CCC QA - Bid BD-26-2018-CNB-CNB-129084_REPOST.pdf

Q&A

Investigative Background Check Services RFR

COMMBUYS Bid #: BD-27-2018-CNB-CNB-134206

Original COMMBUYS Bid #: BD-26-2018-CNB-CNB-129084

# Question Subject Question

1 Volume Approximately how many background check packages would you order a year?

Answer: For FY26 (July 1, 2025-June 30, 2026), the Commission requested approximately 199 individual and 117 entity background checks. Future volume may be higher or lower and is not guaranteed.

2 Cybersecurity Certifications - Section 3.1.1

Section 3.1.1 references NIST v1.1, SOC 2, HITRUST, and FedRAMP.

Are any of these specific certifications required, or may bidders demonstrate compliance through their applicable certifications, security controls, policies, and practices?

Answer: There is no specific certification required. Bidders may demonstrate compliance through certifications, security controls, policies and practices.

3 Similar Regulated Industry - Section 6.1

Section 6.1 requires at least three years of experience providing the proposed solution or equivalent in the cannabis industry or a similar regulated industry. What does the Commission consider a "similar regulated industry" for this requirement?

Answer: Examples may include, but are not limited to, gaming, alcohol, pharmaceuticals or controlled substances, healthcare, financial services, and other industries involving comparable licensing, compliance, investigative, or enforcement requirements.

4 International Searches - Sections 3.2.1 and 3.2.2

Are international searches required only when an individual or entity has relevant international history or affiliations, or should they be included in every investigation?

Answer: Only when relevant and subject to prior Commission approval.

5 Cost Proposal - Part B

Part B states that all applicable costs must be included in the total proposed cost. Certain third-party and pass-through costs, such as court access, database, and international search fees, vary based on the jurisdictions and searches required for each investigation and cannot be determined in advance. Is it acceptable to bill these variable pass-through costs separately from the proposed per-investigation unit price, as incurred? That wording guides

Answer: Costs associated with performing the standard background investigation should be included in the proposed per-investigation price.

Additional investigative services outside the standard background check may be billed at the proposed hourly rate only when requested and approved in advance by the Commission.

6 BD-26-2018-CNB-

CNB-129084

For purposes of the Mandatory Specification requiring at least three years of experience providing the proposed solution or equivalent in the cannabis industry or a similar regulated industry, would investigative/background investigation experience supporting regulated industries such as insurance and workers' compensation satisfy the "similar regulated industry" requirement?

Answer: Yes. Insurance and workers compensation may be considered similar regulated industries for purposes of this requirement, provided the bidder demonstrates at least three years of relevant investigative background experience.

7 Section 3.2.1 Under the current contract, there is a SAFIS review component. Is that an expectation with this contract as well?

Answer: No. A SAFIS review is not required.

8 Section 3.3.1 Does the Commission agree that processing a specific international search in a country, as requested, does not run afoul of Section 3.3.1?

Answer: Section 3.3.1 is regarding data once received by the vendor regardless of the source location. All data transfers should be done in a secure manner.

9 Section 1.1 Does this bid include internal hires for the Massachusetts CCC Human Resources Department?

Answer: No. This RFR does not include background checks for internal CCC hires.

10 Section 3.2.1 Does the Commission agree that if the state offers a comprehensive statewide criminal search, the county search in addition to the statewide search would be considered redundant and not necessary?

Answer: It would only be considered redundant if the statewide search would also capture civil matters that are typically found with the county search.