ESBD_368287_1723236874225_SOLADD_2_405-24R0010718.pdf

ADDENDUM OF SOLICITATION

1. SOLICITATION NO.

405-24R0010718

2. ADDENDUM NO.

3. EFFECTIVE DATE

8/09/2024

4. ISSUED BY

Department of Public Safety Procurement and Contract Services 5805 North Lamar Blvd. Bldg. A 1st floor Austin, Texas 78752

5. NAME AND ADDRESS OF OFFEROR

6. The above numbered solicitation is amended as set forth in Item 7. The hour and date specified for receipt of Offers is extended, is not extended.

Offers must acknowledge receipt of this addendum prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing Items 5 and 8, and returning 3 copies of the addendum; (b) By acknowledging receipt of this addendum on each copy of the offer submitted; or (c) By separate letter or e-mail which includes a reference to the solicitation and addendum numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER.

If by virtue of this amendment you desire to change an offer already submitted, such change may be made by e-mail or letter, provided each e-mail or letter makes reference to the solicitation and this addendum, and is received prior to the opening hour and date specified.

7. DESCRIPTION OF ADDENDUM:

The purpose of this addendum is to answer additional vendor questions.

Except as provided herein, all terms and conditions of the solicitation, as heretofore changed, remain unchanged and in full force and effect.

8a. NAME AND TITLE OF SIGNER (Type or Print)

8b. OFFEROR

(Signature of Person Authorized to Sign) Date Signed

Question # Vendor Question DPS Response to Vendor Question

Is a response required for each item in ESBD_368287_1721085186748_SOLICIEXH_F.10_IT Requirements?

Respondent must acknowledge the requirements of the IT exhibit can be met. If a section cannot be complied with, the respondent must acknowledge and provide an exception which DPS will review and confirm or reject.

Requesting a two week extension. Given the size of the requirements, it will be very difficult to respond to this RFO by the 8/20 deadline. The closing date will not be extended.

Which Cyber Security protocols must be achieved in this project (Example: CAIQ/TXRamp)? A: Per section C.15 Cyber Security Contract Requirements: For hosted services using a third-party cloud services provider, the Contractor must deploy in an environment authorized by TX-RAMP, StateRAMP, or FedRAMP at high impact and maintain program compliance and certification throughout the term of the contract. If CJIS data is being processed, stored, or transmitted, Contractor must deploy in a Government Cloud environment. A TX-RAMP Level 2 Certification and a CAIQ will be required

All Cyber Security protocols outlined in the solicitation must be adheren to. Any exceptions must be submitted with vendor's response proposal. Test or "dummy" data may be transferred to a solution with a provisional certificate. A full certification is required for production (real) data.

Can you please confirm the requirement is for TxRamp/StateRamp/FedRamp 2/MODERATE ? TxRamp Level 2 Certification and the CAIQ (Consensus Assessment Information Questionairre) generally correspond to TxRamp/StateRamp/FedRamp 2/MODERATE. The answer to question 4 states: “TX- RAMP Level 2 Certification and a CAIQ will be required”. This indicates TxRamp/StateRamp/FedRamp

2/MODERATE.

TX-RAMP Level 2 Certification is the required minimum certification level for a cloud computing service that processes, stores, or transmits agency data determined to be confidential and determined to be a moderate or high impact information resource.

Per the RFO section C.15 Cyber Security Contract Requirements: For hosted services using a third-party cloud services provider, the Contractor must deploy in an environment authorized by TX-RAMP, StateRAMP, or FedRAMP at a High impact and maintain program compliance and certification throughout the term of the contract. If CJIS data is being processed, stored, or transmitted, Contractor must deploy in a Government Cloud environment. A TX- RAMP Level 2 Certification and a CAIQ will be required.

For vendors with a current TX-RAMP Provisional Authority to Operate (P-ATO) authorization and an auditable plan showing a path to full TX-RAMP, StateRAMP and FedRAMP ATO certification prior to the anticipated project Go Live date, can you please confirm that this is sufficient for submission and fair consideration of a proposed solution?

Provisional certification at the time of Contract Award is acceptable. Full certification is required for implementation

If a vendor offers a true Software as a Service (SaaS) solution in a FedRAMP/StateRAMP certified hosting environment like Microsoft Azure, and can demonstrate substantially similar security, compliance and service levels within their current enterprise cloud hosting infrastructure to a comparable ‘government cloud’, will the state consider alternatives to a ‘government cloud’ hosting designation?

Alternatives to Gov Cloud are not acceptable. If CJIS data is being processed, stored, or transmitted, Contractor must deploy in a Government Cloud environment. A TX-RAMP Level 2 Certification and a CAIQ will be required.

Given that a signed CJIS Security Addendum is not required at the time of proposal submission, and it is still being determined if and what type of CJIS/PII data would be stored in the new system, can you please confirm vendors can assess the need for CJIS compliance and make a good faith effort to fulfill those obligations at contract award if deemed necessary?

Vendors have the ability to assess the CJIS reuirements and can confirm such prior to a contract being awarded.

PART 1: Interface Requirement Reconciliation The following interfaces are not part of RFO Sections

4.1.6 LTC Interface Requirements or 4.1.7 LTC Program-Specific Interface Requirements.

8.1

1. 001 - Texas.Gov – WEB: Can you confirm that this interface is a solution requirement.

There may be an interface to Texas.gov, but the solution will contain the external application and user interfaces. It will not be built or maintained by Texas.gov.

8.2 2. 002 - Crime Record / through CBM. Please verify if this interface is required. FACT clearinghouse replaces these

8.3 3. 003 – Cherwell. No

8.4 a. Please verify if this interface is required.

8.5 b. Does DPS expect a ticket system to be integrated as an interface between the contact center and ELS?

8.6 4. 004 - MAB (Medical Advisory Board). Please verify if this interface is required. We will explore this as they do have an interface, but we do not currently use it.

8.7 5. 005 – OpenFox. Please verify if this interface is required. Not required

8.8 6. 006 – HHS. Deceased List. Please verify if this interface is required. This is an imported file, will explore an interface if available.

8.9 7. 007 – Finesse. Please verify if this interface is required. We would like to interface with this, it does not need to be in our initial go-live.

9 PART 2: Interface Requirement Reconciliation

9.1 1. 004 & 005: Will Rapbacks be included in the 005 FACT transactions or will they be separate? Included in FACT clearinghouse

9.2

2. 009 to 012 (G. Card Vendor): Will the card generation process and interaction with the vendor be file based or transactional for each step in the process? It will be file based, as that will be the existing process when this contract starts

9.3 3. 017 Kaseware. Kaseware will be a service at startup, will eventually replace.

9.4 a. Will Kaseware also be part of the Complaint process or will ELS manage complaints separately?

9.5 b. Please verify if Kaseware replaced iDocket and SPURS.

9.6 4. For all the interfaces below, can you validate the interface type to be used. Information will be provided after contract award as part of project scope

9.7 5. For all the Interfaces below, can you validate the calculation and transaction estimates. Information will be provided after contract award as part of project scope

9.8 6. Gap. Will the DPS email server be an additional interface? Possibly, if the vendor system does not have that functionality.

9.9 7. Gap. Does DPS need an address verification service or does DPS have a service that the vendor can use with We do not have an address validation service, vendor to supply

DPS- Enterprise Licensing Platform RFO- Q&A 405-24R0010718