EVT0010497_-_Bid_Amendment_1_Q___A.pdf

Office of Procurement and Contracts 900 SW Jackson St., Room 451 South Topeka, KS 66612

Phone: 785-296-2376 Fax: 785-296-7240 www.admin.ks.gov/offices/procurement-and-contracts Adam Proffitt, Secretary Todd Herman, Director

Laura Kelly, Governor

Amendment

Request for Proposal

Date: October 14, 2025

Amendment Number: 1

Event Number: EVT0010497

Closing Date: October 30, 2025, 2:00 PM CST

Procurement Officer: Justin Hubbard

Telephone: 785-296-6271

E-Mail Address: justin.hubbard@ks.gov

Agency: Kansas Department of Revenue

Item: FileNet Upgrade

Conditions: 1) Answers to submitted questions follow on page two (2) of this document.

A signed copy of this Addendum must be submitted with your bid. If your bid response has been returned, submit this Addendum by the closing date indicated above.

I (We) have read and understand this addendum and agree it is a part of my (our) bid response.

NAME OF COMPANY OR FIRM:

SIGNED BY:

TITLE: DATE:

It shall be the vendor's responsibility to monitor this website on a regular basis for any changes/addenda.

http://admin.ks.gov/offices/procurement-contract mailto:justin.hubbard@ks.gov http://admin.ks.gov/offices/procurement-contract

Event ID: EVT0010497

EVT0010497 – Amendment 1

FileNet Upgrade

Questions and Answers

Q1: On page 26, KDOR mentions needing both upgrade steps (5.5.4 —> 5.5.8 —> 5.6) to happen in “one day” — does this apply for both dev/test environment AND prod environment? Can KDOR describe what they envision occurring as a part of this one day operation, and what high-level goals may be accomplished outside of this one day operation?

A1: Dev/test would be prior at a different time For Prod – The upgrade in production should be in a single day or over a weekend. We want to limit production down time, and we don’t want to stay on 5.5.8 for any length of time. As long as we are in production on 5.6 as the end goal.

Q2: Can KDOR more fully describe the way in which Encapture is used with FileNet and is integrated with it from a business & technical perspective?

A2: Encapture is the primary way images are ingested into FileNet. It is used for moving scanned images into P8 where they are organized and filed.

Q3: KDOR mentions the CPE versions, but what is the current version of ICN installed on the

5.5.4 system to date?

A3: We are on CPE 5.5.4, and ICN is 3.0.7

Q4: KDOR mentions upgrading existing servers to CPE 5.5.8, is the intent to also upgrade existing servers to the “matching” ICN version that was current at the time of 5.5.8 release?

A4: With moving to 5.5.8 we would be moving to ICN 3.0.11

Q5: For the last bullet point on page 26, in reference to “… the program does not prompt for credentials whenever an image must be viewed…”, can we get further clarification on which program is being referred to here? Additionally, can we describe how users view these images to date? For example:

1. As a logged in user within FileNet context?

2. As a logged in user in a secondary / external system to FileNet that queries or displays

FileNet images / documents?

3. As a user not logged into any system, but viewed through some sort of portal (public or private)?

A5: We have a workflow application that logs into FileNet, because of this we do not need Daeja ViewONE prompting for a password. We need to continue to pass the user ID and PW into the request that is being sent to pull the image.

We want the user experience to be the same, with the upgraded software, and need help with setting it up to hit the new version of ICN/Daeja ViewONE.

Q6: From our understanding, KDOR has a two environment system, can you please describe the architecture of each? I.e., how many FileNet servers are in each environment, and what FileNet components are installed on them?

A6: Dev/test – ICN server, CPE server, Websphere is on both

Prod - ICN server, CPE server, Websphere is on both

Q7: How are CPE’s FileStorage requirements currently being met to date?

A7: It is a virtual machine on VMWare

Q8: Regarding the statement of “…previously challenging with one of the integrated applications due to changes in cefsharp…”, given what cefsharp is, can KDOR further describe how they are using cefsharp in relation to FileNet and the broader solution used today?

A8: It refers to the application mentioned in Q5 Daeja ViewONE. cefsharp chromium framework referenced by the application that is used to pull the cookie information from from ICN/Daeja ViewONE to be used with displaying the image URL. The version of cefsharp that works for this process is outdated and has vulnerabilities and we need assistance in updating how this is done that may not require cefsharp.

Q9: In terms of assisting and supporting discovery of changes in existing KDOR processes, can KDOR describe what other processes or applications would be included in this step?

Is it only FileNet and Encapture, or are more pieces of the solution expected to be reviewed?

A9: The intent is to identify any required changes necessary for the upgrade. i.e. with Daeja ViewONE in the answer to Q8

Q10: We can accommodate a number of training needs, but can KDOR provide any further clarification on what types and level of training may be required for their users? For example, number of sessions, end-user training sessions, train-the-trainer sessions, can training be completed virtually, or is on-site training needed?

A10: We don’t expect to need end user training. The only training that may be needed is administration training at the admin level. Virtual training would be sufficient.

Q11: KDOR mentions heavily using scanning (895 locations as of 2024), are there any concerns from KDOR around changes or configuration needing to be provided for these scanning locations as a part of this RFP?

A11: No current specific concerns here.

Q12: KDOR mentions indexing as a part of their solution - is Content Search Services (CSS) component from IBM a part of your solution?

A12: We don’t use CSS. And the indexing mentioned in our background info is performed by an in-house workflow application.

Q13: Is KDOR’s current FileNet Solution configured in a High Availability method (workload distributed across multiple redundant servers for each component of FileNet in case one server should fail or require maintenance, etc.)?

A13: No we don’t have high availability set up on those servers.

Q14: While it is not explicitly mentioned in specifications brief on pages (26-27), for the Data Security Attachment, it is mentioned that the contractor would be responsible for Disaster Recovery type concerns. Can KDOR confirm that the FileNet vendor would need to account for this as a part of their proposal? If so, what is KDOR’s current DR system and plan for their to date FileNet & Encapture solution?

A14: No, disaster recovery is part of the managed services provided by our data center hosting provider.

Q15: As a part of the upgrades to 5.5.8 and 5.6, we assume that KDOR will want the latest fix packs and interim fixes installed and applied for the respective FileNet components, is this correct?

A15: Yes

Q16: What is the underlying FileNet database in use (i.e., Oracle, SQL, DB2, etc.)?

A16: SQL

Q17: In regards to the FileNet document storage, what role will the FileNet vendor take in migrating this data from the old system to the new system? Would the FileNet vendor be fully responsible for migrating the data from one system to the next, or would the vendor simply be directing and assisting KDOR technical staff with this operation?

A17: We don’t expect there to be a data migration given the way the infrastructure is designed.

Q18: For the FileNet document storage how large is the storage to be migrated for each environment (DEV & PROD)?

A18: 13 TB

Q19: For the FileNet document storage, how are they currently being stored and accessed by

CPE (Network attached storage, Database storage only, etc.)?

A19: It’s on the filesystem on the virtual machine

Q20: For the system at large, what types of servers are in use here? Are these KDOR owned and operated, physical servers? Are they virtual servers? Is this a cloud-based solution?

Is this a containerized solution?

• Is there another vendor that is responsible for managing and maintaining the servers in the platform, or is this handled by KDOR technical staff?

A20: All virtual machines are hosted in a Unisys co-located in a datacenter with other KDOR and state servers. Unisys handles anything below the operating system.

Q21: For the system at large, what operating system is currently in use? Are the new servers going to be using the same OS, or a new version?

A21: Windows Server 2019

Q22: If subcontractors are included, should each submit their own Tax Clearance Certificate, or is only the prime bidder’s certificate required?

A22: See requirements as stated in the Event Details document.

Q23: Will KDOR provide the necessary IBM FileNet and WebSphere licenses, or should vendors include licensing in their cost proposal?

A23: We will handle the licensing

Q24: Are there any custom workflows, scripts, or integrations beyond ICN and Daeja ViewONE that may require remediation during the upgrade?

A24: Not that we are aware of

Q25: For ICN 3.1.0 and Daeja ViewONE, does KDOR expect configuration-only support, or will code changes be required for authentication fixes?

A25: Until we know what the changes to ICN and Daeja ViewONE are, we won’t know if one or both are needed. Vendor should assume both are needed.

Q26: Is KDOR seeking automation of regression testing for UAT/System Testing, or will manual test execution be sufficient?

A26: Manual test execution is sufficient

Q27: What duration is expected for Post-Implementation Support after the first upgrade—90 days, 6 months, or until acceptance?

A27: 30 days should be sufficient

Q28: For the planned second upgrade in ~2 years, does KDOR expect vendors to lock in pricing now or only commit to scope with future pricing negotiations?

A28: This is a fixed price bid per Section 3.38 Prices. Bidders must submit pricing for the full contract term.

Q30: Does KDOR require vendors to host any non-production environments, or will all DEV/TEST/PROD servers be provided by KDOR?

A30: All servers will be provided by KDOR

Q31: Are there specific security tools/vendors (e.g., vulnerability scanners, SIEM) that KDOR requires vendors to integrate with during the upgrade?

A31: Servers will run anti-virus and endpoint detection and response (EDR) software. There is not direct interaction with the FileNet software with those tools.

Q32: Will remote access be via VPN/RDP provided by KDOR, or does KDOR require a specific secure remote tool?

A32: Remote access will be using BeyondTrust PRA

Q33: Will KDOR require a full SOC 2 Type II or NIST 800-171 compliance report, or will vendor responses to Appendix A security questions suffice?

A33: Yes, if the SOC 2 report exists it would be the more comprehensive of the two, the minimum is to answer the questionnaire.

Q34: The Generative AI policy (P8200.00) requires disclosure of AI use. If a vendor uses AI-assisted coding tools internally, should this be disclosed even if no client data is processed?

A34: Yes

Q35: Would the State prefer to be charged actual costs for any pre-approved travel, or should proposers include travel assumptions in their fixed pricing?

A35: This is a fixed price bid per Section 3.38 Prices. Bidders must submit pricing for the full contract term.

Q36: Who is the incumbent vendor currently supporting KDOR’s FileNet system, and are they eligible to rebid on this procurement?

A36: Support is provided by IBM

Q37: Can KDOR share the historical spend or approximate contract value of the most recent FileNet support/upgrade engagement?

A37: The previous contract was for $61,000.00 and the actual spend was $53,500 for upgrade/support.

Q38: Were there any significant issues, lessons learned, or performance challenges with the incumbent vendor that KDOR would like bidders to address in their proposals?

A38: We learned we need a thorough tabletop run through before go live. As well as a dry run of any data conversions and interfaces.

END OF AMENDMENT 1 – EVT0010497