ERP_RFI-31701-03815_Amendment_2_Q_A.pdf

RFI # 31701-03815 – Q&A Page 1 of 12

STATE OF TENNESSEE

DEPARTMENT OF FINANCE AND ADMINISTRATION

RFI 31701-03815

AMENDMENT 2

FOR TN NEXT GEN ERP REQUIREMENTS REVIEW

DATE: 2/5/2026

RFI # 31701-03815 IS AMENDED AS FOLLOWS:

1. State responses to questions and comments in the table below.

Question RFI SECTION QUESTION / COMMENT STATE RESPONSE

1 What outcomes is the state seeking from its next-generation ERP? The State is seeking a next-generation

ERP that delivers measurable improvements in efficiency, transparency, and service delivery while providing a flexible, secure foundation for future needs. Desired outcomes include:

• Modernized, integrated operations: Replace fragmented and manual processes with a unified, end-to-end ERP that improves data consistency, reduces duplication, and supports cross-agency collaboration.

• Improved user experience:

Provide intuitive, role-based, and accessible interfaces for state employees, managers, and external stakeholders, reducing training time and increasing adoption.

• Actionable insights and decision support: Enable timely access to accurate data, analytics, and reporting to support operational oversight, financial stewardship, and informed decision-making.

• Operational efficiency and cost effectiveness: Automate routine processes, streamline workflows, and reduce

RFI # 31701-03815 – Q&A Page 2 of 12 administrative burden to allow staff to focus on higher-value work.

• Scalability and adaptability:

Support evolving business, policy, and regulatory requirements through configurable, extensible, and standards-based solutions.

• Security, compliance, and resiliency: Meet state, federal, and industry requirements for data security, privacy, auditability, and system reliability.

• Long-term sustainability:

Provide a solution that is maintainable, vendor-supported, and capable of leveraging emerging technologies over time without excessive customization.

2 How does the ERP program align with the State's broader strategic goals? The ERP program supports the State’s broader strategic goals by modernizing core administrative systems to better enable effective governance, fiscal stewardship, and service delivery.

3 What implementation timeline is the State working toward? Are there timeline constraints (e.g., end of system support, go-live phasing) that govern the timeline?

The implementation plan will be determined during the RFP process

4 What are the primary risks the State anticipates in executing this program? Accounts- Making payments accurately and timely (payroll and vendor) and generating the ACFR by 12/31. Vendor and technology security risks.

Data security and privacy—Ensuring confidential and sensitive employee information is protected as ERP modernization consolidates data across core systems and functions.

5 Is the State able to share a high-level current-state architecture diagram for its current ERP? We cannot share an architecture diagram as it is considered confidential under TCA. The current ERP is hosted in the Cloud with multi-tier and high-availability architecture with SSL Load Balancers with WAF, in front of clustered web, application, batch servers, and backend HA database. DR

RFI # 31701-03815 – Q&A Page 3 of 12 with RTO of 2 hours and RPO of 15 mins

6. 5.6 Can the State please clarify if standard introductory or supplementary documents— such as a Cover Letter, Table of Contents, Executive Summary, or other referenced attachments beyond the Requirements Spreadsheet—are excluded from the fifteen

(15) page limit?

All documents beyond the Requirements Spreadsheet do count towards the 15-page limit. This includes the “Technical Information Form.”

The Requirements Spreadsheet is separate and will not count towards the limit.

7. Requirements Spreadsheet Instructions

Regarding the 'Master' spreadsheet tab in the RFI, the instructions note that feedback is requested to 'refine these requirements' ahead of the final RFP solicitation. Could the State please clarify the intended nature of the comments requested for Column G?

- Is the State looking for a preliminary indication of whether/how our current solution can meet these requirements as written?

- Or, given that this is a foundation for a future RFP, is the State primarily seeking consultative feedback on the clarity, feasibility, and industry-standard alignment of the requirements themselves?

The State is primarily seeking feedback on the clarity, feasibility, and industry standard alignment of the requirements themselves.

We will look at how vendor specific solutions meet our requirements as part of the subsequent RFP process.

8. If a vendor recommends a third party for a specific requirement should the vendor respond to the requirement and then indicate in the comments that the functionality will be filled by a third party or should the vendor indicate it is not part of their solution?

You can respond to the requirement and then indicate in the comments that the functionality will be filled by a third party.

9. May we submit an Executive Summary and Appendix to accompany our Attachment 3 responses?

Yes.

Please also reference question and answer #6.

10. Does STS require anything in addition to the completed Attachment 3 submittals (Technology Form and Requirements Excel)?

Additional documentation is not required. The main focus is vendor feedback on the future RFP requirements.

11. Requirements Spreadsheet

With respect to the Comment column, could the STS provide some clarity around expectations? Perhaps STS could provide us with an example of what they consider an appropriate response. To expand on our ask, do we need to respond with how the capability is met via our solution or is the STS looking for a more consultative approach, i.e., whether or not the requirement is reasonable in our

Please see the response to question #7.

RFI # 31701-03815 – Q&A Page 4 of 12 opinion, and if not , what adjustments would we recommend?

12. Requirements Spreadsheet

Across the MASTER sheet, a significant number of requirements reference the “ability to provide” functionality through configuration rather than customization. Could clarification be provided on how the State distinguishes between configuration, low-code extensibility, and custom development when evaluating compliance with these requirements?

Ability to make changes to the system via delivered pages or tools without writing custom code or changing delivered objects. Changing delivered objects makes it harder to maintain during upgrades and patches or tax updates as these changes will have to be reapplied.

13. Requirements Spreadsheet

Multiple requirements in the MASTER sheet reference enterprise-wide capabilities such as search, workflow, reporting, security, and role management. Could clarification be provided on whether these capabilities are expected to be implemented as centralized shared services across all ERP modules, or whether module-specific implementations are acceptable?

Accounts- The intent of this question is unclear and additional clarification may be needed. Some capabilities (most) will be centralized some will require agency specific implementation.

For security’s portion, a centralized shared services across all ERP modules.

The data within the system will be utilized by multiple modules and controls must be consistent.

14. Requirements Spreadsheet

Numerous requirements reference integrations, data exchange, and interfaces with external systems but do not consistently specify real-time versus batch expectations.

Could clarification be provided on whether real-time integration should be assumed by default, or whether integration patterns may vary based on business criticality and system constraints?

Accounts-Integration patterns may vary based on business criticality and system constraints

15. Several requirements appear to require high levels of flexibility to support future business rules, policy changes, and evolving agency needs. Could clarification be provided on whether these requirements are intended to be satisfied through end-user configurable tools, administrator-level configuration, or vendor-supported enhancements?

Accounts- The State is flexible regarding how these requirements are satisfied. However, solutions that support configuration at the administrator level or through end-user configurable tools are preferred, as they enable timely adaptation to future business rules, policy changes, and evolving agency needs without reliance on vendor-supported enhancements.

16. The MASTER sheet contains requirements spanning finance, procurement, human capital, reporting, and cross-functional processes. Could clarification be provided on whether a single unified data model is expected across all functional areas, or whether domain-specific data models with standardized interoperability are acceptable?

Domain specific data models with standard interoperability where critical data is kept in sync through real-time integration is acceptable

17. Many requirements reference auditability, traceability, and historical tracking of

Accounts- Where overlapping occurs the most restrictive retention period

RFI # 31701-03815 – Q&A Page 5 of 12 transactions, configurations, and approvals.

Could clarification be provided on the expected retention period and granularity of audit data, particularly where requirements may overlap with public records or compliance obligations?

and compliance requirements take precedence. The retention period would differ based on the business process involved. The goal would be able to set the retention period through configurable options.

18. Several requirements imply intelligent automation, decision support, or advanced analytics without explicitly referencing artificial intelligence. Could clarification be provided on whether AI-enabled approaches are encouraged to satisfy these requirements, or whether traditional rule-based automation is preferred unless explicitly stated?

Accounts- A best-fit combination of rule-based and AI-enabled techniques may be used depending on the intent of each requirement. AI is not assumed unless explicitly stated, but vendors are encouraged to explain where AI could add value beyond traditional automation.

19. The MASTER sheet includes a wide range of requirements marked with varying MoSCoW priorities. Could clarification be provided on whether these priorities are expected to remain fixed in the future RFP, or whether reprioritization and consolidation of requirements is anticipated based on vendor feedback and implementation feasibility?

Accounts- Reprioritization and consolidation of requirements is anticipated

20. Across the HR and Payroll requirements, extensive flexibility is described for payroll calculations, deductions, retro-pay, garnishments, and FLSA rules. Could clarification be provided on whether these complex payroll scenarios are expected to be supported primarily through configuration and rule-based setup, or whether custom development is anticipated for Tennessee-specific payroll logic?

Primarily through configuration.

21. Several requirements reference asynchronous processing, parallel processing, and real-time monitoring for payroll and HR transactions.

Could clarification be provided on the State’s expectations regarding acceptable processing latency, error recovery timelines, and real-time visibility for high-volume payroll and time processing activities?

The State recognizes that acceptable processing latency and recovery timelines may vary based on transaction type, volume, and business criticality. As such, the State is not prescribing fixed latency thresholds at this stage.

22. Across the Finance requirements, extensive configurability is described for accounting rules, revenue recognition, allocations, workflows, and validations. Could clarification be provided on whether these capabilities are expected to be delivered entirely through configuration and rules engines, or whether limited custom development is anticipated for Tennessee-specific accounting scenarios?

Accounts- Limited custom development is anticipated and preferred.

RFI # 31701-03815 – Q&A Page 6 of 12

23. Many Finance requirements reference real-time validations, integrations, and reconciliations across General Ledger, Accounts Payable, Accounts Receivable, Grants, Projects, and Cash Management. Could clarification be provided on whether real-time processing should be assumed as the default across all financial transactions, or whether a hybrid approach using real-time and batch processing is acceptable based on transaction volume and criticality?

A hybrid approach with real-time and batch processing. We would expect that one-off and a range of transactions would be validated real-time but also expect batch processing for large volumes.

24. Several requirements call for support of multiple ledgers operating concurrently under different accounting bases (cash, modified accrual, full accrual). Could clarification be provided on whether a single unified chart of accounts is expected to support all ledgers, or whether ledger-specific chartfield variations are anticipated?

Accounts- A single unified chart of accounts is expected to support all ledgers.

25. The Finance requirements place strong emphasis on auditability, historical tracking, and immutability of financial records. Could clarification be provided on the expected retention periods and level of audit detail required, particularly for vouchers, journals, grants, and asset transactions subject to public records and compliance audits?

Accounts- Retention periods vary and so we will need configuration.

Retention periods can involve funds, transaction types (payroll).

26. Numerous requirements reference high-volume processing scenarios, including vouchers, journals, P-Card transactions, and interfaces. Could clarification be provided on the State’s performance expectations, such as acceptable processing windows, concurrency thresholds, and peak transaction volumes that should be assumed during solution design?

High volume would refer to large interface files being consumed and converted into transactions to process through the ERP system. Examples would be bank files, agency payments, agency deposits, 3rd party integrations, etc. The expectation is that performance would not be disrupted as those transactions are processing throughout the system. The idea would be having the flexibility to interface

27. The Finance requirements include advanced capabilities such as anomaly detection, predictive analytics, natural-language query search, and AI-assisted reporting. Could clarification be provided on whether these AI-enabled capabilities are expected to be available at go-live, or whether foundational reporting with optional AI enhancements is considered acceptable?

Accounts- Foundational reporting and analytics capabilities are expected to be available at go-live. This includes standard financial reporting, ad hoc queries, dashboards, and cross-module visibility needed for day-to-day operations and oversight.

AI-enabled capabilities such as anomaly detection, predictive analytics, natural-language query, and AI-assisted reporting are not required at go-live and may be delivered as optional or phased enhancements.

RFI # 31701-03815 – Q&A Page 7 of 12

Vendors are encouraged to describe which AI-enabled features are available today, which can be enabled over time, and any dependencies or assumptions related to their use.

The solution should support a clear path to adoption of AI-enabled capabilities without requiring significant re-architecture, allowing these features to be introduced incrementally as organizational readiness, governance, and use cases mature.

DOHR – Same Response as accounts per Lesley Farmer.

28. Several TN-specific requirements describe complex interagency billing, grants management, and asset-based billing scenarios. Could clarification be provided on whether these processes are expected to follow standardized statewide rules, or whether agency-specific variations must be supported through configurable logic?

Accounts- There are statewide rules however, there are agency specific variations also (e.g., stat journals, grants indirect costs) many of which are based on federal grant specifics.

Agency specific should be achieved through configurations and not customizations.

29. The Finance requirements include extensive integration expectations with external systems such as banks, SAM.gov, GSA systems, mobility vendors, and third-party grant and lease platforms. Could clarification be provided on whether standardized integration frameworks and patterns will be defined by the State, or whether vendors are expected to propose integration approaches as part of the solution design?

Accounts- Vendors are expected to propose integration approaches as part of the solution design.

30. The HR requirements include extensive integration points with Finance, Treasury, Retirement, Workers’ Compensation, Tax Authorities, and third-party vendors. Could clarification be provided on whether these integrations are expected to be real-time by default, or whether a combination of real-time and scheduled batch integrations is acceptable depending on the business process?

Accounts- A combination of real-time and scheduled batch integrations is acceptable.

HR – Combination of real-time and batch integration per Lesley Farmer.

31. Numerous requirements describe mass uploads, backdated changes, and future-dated transactions with workflow approvals. Could clarification be provided on whether these

Accounts- The State is flexible regarding how these requirements are satisfied. However, solutions that support configuration at the

RFI # 31701-03815 – Q&A Page 8 of 12 scenarios are expected to be fully supported through end-user or administrator self-service tools without vendor intervention?

administrator level or through end-user configurable tools are preferred, as they enable timely adaptation to future business rules, policy changes, and evolving agency needs without reliance on vendor-supported enhancements.

32. The requirements outline highly granular auditability, including payroll changes, backdated corrections, employee data updates, and disciplinary actions. Could clarification be provided on the expected audit retention period and level of detail required to satisfy State compliance and public records obligations?

Accounts-See response to question #25.

33. Several HR requirements imply advanced automation, predictive analytics, and the use of GenAI for reporting and insights. Could clarification be provided on whether AI-enabled capabilities are expected to be native to the HCM solution at go-live, or whether foundational reporting with optional AI enhancements is considered acceptable?

Accounts-See response to question #27.

HR – Please see response to question #27.

34. The Time and Labor requirements describe highly complex scheduling, overtime rules, workgroups, and exception handling across diverse employee populations. Could clarification be provided on whether these rules are expected to be standardized statewide, or whether agency- and role-specific rule variations must be configurable?

Accounts- Agency- and role-specific rule variations must be configurable.

Edison Time & Labor Team:

Time & Labor rules are determined by State statutes and policies that vary from agency to agency, as such there is no expectation for these to become standardized. An ERP solution must be capable of being highly configurable for the many Time & Labor rules.

35. Multiple requirements reference employee, manager, and non-employee self-service (ESS/MSS), including mobile access and role-based controls. Could clarification be provided on whether all ESS/MSS functionality is expected to be delivered through a single unified user experience, or whether modular self-service components are acceptable?

Accounts- Unified navigation is preferred.

36. The HR requirements include extensive lifecycle management for employees, contractors, retirees, and non-employees, including transitions between statuses. Could clarification be provided on whether a single unified worker record is expected to persist across all statuses, or whether separate but linked records are acceptable?

Accounts- A single unified worker record is expected.

37. Several requirements reference bots, automation users, and query-as-a-service access to the system. Could clarification be

The State expects non-human system access (e.g., bots, automation users, service accounts, and query-based

RFI # 31701-03815 – Q&A Page 9 of 12 provided on the State’s expectations regarding security, licensing, and governance controls for non-human system access within HR and Payroll processes?

access) to be governed by the same security, auditability, and compliance principles applied to human users, with appropriate controls based on risk and function.

38. In Attachment 3, there are several items that include the phrase “please provide a Written Response”. Could you please clarify whether a ‘Written Response’ is required at this stage, or should we provide the full response as part of the formal RFP submission when it is released?

Those instances of “please provide a written response” in Attachment 3 are not specifically tied to this RFI. They are intended to become RFP requirements/questions.

A formal response to those items will be a part of the RFP submission.

Also, please see our response to question #7.

39. We would like clarification regarding the 15-page limit for responses. The provided “TECHNICAL INFORMATIONAL FORM” is already six (6) pages, and when combined with our Cover Letter, TOC, Executive Summary, and Attachments, the total would exceed fifteen pages. Could you please confirm whether the 15-page limit applies to all materials submitted (including the Technical Informational Form) or only to our additional response content? If the limit includes all materials, would a page limit extension be possible?

Please see the response to question #6.

40. Can the 15-page limit be increased to 30? Please see the response to question #6.

41. What legacy systems are being replaced or integrated?

PeopleSoft (HCM, ELM, FSCM, CRM) will be replaced. Numerous agency sub-systems will have to be integrated into the new system.

42. What are your expectations for historical data migration, cleansing, archiving, and retention?

Accounts- See response to question #27 for retention requirements. For migration and cleansing we do expect to migrate and data cleanse with this implementation.

43. What data volumes and qualities are involved? PS PRD Data Volume size by Module

FSPRD 50TB

HRPRD 36TB

ELPRD 2TB

CRPRD 1TB

PAPRD 2TB

44. What are your targets for user counts, transaction volumes, peak loads, and uptime SLAs?

55,000 employees and 275,000 non-state employees with peak loads during payroll cycle and open enrollment and uptime of 99.9%.

RFI # 31701-03815 – Q&A Page 10 of 12

45. Which device types and OS versions must be supported?

All Windows, Linux and Apple OS devices with various and mobile form factors and industry accepted browsers.

46. Is offline capability required, or only browser-?

based mobile access

No need for offline capability.

47. What mobile device management (MDM) systems are in use or planned?

The State uses Microsoft Intune

48. Are there any requirements for constituent portals or citizen access?

Accounts-Yes

49. What mandated reports (financial, budget, audit, transparency) are required?

Accounts-Refer to the requirements.

50. Does an analytics platform exist today? If so, what is it? (Power BI, Tableau, Cognos)

Edison ERP solution uses Oracle BI Applications (OBIA). The dashboards use Oracle Analytics Cloud (OAC) and Oracle Data Visualization (DV). To move the data to the warehouse, we use Oracle Data Integrator

51. What will the state’s role be in the implementation? i.e. Vendor only, co-implementation, vendor design, build, test, etc.?

The state will be involved with requirement/fit gap meetings, data mapping, data conversion, communication, testing, configuring, etc.

52. Will the State conduct meetings/demonstrations after this RFI and before an RFP is released?

The State does not currently intend to conduct meetings and/or demos as part of this RFI.

There is a very high likelihood that demos will be part of the future RFP.

53. Will the State mandate vendors wishing to respond to the RFP be on an existing SWC vehicle?

No. The State will be issuing a separate RFP solicitation, and it is not a requirement of vendors to be on an existing Statewide Contract (SWC) in order to participate.

54. Do you operate a centralized SOC or MSSP, and what SIEM or monitoring platform is used?

Yes, we operate a centralized SOC that specializes in application and network security. We use Splunk for log aggregation and OCI monitoring tools.

55. How are PII, financial, and regulated data protected, including privacy controls, retention policies, and residency requirements?

Front end access (public facing) is controlled through a combination of RBAC, Time Aware Data Security, Identity Management, module specific user settings, reporting controls, scheduling controls and system access controls.

System access, data controls, and data retention are consistent with Federal laws, State laws, Federal policies (NIST guidelines, MARS-E, etc.) and State policies.

Residency requirements are based on Federal and State law and policy. There

RFI # 31701-03815 – Q&A Page 11 of 12 may be approved exception to state policies.

56. Do you have data classification framework in place, and what tools or processes are used for labeling, encryption, DLP, and access control?

Data classification frameworks are in place. Data classification is set by the system data owners. Data classification was identified with go-live of existing system. It is reviewed and updated for every significant system modification (rehosting, new modules, etc.). Access control. Base level access (self-service) is granted to all state employees. Any additional access must be requested and approved by the agency signing authority or designee. Core functionality (HR configuration, payroll, accounts) are limited to the owning agency.

57. How is vendor, contractor, and auditor access provisioned, monitored, and revoked?

Vendor – request access to the vendor portal. (There are additional verification steps prior to vendor payment).

Contractor – hired in system. ID created (limited contractor self service). Any additional access must be requested and approved by the agency signing authority or designee.

Auditor (state – agency) – They receive self-service. There are specialized agency auditor roles and data level security that must be requested and approved.

Auditor (state – Comptroller) – They receive self- service. There are specialized Comptroller auditor roles and data level security that must be requested and approved.

Auditor (non-state) – If system access is required, they are entered into the system as a contractor and assigned contractor self- service. Then they may be assigned agency audit roles as requested and approved.

58. How are roles defined and governed for sensitive systems (e.g., ERP, Finance, HR), including joiner/mover/leaver processes and periodic access reviews?

Roles, time aware data access, etc. are custom and work in conjuration. Roles grant access to system functions (navigations, pages, processes, reports, etc.) time aware data access limits the data (high level example: Agency A may not see Agency B - N’s data; the owning agency, Agency B may see all data A – N).

Employee attestation is performed at least annually.

RFI # 31701-03815 – Q&A Page 12 of 12

Non-employee (contractor) attestation is performed quarterly.

Vendor attestation is performed annually.

Non-TN employee (benefit participant) attestation is performed annually.

Non-employee learner attestation is performed quarterly.

59. What enterprise identity platform is used today for workforce and external users, and how are MFA, privileged access, and segregation of duties enforced?

We use OCI IAM for authentication and MFA and a custom application for identity governance.

2. RFI Amendment Effective Date. The revisions set forth herein shall be effective upon release. All other terms and conditions of this RFI not expressly amended herein shall remain in full force and effect.