Bid_QA_Report.xlsx
XLSX spreadsheet 20 KB Posted
- Attached to
- PANG Sewer Inspections
- Solicitation number
- S-24800-00014454
- Issued by
- Multnomah County, Oregon
About this file
This is a Bid Quality Assurance Report documenting responses to a Request for Information (RFI) issued by the Oregon Liquor and Cannabis Commission (OLCC) for Bid Number S-84500-00014457, managed by Danni Burton. The RFI seeks information on cannabis tracking and inventory management systems to support the state's regulatory framework for recreational and medical cannabis operations. The report contains 38 numbered questions and corresponding answers addressing system requirements across multiple functional areas, including regulatory integration with multiple state agencies, scalability and performance benchmarking, deployment architecture, compliance certifications, data migration strategies, system integration capabilities, service levels, identity and access management, audit logging, data access and reporting, business rules adaptability, peak load handling, training and support, security and data residency, cost allocation models, and hardware-software integration requirements. The RFI submission deadline is October 26, 2025, with all responses required through the OregonBuys platform. OLCC has not established a specific timeline for transitioning from RFI to formal RFP.
The OLCC has not established a budget for this project and does not currently have preferences regarding SaaS models, perpetual licensing, or custom versus off-the-shelf solutions; vendors are expected to provide detailed information about their system capabilities rather than OLCC prescribing specific requirements. Key technical requirements include annual SOC 2 Type II certification and penetration testing, FedRAMP or GovRAMP certification, 10-year audit log retention, full data export rights, multi-factor authentication for OLCC staff, integration with external systems via unidirectional APIs, data residency within the continental United States with disaster recovery failover capability, and support for approximately 3,000 licensees with potential concurrent user loads reaching 83,000 employees. The system must support full batch-level tracking of input and output products, entire production workflow tracking from cultivation through sale, daily inventory reconciliation by licensees, and configurable business rules to accommodate frequent changes in cannabis law. OLCC will cover all system costs without imposing subscription fees on licensees, and prior state-level implementation experience is not a mandatory requirement for bidder eligibility.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Bid QA Report 2023 Report
| Bid Number | Buyer Name | Question # | Subject | Question | Answer | Question Date | Latest Answer Date |
| S-84500-00014457 | Danni Burton | 1 | Regulatory Integration & Multi-Agency Coordination | The RFI references integration with OLCC licensing systems, but Oregon's cannabis regulatory framework involves multiple agencies (ODA for hemp, OHA for medical program coordination). How should the new system handle cross-agency data sharing requirements, particularly for dual-licensed operations or businesses transitioning between medical and recreational markets? Are there specific data formatting or API standards that must be maintained for existing integrations with DOR tax systems or other state databases? | Please provide options your company may be able to provide for this question. DOR will have access to our system. | Aug 28, 2025 | Sep 3, 2025 |
| S-84500-00014457 | Danni Burton | 2 | Scalability & Performance Under Regulatory Stress | Oregon's cannabis market continues growing, and we understand system performance issues have impacted other states during peak compliance periods (end-of-month reporting, harvest seasons, etc.). What are OLCC's specific performance requirements during peak load scenarios? For example, during a statewide compliance audit or when implementing emergency regulatory changes, what would be the expected concurrent user load and acceptable response times for critical functions like manifest generation and inventory verification? | Attached is a service level agreement that will help clarify expectations. | Aug 28, 2025 | Sep 3, 2025 |
| S-84500-00014457 | Danni Burton | 3 | Deployment and Hosting Model | Could OLCC clarify whether it requires a dedicated environment, a government cloud such as Azure Gov, or physical isolation of the system? This distinction will determine whether a multi-tenant SaaS, a dedicated tenant, or an onâ??premises deployment is acceptable. | The State is moving to a cloud-forward approach making this option preferable. Fed-Ramp and Gov-Ramp certifications will be required. | Aug 28, 2025 | Sep 3, 2025 |
| S-84500-00014457 | Danni Burton | 4 | Compliance and Audit Baseline | Could OLCC specify which certifications are mandatory, such as SOC 2 Type II or ISO 27001, and the expected frequency of audits and penetration tests? Clear expectations will help determine the compliance roadmap. | Annual SOC 2 Type II and annual penetration testing are required. Must be in compliance with information technology standards established by EIS, found at: https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspxand which may be updated from time to time. | Aug 28, 2025 | Sep 3, 2025 |
| S-84500-00014457 | Danni Burton | 5 | Historical Data Migration | What is the required scope of data migration in terms of years of history, transaction records, and attachments? Will data cleansing or deduplication rules be defined by OLCC, and is a rollback plan expected in case of errors? | Develop, deliver, manage, and update a Data Migration Plan illustrating how Contractor will complete Data Migration activities, including incorporating data from various historical and external sources of varying complexity. In the Data Migration Plan, Contractor shall provide specific strategies and an approach to data migration for the data including interim migrations, and execution of mock migrations with input and feedback from Agency. Contractor shall provide a detailed process for extracting, transforming, validating, and loading data in the Data Migration Plan. | Aug 28, 2025 | Sep 3, 2025 |
| S-84500-00014457 | Danni Burton | 6 | System Integration and Interfaces | Could OLCC clarify the number and types of external systems that must be integrated, such as pointâ??ofâ??sale platforms, licensing or tax systems, and laboratory information management systems (LIMS)? Should integrations be bidirectional and realâ??time, or will batch processing be acceptable? | Vendors are required to have an API available. There are multiple systems that will need to be integrated. External vendors will send information to the system but it will not transfer both ways. | Aug 28, 2025 | Sep 22, 2025 |
| S-84500-00014457 | Danni Burton | 7 | Service Levels, High Availability, and Disaster Recovery | What are OLCCâ??s expectations for uptime guarantees, recovery point objectives, recovery time objectives, and whether multiâ??zone or multiâ??region deployments are required? | This is captured in the Service Level Agreement. | Aug 28, 2025 | Sep 3, 2025 |
| S-84500-00014457 | Danni Burton | 8 | Identity and Access Management | Will OLCC require integration with enterprise identity providers such as Microsoft Entra ID or Okta? Must multiâ??factor authentication be enforced across all users, and should the system support recordâ??level authorization? | The state prefers MFA and I expect it will be a requirement al least on the OLCC staff user side. If we integrate with Active Directo/mnicrosoft Entra and have a single sign-on for OLCC staff, this is an ideal process. | Aug 28, 2025 | Sep 3, 2025 |
| S-84500-00014457 | Danni Burton | 9 | Audit Logs and Retention | What retention period does OLCC require for audit logs? Must the logs be immutable (for example, using WORM storage), and is realâ??time mirroring of logs to an OLCC security information and event management (SIEM) system required? | System Audit logs should be maintained for 10 years. | Aug 28, 2025 | Sep 3, 2025 |
| S-84500-00014457 | Danni Burton | 10 | Data Access and Reporting | Will OLCC require full rights to export all system data, and should the system provide readâ??only SQL or API access for adâ??hoc queries? Must the solution include preâ??built connectors for thirdâ??party business intelligence tools such as Tableau or Power BI? | Yes we will require full rights. Some query able data is required whether through business intelligence dashboard, or sort and filter of the que. | Aug 28, 2025 | Sep 3, 2025 |
| S-84500-00014457 | Danni Burton | 11 | Business Rules and Regulatory Adaptability | How does OLCC expect the system to handle changes in law or administrative rules? Should the solution allow rapid adaptation through configuration or lowâ??code tools, or would codeâ??level modifications be acceptable? | OLCC is searching for a flexible solution that allows for frequent changes to Cannabis law. | Aug 28, 2025 | Sep 3, 2025 |
| S-84500-00014457 | Danni Burton | 12 | Scalability and Peak Load | What are OLCCâ??s expectations regarding concurrent user levels, event volume, and seasonal peak load? Are there strict latency requirements for processing timeâ??sensitive transactions? | Licensees are required to reconcile inventory daily. The attached SLA should also have additional helpful details. The number of users logged in each day and the transactions per day vary. It could be as few as 166 state users and 83,000 employees including licensees in 30 days. | Aug 28, 2025 | Sep 3, 2025 |
| S-84500-00014457 | Danni Burton | 13 | Training and Support | Is the vendor expected to provide training and ongoing support not only for OLCC personnel but also for all licensed businesses across the state? If so, should this support be available 24/7 and structured in tiers? | 24/7 is preferable but you will need to provide us with the services you can provide. | Aug 28, 2025 | Sep 3, 2025 |
| S-84500-00014457 | Danni Burton | 14 | Security and Data Residency | Does OLCC require that all data be stored within the State of Oregon, within the United States, or specifically in a governmentâ??certified cloud environment? | The data must reside solely within the continental United States. Disaster recovery mechanisms must be in place including a failover hosting location. | Aug 28, 2025 | Sep 3, 2025 |
| S-84500-00014457 | Danni Burton | 15 | Cost Allocation Model | Will the costs of the system be covered entirely by OLCC, or must each licensee contribute through subscription fees? If licensees are charged, should the fees be flat or scaled by business size? | OLCC will pay for the system | Aug 28, 2025 | Sep 3, 2025 |
| S-84500-00014457 | Danni Burton | 16 | External Systems Integration Details | OLCC has indicated that the solution must integrate with external systems such as point-of-sale platforms, licensing or tax systems, and laboratory information management systems (LIMS). Could OLCC provide more detail on these systems, including their nature or characteristics? For example: |
Are they commercial off-the-shelf products or state-developed systems?
What brands or platforms are currently in use?
Are they cloud-based or on-premises deployments?
What types of interfaces are available (APIs, flat-file exchange, batch jobs, etc.)?
What performance or throughput requirements should be expected for data exchange?
| Who maintains these systems and their integration endpoints (OLCC IT, third-party vendors, or state-wide shared services)? | Vendors are required to have an API available. There are multiple systems that will need to be integrated. External vendors will send information to the system but it will not transfer both ways. | Sep 8, 2025 | Sep 22, 2025 | ||
| S-84500-00014457 | Danni Burton | 17 | Historical Data Migration Artifacts | OLCC has stated that a comprehensive Data Migration Plan will be required, including mock migrations and validation processes. To accurately assess the effort and risk involved, could OLCC provide artifacts from the current system, such as: |
Sample datasets with representative records;
Data dictionaries with field definitions and relationships;
Database schema or entity-relationship diagrams;
Estimates of data volume, including transaction counts, log history, and attachment sizes.
| If these artifacts cannot be provided at this stage, please confirm whether vendors may treat data migration as a time-and-materials (T&M) activity, with flexible resource-based pricing rather than a fixed lump-sum cost, in order to account for uncertainties. | Data migration will not be treated as a time and materials project. At this point with the RFI OLCC will not be releasing any artifacts. | Sep 8, 2025 | Sep 22, 2025 | |||||
| S-84500-00014457 | Danni Burton | 18 | Authorization Granularity | Beyond confirming the use of SSO and MFA, does OLCC require fine-grained access controls such as record-level or domain-level permissions to restrict visibility of specific data to certain roles or users? | Yes | Sep 8, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 19 | Audit Logs and Security Monitoring | In addition to the 10-year retention requirement, must audit logs be immutable (e.g., WORM storage)? Is real-time mirroring of logs to a state-level Security Information and Event Management (SIEM) system required? | We do not have an SIEM however, real time system logs are required. | Sep 8, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 20 | Secondary and Tertiary Product Tracking Scope | For secondary or tertiary cannabis products that involve processes beyond the cannabis plant itself (e.g., infused edibles, tinctures, beverages), is it sufficient to capture only the batch information of the procured input products, without requiring full batch-level tracking of the subsequent processed products? | We require full batch level tracking of input and output. | Sep 8, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 21 | Production Process Tracking Granularity | Given that cannabis cultivation and processing inherently involve multiple production steps and stages, does OLCC require the system to control and track the entire production workflow (e.g., trimming, drying, extraction, formulation, packaging), or is it sufficient to control and record only the start and end points of the production process? | The entire workflow should be trackable. | Sep 8, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 22 | possible previous experience requirement | Could OLCC clarify whether prior state-level implementation experience will be established as a mandatory requirement for bidder eligibility in the forthcoming RFP, or instead treated as an evaluation factor that may provide additional scoring advantages? | This is not a requirement. | Sep 9, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 23 | RICEFW- Questions | General Project Information |
What is the estimated volume of historical and ongoing data (in GB/TB) that needs to be migrated or managed?
What is the overall budget range allocated for this project (including software, licensing, support, and implementation)?
What is the planned start date for the project implementation?
What is the desired project completion timeframe (in months)?
| Do you have a preferred timeline or sequencing for the data migration process? | The Request for Information is to gather information on what programs are available to the state at this time. The vendor should provide us the information on what their software can accomplish for us. | Sep 18, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 24 | Licensing and Access |
How many software/user licenses will be required initially, and what is the anticipated growth in users over the next 3â??5 years?
Are there any external users (such as third-party labs, distributors, or auditors) who will require direct access to the system?
| Should the system support tiered licensing or concurrent user models? | Currently OLCC has aprpox. 3,000 licensees and there is currently a moratorium on licensees. Third party users are required to have an API connection to push information. | Sep 18, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 25 | System and Integration Requirements |
Which system integrations are considered mandatory for go-live (e.g., OLCC licensing, point-of-sale, taxation)?
Are there any legacy systems that must be retained and integrated with the new solution?
Will OLCC consider hybrid deployment models (e.g., private cloud/on-premise) in addition to SaaS?
What level of live tracking granularity is expected (plant batches, individual plants, product units, transportation manifests)?
Training and Support
What training formats are preferred (on-site, online, hybrid, self-paced)?
Should training also cover industry licensees (growers, retailers, labs), or only OLCC staff?
What are the expectations for ongoing supportâ??business hours only, or 24/7 availability?
Reporting and Analytics
What key performance indicators (KPIs) or metrics are most critical to OLCC operations?
What level of real-time reporting is required versus daily/weekly scheduled reporting?
Should the system provide dashboards and visual analytics (e.g., Power BI, Tableau integration) out-of-the-box?
Security
Are there any state-specific compliance standards (e.g., Oregon IT security policies) in addition to the listed requirements (TLS, MFA, RBAC, SSO)?
How long must audit logs be retained by default, and what are the rules for data purging?
Should the solution undergo independent third-party security certification (e.g., SOC 2, FedRAMP)?
References
Does OLCC require references to be specific to cannabis tracking implementations, or will similar regulated inventory tracking projects (e.g., pharmaceuticals, alcohol) be acceptable?
| How many reference projects should be provided, and what level of detail is expected (contact information, project size, technology stack)? | Please provide what options your system can support. OLCC would like to review all system options. | Sep 18, 2025 | Sep 22, 2025 | |||||
| S-84500-00014457 | Danni Burton | 26 | Purpose of New Solicitation | Can OLCC clarify whether the intent of this RFI is to identify a potential replacement for the current cannabis tracking software, to supplement the existing system, or to gather information for future planning? | OLCC is gathering information on what systems are currently available. | Sep 18, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 27 | Role of Hardware vs. Software | The RFI includes both point-of-sale (POS) integration and references to peripheral devices. Can OLCC clarify whether respondents are expected to propose hardware solutions in addition to software, or if the requirement is limited to ensuring that software solutions can interoperate with hardware (e.g., Android-based devices, scanners, printers) already in use by licensees? | Please provide OLCC with all options that your program can provide. OLCC does have android users and iphone users. | Sep 18, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 28 | SECTION 2: BACKGROUND | Will OLCC be providing detailed input related to cultivation timelinesâ??such as when plantation starts, the estimated number of days to grow each strain, and when the product can be harvested or sold? |
Can you please share details about the current system in use for Medical Marijuana Program tracking (e.g., technology stack, features, pain points)?
| Are standardized growth stages (e.g., germination, vegetative, flowering, harvest-ready) defined by OLCC for each plant type or strain, and will these be shared as reference input? | Any questions regarding the current system is public information and can be accessed through the OregonBuys system. The OLCC required licensees to track steps in the growing process. We do not tell the licensees when to grow. | Sep 18, 2025 | Sep 22, 2025 | ||
| S-84500-00014457 | Danni Burton | 29 | SECTION 4: SCOPE OF WORK REQUIREMENTS | Will OLCC or licensees provide detailed planting records, such as strain type, planting date, and location |
Will the system be expected to calculate estimated harvest dates based on strain or input data, or will those dates be manually entered?
Can OLCC clarify the expected user roles for the new web-based inventory tracking system (e.g., licensees, OLCC staff, inspectors)?
Approximately how many total users are expected to access the system? Will there be a need to support concurrent users, and if so, what is the estimated concurrency level?
Should the system support configurable timelines and alerts for cultivation milestones based on OLCC-provided parameters (e.g., auto-reminders for harvest window, testing schedules, or compliance checkpoints)?
What are the current systemâ??s limitations or pain points?
Is OLCC considering a SaaS-based solution, a COTS product, or a custom-built system for the new platform?
What is the volume and format of existing data to be migrated?
 Will OLCC provide historical cultivation data for system testing or migration?
Will the agency provide the infrastructure and data storage environment for hosting the application?
Please let us know if you have any Microsoft licenses, if so what type of licenses are those.. Total users could be over 3,000.
OLCC currently requires licensees to track different stages in the growing/production and sale.
OLCC is not requiring SaaS or other system. The RFI requires vendors to provide information on their systems.
| At this time, OLCC will not provide any data to vendors. | Sep 18, 2025 | Sep 22, 2025 | |||
| S-84500-00014457 | Danni Burton | 30 | 5.2 Respondents to this RFI must submit the following: | Could you please share if OLCC has identified a target budget range or ceiling for this project? |
Will OLCC prefer a subscription-based SaaS model, a perpetual license, or a hybrid cost model?
Will OLCC provide infrastructure (e.g., Microsoft 365 tenant, Azure hosting), or is the vendor expected to host the solution independently?
Should licensing costs for all users (e.g., OLCC staff and licensees) be included in the proposal?
Are there any constraints on costs related to data migration volume, historical record retention, or storage limits? Currently OLCC has not identified a budget.
OLCC does not have a preference at this time for Saas.
| At this time, OLCC cannot say if we will need vendors to host independently. Vendors must tell OLCC what their software can provide. | Sep 18, 2025 | Sep 22, 2025 | ||||||
| S-84500-00014457 | Danni Burton | 31 | Suppliers scope of work | Is OLCC definite on whether you are more interested in off-shelf solutions or custom builds? | We do not currently have a preference. | Sep 19, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 32 | budgetary goals | It would be very helpful for us to hear the State's thoughts regarding rough order of magnitude budget for this project. | OLCC does not have a budget currently. This is a request for information. | Sep 19, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 33 | implementation timeline | Does OLCC have a rough implementation timeline in mind, best/worst case scenarios, or a "nice to have" estimate? Is the fiscal year 2027 a fairly accurate assessment of the time to implement? | Please submit information by the deadline in the RFI. OLCC cannot provide any further dates. | Sep 19, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 34 | RFI/RFP | The RFI landing page shows bids opening 10/26. Can OLCC clarify that the RFI is fairly solid to become an RFP at that time? | No OLCC does not have a timeline for the RFP yet. | Sep 19, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 35 | Submission | Will the State please clarify how we should submit our response to the RFI, whether via OregonBuys, or by email, or both? | All responses shall be submitted via OregonBuys. | Sep 19, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 36 | Experience | Will the State request that offerors to disclose when they have been unable to meet their contractual obligations, have experienced performance issues (e.g., inability to meet implementation deadlines and/or receipt of notices to cure), or had a contract terminated before full term? |
| How does the State plan to consider vendors' experience and track record in other jurisdictions and/or government projects? | OLCC is not currently asking for this information for the RFI | Sep 19, 2025 | Sep 22, 2025 | |||||
| S-84500-00014457 | Danni Burton | 37 | Data | Can the State clarify its expectations on purging data automatically? Typically, a track-and-trace system will not purge data to have a complete dataset and a full record of System activity. | OLCC has a purge schedule. Please tell us what your system can do whether that is purging automatically or not. | Sep 19, 2025 | Sep 22, 2025 | |
| S-84500-00014457 | Danni Burton | 38 | ERP integration question | We understand that production licensees may fall into two categories: (1) those without an internal ERP system, where the OLCC tracking solution would operate independently and require licensees to manually enter the required production information; and (2) those with an existing ERP system, where the OLCC tracking solution could potentially integrate and automatically ingest the required data from the licenseeâ??s ERP. |
Could OLCC clarify whether, in the latter case, the system will be required to support integration with licensee ERP platforms in order to automate data ingestion, or whether manual data entry by the licensee will remain sufficient to satisfy compliance obligations? Sep 23, 2025 Sep 23, 2025
File details come from the government source that posted it. Updated .