transcript.

e. Ability to unassign and reassign user accounts to accommodate weekly staff turnover while retaining user history and transcripts for inactive users.

2. Training Content: The Awardee must create privacy and security training modules that can be branded for FSSA and customized to meet FSSA business needs. These training modules will be assigned to FSSA staff at management’s discretion for supplemental learning. FSSA management will need the ability to enroll staff both manually and automated. The Awardee must provide the content for these privacy and security training modules with a range of security related subjects, including but not limited to:

a. basic information security awareness,

b. advanced information security awareness,

c. information security fundamentals,

d. social engineering,

e. cloud security,

f. email security,

g. password management,

h. social engineering, and

i. phishing.

FSSA PSO and DFR must be able to load unlimited courses created by FSSA staff to the LMS for deployment using standard compatible file types (such as SCORM, PDF, xAPI, and video files). The courses will be the intellectual property of FSSA and may not be used by the Awardee for any other purposes.

3. Course Management: The LMS must provide FSSA with the ability to:

a. retain version history for computer-based training modules,

b. copy modules,

c. activate and deactivate modules,

d. Capture completion data (including enrollment date, start date, assessment scores, time/date of completion and duration.

e. organize modules into curricula, and

f. measure module and curricula completion.

4. Scheduling and Rollout Functions: Admin users must be able to mass enroll/unenroll in computer-based modules and curricula both individually and via bulk enrollment, schedule deployment and enrollment dates, and assign coursework and due dates based on user role and learning pathways. The LMS must feature a role-based ability to schedule and manage enrollment for instructor led training sessions. This must include the ability for self-enrollment/supervisor enrollment and the ability to restrict enrollment based on user role, session size, and registration dates.

5. LMS User Notifications: The LMS must be able to produce an email notification for users assigned to a training module. FSSA management staff should be able to set the timing on the notification and subsequent reminder notifications. This email notification feature must be tailored to each training module and customizable by FSSA admins. The LMS must also be able to send unenrollment emails, mass emails, and course/curricula completion certificates.

6. Assessments: The LMS must include native software for proctoring multiple choice exams and be compatible with SCORM and xAPI assessment tools. The LMS reporting mechanism must be able to retrieve both individual user scores and question specific score results (i.e., 23% of assessment takers missed question 2).

7. Tracking and Reporting: The LMS must be able to report granular fields of data on user activity in real time, such as tracking:

a. percentage of module completion,

b. time spent on a lesson,

c. certification,

d. assessment scores,

e. transcripts, and

f. compliance.

The LMS must also capture test/quiz scores separate from module completion status.

These reports will need to be made available for FSSA management to access at any time through the LMS and not dependent on the Vendor sending reports.

The reporting mechanism must support the creation of configurable reports, and automated reporting that will disseminate reports to users based on roles/realms/organizational hierarchy.

FSSA requires, at a minimum, two configurable dashboards, one for the PSO and one for the DFR with detailed and configurable reporting that is user friendly and intuitive.

8. Migration and Historical Data:

The LMS must have the ability to migrate historical data and transcripts for approximately 35,000 active and inactive users from FSSA’s current LMS to the Awardee’s LMS. The LMS must also migrate historical training modules which currently stands at approximately over 32GB of data containing over 240,000 Scorm and iComposer files.

9. Technical Support: Awardee must provide technical support for the LMS during State business hours and respond to initial requests within 24-hours. The Awardee must provide admin training for new admin users and admin/end user UI specs for reference.

10. Hosting: FSSA requires a completely vendor hosted solution. See Attachment M – Infrastructure Overview for more detailed guidance. The LMS must maintain accessibility and compatibility with commercially available browsers as they update over time (e.g., Microsoft Edge and Google Chrome).

11. Compliance with IOT: The State has robust and comprehensive security standards that permeate all levels of the organization. The Indiana Office of Technology (IOT) has been tasked with establishing and maintaining these security standards. The security standards include assessing security risks, developing, and implementing effective security procedures, and monitoring the effectiveness of those procedures. If the proposed solution involves information technology-related products or services, all such products or services are to be compatible with any of the technology standards found in the Information Security Framework (https://www.in.gov/iot/iot-vendor-engagement/) that are applicable, including the assistive technology standard. Respondents will be required to sign a Non- Disclosure Agreement (NDA) to access the IOT Information Security Framework;

Respondent’s should review the IOT Information Security Framework, and ensure their proposed solution meets all standards therein.

12. Timeline: 4-year contract, starting 10/1/2026.

https://www.in.gov/iot/iot-vendor-engagement/