F-548(5)_addendum2-12.27.2024.docx

Office of State Procurement 112 Administration Building 50 Sherburne Avenue St. Paul, MN 55155

SOLICITATION ADDENDUM

SCOPE OF ADDENDUM

This addendum containing the following revisions, additions, deletions, or clarifications is hereby made part of the Solicitation, including the Sample Contract and Exhibits if applicable.

The purpose of this addendum is to revise the due date and time of the Solicitation and respond to questions received by the deadline stated in the Solicitation.

Responders acknowledge receipt of this addendum by responding to SWIFT Event No. G0210-2000016267, Version 3 (or more recent version) by the solicitation due date and time.

Except as modified by this addendum, all the terms and conditions remain in full force and effect.

ADDENDUM

The State extends the due date and time of the Solicitation from January 7, 2025 at 3:00 PM CT to January 28, 2025 3:00 PM CT.

The following sections of the Solicitation are amended as follows (strike through is used for deletions and underlining for insertions):

Attachment C, Supplement 1, Section B Printer Costs Only is REVISED to:

The price detailed below MUST include full software and hardware support coverage in accordance with the requirements in Section 56 and Section 61 Section 52 – 56 of Attachment F: Technical Specifications and Responses Below are the State’s responses to questions received by the deadline stated in the solicitation.

Due the complexity of the RFP and research required for the numerous security requirements, will an extension of at least 30 days be granted?

See Line I above.

Will this contract be awarded to a single vendor?

Yes, a single award is intended.

We understand that the live scan vendor does not need to be currently certified to transmit a live scan in the state. Once awarded, how long is the certification process expected to take?

Regarding FBI Certification, additional information is available at https://fbibiospecs.fbi.gov/certifications-1/cpl/faq. Per the site, “It (certification) takes one to two months from original receipt of the test data, assuming there are no substantial problems.”

Will the answers to all vendors’ questions be published publicly?

Yes, all answers to questions received by the question due date and time are reflected in Addendum 2.

Where can we find the State of Minnesota’s Digital Accessibility Standard?

The State of Minnesota Accessibility Standards are available at https://mn.gov/mnit/government/policies/accessibility/.

How does compliance or non-compliance of the Digital Accessibility Standard impact scoring?

The response to Attachment E, Section 3. Accessibility of Services and Products will be reviewed and scored including the submitted VPAT Form for software, hardware and websites (as applicable).

As reflected in the Request for Proposal, Section 5, Phase 2, up to 100 points will be allocated for VPAT – Accessibility of Services or Products.

Where can we find the State’s Terms and Conditions and Sample Contract?

Please review Addendum 1 and the documents within the SWIFT Portal.

Regarding Attachment E, Section 4, Installation and Set Up, a workstation will be prepared for a Contractor representative to install the Live Scan Machine.

Just to confirm, “workstation” as noted above, means “work area”, not to be confused with a computer workstation? Also, is the State is looking for a turnkey system?

Yes, the reference to “workstation” within Attachment E, Section 4 is referring to a dedicated space to install the Live Scan Machine.

The Live Scan machine should be “turnkey” as a working unit that will be installed in a dedicated workspace. The workspace may be table, desktop or mobile cabinet. See table provided in Attachment F, Section 34.1.

Regarding Attachment F, what are the acceptable codes for columns E and N?

In Attachment F, Columns E (Mandatory) and N (Desire), provide a response of “Yes” or “No” for each line. Additional information may be provided in columns F and O respectively.

Regarding Attachment F, is a description or documentation mandatory if the response is “Yes” and does not state to explain?

Documentation will not need to be provided in a response but may be requested, as stated in the Request for Proposals, Section 4.

Regarding Attachment F, Section 10.7, does the Minnesota Department of Administration (MDA) require the ability to push the statute tables from the Livescan Management Server to all connected devices in addition to the livescans having the ability to request and pull the updated statute tables from the Livescan Management Server itself?

Yes, the expectation is for current statutes tables to be available to the Livescans. Responders are encouraged to provide how the proposed management server would provide updates to livescans (whether daily, weekly, monthly, etc.) and including if the proposed system will use our statute service.

Regarding Attachment F, Section 34.1, can additional columns be added to accommodate specific Computer type and Capture Mode as further defined below? These should have their own configuration. Combinations for Criminal Config 2 could include Desktop with Live Capture, Desktop with Card scan, Laptop with Live Capture, and/or Laptop with Card scan. Same for Civil Config 1. Criminal Config 1 should also have one for Desktop and one for Laptop.

Also, a full- size monitor is listed as required for each configuration. Is this intended even if the agency selects the Laptop? This would also be addressed with additional configuration options.

The State open to adding additional configurations for hardware designations.

If a laptop is selected, the laptop monitor would satisfy the requirement of a full-size monitor. A separate monitor would not be required.

Regarding Attachment F, Section 34.3. (mandatory requirement) Is the 1000 ppi scanning a requirement for card scanners, for livescans, or for both?

The mandatory requirement is for both card scanners and livescans to have the ability to scan 1000 ppi.

Regarding Attachment F, Section 41.1, for “Printing Options”, please explain the type of printing options that you would like to be configurable?

The “Printing Options” may include criminal vs. applicant vs. hard card vs. paper. The State anticipates working with the Awarded Contractor regarding specific customizations.

NOTE: Attachment F, Section 41.1 is a “Desired” capability.

Regarding Attachment F, Section 41.1, regarding “Internet access”, our Kiosk-mode can restrict internet access to only specific permitted (e.g., white-listed) URLs. Is this what you mean?

Yes, it is also desired to have the ability to block all internet access.

NOTE: Attachment F, Section 41.1 is a “Desired” capability.

Regarding Attachment F, Section 46.1, the latest version of the operating system must have FIPS 140-2 NIST certified encryption according to requirement 43.1.; however, universally the latest version of the operating system never includes a FIPS 140-2 NIST certified encryption engine due to the time lag required for certification. How is this conflict to be reconciled?

This will be negotiated at the time of Award. Responders should indicate the most current version of their operating system that includes FIPS 104-2 NIST certified encryption at the time of their response, along with the versions that have been released following the release of that operating system.

Regarding Attachment F, Section 47.1, please provide the list of antivirus software the BCA has approved.

The BCA does not have a list of approved anti-virus software. The anti-virus software must meet FBI/CJIS guidelines.

According to the FBI's CJIS security policy, agencies accessing criminal justice information must utilize a robust antivirus solution that meets industry standards, including real-time protection, signature-based detection, and heuristic analysis to effectively identify and prevent malware threats, ensuring the confidentiality and integrity of sensitive data.

Regarding Attachment F, Section 47.3, do the antivirus software updates come from BCA servers or the Livescan Management Server?

The vendor will own the antivirus solution, patches, updates, management, and logging.

Regarding Attachment F, Section 48.3, please provide the BCA's vulnerability standard.

Vulnerabilities will need to be remediated in accordance with the stricter of these standards or policies: Threat and Vulnerability Management Standard, CJIS Security Policy Resource Center — LE, and BCA CJDN Security Policy. More information is available through the links below:

Threat and Vulnerability Management Standard https://mn.gov/mnit/assets/Threat%20and%20Vulnerability%20Management%20Standard_tcm38-323798.pdf CJIS Security Policy Resource Center — LE https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center BCA CJDN Security Policy https://s3.us-east-2.amazonaws.com/assets.dps.mn.gov/s3fs-public/migrated-files/divisions/bca/bca-divisions/mnjis/Documents/MNJIS-5002-CJDN-Network-Security-Policy.pdf Regarding Attachment F, Section 51.2, is a card scanner that has an Automatic document feeder for capturing cards at 1000ppi required?

The mandatory requirement is for both card scanners and livescans to have the ability to scan 1000 ppi. If this is not possible with a document feeder, please clarify in your response.

Regarding Attachment F, Section 57.3, the hyperlink to this document is non-functional. Please provide a functional link or a copy of the document.

The web address is https://bcanextest.x.state.mn.us/launchpad/links/links.cgi.

Regarding Attachment F, Section 60.1 and 60.2 (mandatory requirements), MFA and LCM provided usernames and passwords. Do you want users to utilize usernames and passwords that the vendor-provided system manages (rather than credentials from AD, Azure AD, or other government-owned systems)?

The vendor system(s) would need to provide usernames, passwords, and MFA.

Regarding Attachment F, Section 60.1 and 60.2 (mandatory requirements), MFA and LCM provided usernames and passwords. Do you want officers to be required to re-authenticate including the use of MFA for each transaction (e.g., booking, submission, re-submission, etc.)?

The FBI CJIS Security Policy requirement is that users reauthenticate after 30 minutes of inactivity, they initiate a device lock before leaving the system unattended and require log out when a work period has been completed.

Regarding Attachment C, can additional line items be added to the spreadsheet (i.e., there are multiple card swipe devices available)?

Also, there is a difference in cost between a laptop and desktop so three of the configurations would require a separate line each spelling out the type of computer.

The same applies to Live Capture vs. Card scan. Two of the configurations would require separate lines.

Yes, the responder may add additional configuration options if applicable. The information will be reviewed but not used for scoring.

Regarding Attachment C, for the LCM, does the State plan to provide the server, OS and SQL if required or is that the responsibility of the Vendor? If the vendor is to provide that can be added to the Cost sheet.

This may be negotiated depending on the LCM solution.

Regarding Attachment C, Price Schedule, it makes reference to Sections 56 and 61 of Attachment F. Are these the correct sections? Perhaps all or some of sections 52-56 are desired instead?

See Line II above.

After the new vendor system is approved and certified, what timeframe is expected for the agencies to purchase the 197 or so new livescan systems?

The anticipated cycle is about 30 per year. Historically we have a 5-year replacement cycle.

Is it possible to have an opportunity to submit a second round of questions, following illuminations that will be revealed by the first round.

While responders may submit questions at any time, per Section 3 of the RFP Document, the State might not respond to any questions after December 17, 2024.

Responders that come up with additional questions should submit them as soon as possible for consideration. A Responder’s failure to ask clarifying questions prior to the response due date shall not relieve the Responder of the obligation to meet the mandatory requirements.

END OF ADDENDUM

image1.jpeg