FDLE-RFI-2643 Addenda 1.pdf

DATE: May 26, 2026

SOLICITATION NUMBER: FDLE RFI 2643

SOLICITATION TITLE: Computerized Criminal History and CJIS Data Collections Systems

REPLY OPENING: June 10, 2026

ADDENDA NUMBER: 1

This addendum serves as notice of responses to questions received from potential Vendors relevant to the Request for Information (RFI).

All other terms and conditions of the RFI remain unchanged.

THIS ADDENDUM NOW BECOMES PART OF YOUR PROPOSAL RESPONSE.

THE ADDENDA ACKNOWLEDGEMENT FORM SHALL BE SIGNED BY AN AUTHORIZED COMPANY REPRESENTATIVE, DATED AND RETURNED WITH THE RFI RESPONSE.

ADDENDA ACKNOWLEDGEMENT

COMPANY NAME:

ADDRESS:

CITY: STATE: ZIP:

AUTHORIZED REPRESENTATIVE: TITLE:

AUTHORIZED SIGNATURE: DATE:

PHONE: EMAIL:

FAILURE TO FILE A PROTEST WITHIN THE TIME PRESCRIBED IN FLORIDA STATUTE 120.57(3) OR FAILURE TO FILE A BOND OR OTHER SECURITY WITHIN THE TIME ALLOWED FOR FILING A BOND SHALL CONSTITUTE A WAIVER OF

PROCEEDINGS UNDER CHAPTER 120 FLORIDA STATUTES.

FLORIDA DEPARTMENT OF LAW ENFORCEMENT

FDLE-RFI-2643

Computerized Criminal History and CJIS Data Collections Systems Addendum #1

Vendor Questions and Answers

Question #1

Is FDLE seeking information only from vendors with an existing commercial off-the-shelf CCH/Data Collections SaaS product, or will FDLE also consider responses from cloud modernization, systems integration, data platform, and managed services vendors that can design, implement, secure, and operate a future-state SaaS platform?

Answer #1

Vendors may provide information regarding commercial off-the-shelf solutions, modernization services, systems integration capabilities, managed services, SaaS platforms, or other approaches aligned with the needs identified within this RFI.

Question #2

Would FDLE consider a modular approach where CCH modernization, Data Collections modernization, reporting/analytics, workflow, data quality, and cloud operations are implemented as separate but integrated components?

Answer #2

FDLE is open to reviewing information regarding various solution approaches, including modular or integrated approaches, as part of this RFI process.

Question #3

Does FDLE have a preferred cloud provider for the future-state solution, or is AWS GovCloud acceptable if the proposed architecture satisfies FBI CJIS Security Policy and applicable State of Florida cloud/security requirements?

Answer #3

As stated in Section 7.2.d of the RFI, FDLE’s preference is GovCloud or another cloud provider capable of complying with the FBI CJIS Security Policy and applicable State of Florida security requirements. Vendors may provide information regarding compliant hosting approaches as part of their response.

FDLE-RFI-2643 2 Addendum #1

Question #4

For Data Collections currently hosted in the State’s Azure Government Cloud tenant, is FDLE open to migration, hybrid integration, or multi-cloud architecture as part of a future procurement?

Answer #4

FDLE is requesting information regarding potential solution approaches and architectures.

Vendors may provide information regarding migration, hybrid integration, multi-cloud, or other architectural approaches as part of their response.

Question #5

Does FDLE expect the vendor-hosted SaaS solution to include all application functionality, hosting, security, infrastructure, managed services, and custom development under one prime contractor, or would a prime/subcontractor team be acceptable?

Answer #5

FDLE is requesting information regarding potential service delivery approaches and operational models. Vendors may describe proposed teaming structures, including prime/subcontractor arrangements, within their response.

Question #6

Should vendors include a proposed phased migration roadmap in the RFI response, including discovery, data profiling, pilot, migration, parallel operations, cutover, and managed operations?

Answer #6

Vendors may include any information they believe would assist FDLE in understanding their proposed approach, including phased migration methodologies or implementation considerations.

Question #7

For AI ad-hoc reporting, should vendors assume FDLE prefers a private/dedicated AI environment with no Department data used to train public or generalized AI models?

Answer #7

FDLE encourages vendors to review Section 7.1.b of the RFI regarding AI Ad-Hoc reporting requirements and provide information regarding how their proposed solution addresses those requirements.

FDLE-RFI-2643 3 Addendum #1

Question #8

Are there specific transaction volume, user concurrency, response time, storage, batch processing, or reporting performance assumptions FDLE would like vendors to use when describing scalability?

Answer #8

Vendors should utilize the information provided within the RFI when describing scalability and system capabilities. Additional metrics or assumptions may be proposed by the vendor as part of their response.

Question #9

Are vendors expected to provide sample service level targets for availability, incident response, recovery time objective, recovery point objective, and support response times?

Answer #9

FDLE encourages vendors to provide sample service level targets and operational support information, including availability, incident response, recovery objectives, and support response time considerations, as part of their response.

Question #10

Does FDLE have specific expectations for NIEM/IEPD version management, schema validation, and technical documentation automation that vendors should address?

Answer #10

Vendors should address the requirements and requested information identified within Sections 7 through 9 of the RFI, including information related to NIEM, IEPD processes, schema management, and technical documentation.

Question #11

Should vendors provide general budgetary pricing ranges by phase and cost drivers only, without specific price quotes, consistent with the RFI instructions?

Answer #11

Yes. Vendors should follow the instructions provided in Section 10, Tab 3 – Sample Pricing Information. Vendors may also provide additional budgetary pricing assumptions, structures, or cost considerations they believe would assist FDLE in understanding their proposed approach.

Specific price quotes are not requested as part of this RFI.

FDLE-RFI-2643 4 Addendum #1

Question #12

Will FDLE allow vendors selected for information exchange meetings to provide demonstrations of proposed architecture, workflows, dashboards, reporting, or security operations capabilities?

Answer #12

As stated in Section 11 of the RFI, FDLE may hold information exchange meetings with selected vendors, which may include demonstrations of the products or services described in the vendor’s response.

Question #13

What are the current and projected annual transaction volumes (or monthly averages) for key activities such as arrest/disposition records in CCH, submissions through the CJIS Portal, CJDT person-based records, FIBRS incidents, and UAA affidavits? Are growth projections available for the next 3–5 years?

Answer #13

Vendors should utilize the information provided within the RFI regarding current system operations and volumes. FDLE is not providing additional transaction volume projections at this time.

Question #14

Does FDLE have a strict requirement for Microsoft Azure Government Cloud specifically, or would other CJIS-compliant GovCloud providers (e.g., AWS GovCloud) that meet FBI CJIS Security Policy and Rule 60GG-4 be acceptable?

Answer #14

See Answer #3.

Question #15

For the AI Ad-HOC reporting capability (Section 7.1.b), is a single-tenant dedicated environment sufficient to meet the data segregation and non-training requirements?

Answer #15

See Answer #7.

FDLE-RFI-2643 5 Addendum #1

Question #16

Is the primary focus of this modernization on the Data Collections systems (CJDT, FIBRS, UAA, CJIS Portal), or is FDLE seeking a single integrated solution that also fully replaces or enhances the current CCH system?

Answer #16

FDLE is requesting information related to modernization opportunities for both the Computerized Criminal History (CCH) and Data Collections Systems as described within this RFI.

Vendors may provide information regarding integrated or separate approaches.

Question #17

What are the most critical integration points required with existing FDLE systems (e.g., MBIS, current CJIS Portal, FCIC)?

Answer #17

Vendors should review the information provided within the RFI regarding existing system interactions and dependencies and may provide recommendations regarding additional integration considerations within their response.

Question #18

To what extent does FDLE anticipate needing custom development versus out-of-the-box configuration of a commercial SaaS solution?

Answer #18

FDLE is requesting information regarding available vendor capabilities and solution approaches.

Vendors may describe configurable functionality, custom development capabilities, or hybrid approaches within their response.

Question #19

What contract term length is FDLE most interested in exploring (e.g., 3-year, 5-year initial term with renewal options)?

Answer #19

Question pertains to a potential future procurement terms and conditions and is outside the scope of this RFI.

FDLE-RFI-2643 6 Addendum #1

Question #20

Could you please confirm whether there is any FedRAMP requirement associated with RFI- 15805 / FDLE-RFI-2643 – Computerized Criminal History and CJIS Data Collections Systems?

Answer #20

FDLE has not identified a FedRAMP requirement as part of this RFI. Vendors should review Appendix A and the applicable security requirements identified within the RFI and provide information regarding how their proposed solution addresses those requirements.

Question #21

Is the State open to having the solution hosted in the State’s cloud tenant, operated and managed by the vendor?

Answer #21

FDLE prefers vendor-hosted cloud solutions capable of complying with applicable CJIS Security Policy and State security requirements identified within the RFI.

Question #22

Is the State open to purchasing software/cloud subscription on a separate contract (via the State’s reseller of choice) and contracting with the vendor only for the services? (The vendor will provide the State specifications of the software that needs to be purchased. Buying thru a State contract is anticipated to be financially advantageous to the State.)

Answer #22

Vendors should provide information regarding the solution and service delivery approach they believe best aligns with the needs identified within this RFI.

Question #23

Does FDLE anticipate a single prime award covering both CCH and Data Collections, or separate awards by domain?

Answer #23

FDLE is seeking information regarding potential solution and service delivery approaches and has not made determinations regarding future procurement structure at this time.

Question #24

Does FDLE anticipate a prime system integrator model (SI-led) versus a COTS/SaaS product vendor as prime?

FDLE-RFI-2643 7 Addendum #1

Answer #24

FDLE is requesting information regarding available solution and service delivery approaches.

Vendors may describe their proposed operational and implementation models within their response.

Question #25

Will the follow-on solicitation allow modular subcontractors (e.g., analytics/entity resolution/deduplication), or is an end-to-end suite preferred?

Answer #25

Vendors may provide information regarding the solution and delivery approach they believe best aligns with the needs identified within this RFI.

Question #26

For Data Collections, is FDLE seeking to replace the CJIS Portal staging layer, or retain it and modernize downstream repositories/workflows?

Answer #26

FDLE is requesting information regarding modernization opportunities related to the current environment described within the RFI. Vendors may provide recommendations and approaches within their response.

Question #27

For CCH, is FDLE seeking full system-of-record replacement including lifecycle processing, or primarily workflow/reporting modernization around the repository?

Answer #27

FDLE is requesting information regarding modernization opportunities for the CCH system as described within the RFI. Vendors may provide information regarding replacement, enhancement, modernization, or hybrid approaches within their response.

Question #28

What are the highest-priority pain points for NIEM/IEPD modernization (schema version handling, tooling, automated validation, reducing time/cost of changes)?

FDLE-RFI-2643 8 Addendum #1

Answer #28

Vendors should review the information provided within the RFI related to NIEM, IEPD processes, schema management, and workflow challenges. FDLE is seeking vendor feedback and recommendations regarding these areas.

Question #29

Are interface specifications available for key systems (e.g., MBIS event sources, CJIS Portal integrations), and should vendors assume additional systems beyond those listed?

Answer #29

Vendors may identify assumptions, dependencies, or interface considerations they believe are relevant based on the information currently provided within the RFI.

Question #30

Will FDLE require the solution to operate in vendor-owned GovCloud tenancy, FDLE-owned cloud tenancy, or is either acceptable?

Answer #30

FDLE is requesting information regarding potential hosting and operational approaches. Vendors may provide information regarding proposed hosting models within their response.

Question #31

In the follow-on solicitation, does FDLE anticipate using a standard State contract template, and will vendors be permitted to request limited exceptions or negotiated terms (if selected)?

Answer #31

Question pertains to a potential future solicitation and contractual process and is outside the scope of this RFI.

Question #32

Will FDLE allow contract term negotiations post-award recommendation (e.g., limited redlines), or will contract terms be treated as non-negotiable?

Answer #32

Question pertains to a potential future solicitation and contractual process and is outside the scope of this RFI.

FDLE-RFI-2643 9 Addendum #1

Question #33

Does FDLE anticipate requiring vendors to accept the FDLE Information Systems Security Addendum substantially as written, or is there any flexibility via alternate controls/equivalency mapping?

Answer #33

Vendors should review Appendix A of the RFI and may provide information regarding how their proposed solution addresses or aligns with the identified security requirements.

Question #34

Will the follow-on solicitation allow modular components (e.g., identity proofing, intake fraud controls, entity resolution), or is FDLE seeking only end-to-end suites?

Answer #34

See Answer #25.

Question #35

Will FDLE pursue one prime vs multiple awards for separate components (CCH vs Data Collections vs intake/web forms)?

Answer #35

See Answer #23.

Question #36

For the “customer-facing web form” combining fingerprint + payment info, which programs are in scope (background checks, licensing, firearms, other)?

Answer #36

Vendors may provide information regarding customer-facing workflow capabilities and related solution approaches aligned with the needs identified within the RFI.

Question #37

Does FDLE expect identity proofing for these customer-facing flows, or will FDLE rely solely on authentication (MFA/SSO) after account creation?

Answer #37

Vendors may provide information regarding identity proofing, authentication, and workflow approaches they believe best align with the needs identified within the RFI.

FDLE-RFI-2643 10 Addendum #1

Question #38

Will FDLE allow identity verification services to operate in a dedicated environment, with explicit confirmation that FDLE data is segregated and not used for training, consistent with the AI constraints stated?

Answer #38

See Answer #7.

Question #39

Confirm whether identity/fraud components must meet the same CONUS-only, SOC, and CJIS addendum obligations as the core platform.

Answer #39

All proposed solution components, including identity and fraud-related capabilities, should comply with the applicable security requirements identified within the RFI and Appendix A.

Question #40

Are “fraud-like” controls desired for submission integrity (anomaly detection, repeat offenders, suspicious corrections), alongside error-queue validation/correction?

Answer #40

Vendors may provide information regarding validation, monitoring, workflow, fraud detection, and data quality capabilities aligned with their proposed solution approach.

Question #41

Is this modernization/replacement vs net-new?

Answer #41

As described within Sections 4 and 5 of the RFI, FDLE is seeking information regarding modernization opportunities associated with existing CCH and Data Collections systems and related workflows.

Question #42

Please describe FDLE’s current vendor/product environment supporting CCH and Data Collections (at a high level), and indicate what FDLE expects to retain vs. replace in the target state to inform transition and migration planning?

FDLE-RFI-2643 11 Addendum #1

Answer #42

FDLE is seeking information regarding potential future solutions and is not providing additional information regarding current vendor operations or contractual relationships at this time.

Question #43

Does FDLE anticipate the prime (or prime team) will be responsible for full implementation and migration services (system integration, data migration, cutover), or will FDLE provide a separate integrator and/or internal resources for portions of the transition?

Answer #43

FDLE is requesting information regarding available vendor capabilities and service delivery approaches. Vendors may describe implementation and migration methodologies within their response.

Question #44

Is FDLE seeking a single vendor to deliver both CCH and Data Collections, or are separate vendors acceptable for each component?

Answer #44

See Answer #23.

Question #45

Will CCH and Data Collections be procured under a single contract or separate solicitations?

Answer #45

See Answer #23.

Question #46

How are juvenile records handled within both the CCH and Data Collections systems, and what legislative or policy constraints govern their management and access?

Answer #46

FDLE is seeking information regarding potential future solutions and is not providing additional information regarding current operational workflows or data management practices at this time.

FDLE-RFI-2643 12 Addendum #1

Question #47

Do prosecutors and courts submit data directly to the CCH system, or does that data flow through the Data Collections system before being routed into CCH?

Answer #47

FDLE is seeking information regarding potential future solutions and is not providing additional information regarding current operational workflows at this time.

Question #48

Beyond MBIS, what other third-party systems, message switches, or integrations does the new solution need to support — including any systems used to route RAP sheet responses or other CCH outputs?

Answer #48

FDLE is seeking information regarding potential future solutions and is not providing additional information regarding current operational integrations or system architecture at this time.

Question #49

What is the current total annual transaction volume for CCH across all submitting agencies?

Answer #49

Vendors should review Section 4, Background, of the RFI regarding currently available CCH transaction and operational volume information.

Question #50

What is the total data volume and record count currently stored in the CCH system?

Answer #50

Vendors should review Section 4, Background, of the RFI regarding currently available CCH record and data volume information.

Question #51

Is GovCloud a strict requirement, or will FDLE consider other CJIS-compliant cloud environments?

FDLE-RFI-2643 13 Addendum #1

Answer #51

See Answer #3.

Question #52

Will FDLE consider a vendor that hosts within the state's existing Azure Government Cloud tenant, or must the solution run on vendor-managed infrastructure?

Answer #52

See Answer #30.

Question #53

Does FDLE anticipate retaining the current NIEM XML IEPD schema structure, or is a redesigned data exchange model acceptable?

Answer #53

FDLE is requesting information regarding available vendor capabilities and recommendations related to NIEM, IEPD, and data exchange approaches.

Question #54

In Section 7.2.e, payment is mentioned — can FDLE clarify whether this refers to functionality within the Criminal Justice Data Transparency (CJDT) initiative, or does it indicate a broader payment processing requirement?

Answer #54

Question was unclear.

Question #55

What is the intended scope of public access within the Data Collections system?

Answer #55

FDLE is seeking information regarding potential future solutions and is not providing additional information regarding current operational workflows or system access models at this time.

Question #56

Following the RFI, does FDLE anticipate issuing a formal RFP, or are other procurement vehicles being considered?

FDLE-RFI-2643 14 Addendum #1

Answer #56

As stated in Section 2 of the RFI, FDLE is gathering information to better understand available solution approaches, service models, modernization strategies, and potential procurement considerations.

Question #57

Will vendors who participate in the optional information exchange meetings be evaluated differently than those who do not?

Answer #57

No. Responses to this RFI will be reviewed for informational purposes only. FDLE is gathering information to better understand available solution approaches, service models, modernization strategies, and potential procurement considerations.

Question #58

Will CCH and Data Collections be procured as a single solicitation or separate procurements?

Answer #58

See Answer #23.

Question #59

Will the anticipated procurement allow responses from vendor teams, including prime/subcontractor arrangements??

Answer #59

See Answer #5.

Question #60

Does FDLE anticipate considering phased implementation approaches, including phased deliverables, releases, or pricing structures?

Answer #60

FDLE anticipates modernization may require phased implementation, transition, validation, and deployment activities and is seeking vendor input regarding phased approaches and implementation strategies.

FDLE-RFI-2643 15 Addendum #1

Question #61

What technical documentation, data dictionaries, interface specifications, or IEPDs does FDLE anticipate making available during the solicitation or discovery process?

Answer #61

Additional technical documentation or supporting materials, if applicable, may be provided as part of any future procurement process.

Question #62

Does FDLE intend to migrate all existing CCH records to the new system, or maintain a legacy read-only archive in parallel?

Answer #62

FDLE is seeking information regarding modernization and migration approaches, including strategies related to historical data retention, archival considerations, and transition planning.

Question #63

Are there existing integrations with other state systems beyond those listed in the RFI that the solution must support?

Answer #63

FDLE is seeking information regarding potential future solutions and is not providing additional information regarding current operational integrations or system architecture at this time.

Question #64

Will FDLE require vendors to hold an existing FBI CJIS Security Addendum prior to RFP submission, or is compliance a post-award condition?

Answer #64

Question pertains to a potential future solicitation and is outside the scope of this RFI.

Question #65

Does the CJIS Technical Compliance Audit checkbox in Appendix A Section 10.04 apply to this procurement, and if so, will it be conducted prior to or after award?

Answer #65

Additional technical documentation or supporting materials, if applicable, may be provided as part of any future procurement process.

FDLE-RFI-2643 16 Addendum #1

Question #66

What is FDLE's target go-live date or modernization completion timeline?

Answer #66

FDLE has not established a target go-live date or modernization completion timeline at this time.

Vendors may provide information regarding implementation timelines, sequencing, dependencies, and transition considerations aligned with their proposed approach.

Question #67

Does FDLE anticipate a phased transition from legacy systems to the modernized environment, including any period of parallel operations, validation, or legacy fallback?

Answer #67

FDLE anticipates modernization may require phased transition, validation, parallel operations, and continuity considerations and is seeking vendor input regarding transition and implementation strategies.

Question #68

Will FDLE require key personnel designations in the solicitation response, and if so, which roles?

Answer #68

Question pertains to a potential future solicitation and is outside the scope of this RFI.

Question #69

Is FDLE planning to replace the current CCH system or just build on top of it?

Answer #69

See Answer #27.

Question #70

Is FDLE looking to operate the Computerized Criminal History and CJIS Data Collections Systems in FDLE's own secure Cloud environment?

Answer #70

See Answer #30.

FDLE-RFI-2643 17 Addendum #1

Question #71

Does this RFI intend to influence a future procurement? If so, could you please share any anticipated timeline for a potential solicitation?

Answer #71

See Section 2 of the RFI regarding the purpose of this Request for Information. FDLE has not established a timeline for any potential future solicitation at this time.

Question #72

When is the existing contract with the incumbent vendor scheduled to expire?

Answer #72

FDLE is seeking information regarding potential future solutions and is not providing additional information regarding current vendor operations or contractual relationships at this time.

Question #73

Would the FDLE please share additional information regarding the primary challenges or pain points with the current solution?

Answer #73

Vendors should review Sections 4, 5, 7, 8, and 9 of the RFI regarding the modernization objectives, operational considerations, workflow needs, reporting capabilities, data quality expectations, and security requirements associated with the systems identified within this RFI.

Question #74

Would the FDLE please provide further context regarding the key objectives and intent behind issuing this RFI?

Answer #74

See Sections 2, 4, and 5 of the RFI regarding the purpose, background, and statement of need associated with this Request for Information.

Question #75

What is the FDLE’s current level of satisfaction with the incumbent vendor? Are there specific areas of satisfaction or concern that can be shared?

FDLE-RFI-2643 18 Addendum #1

Answer #75

FDLE is seeking information regarding potential future solutions and is not providing additional information regarding current vendor operations or contractual relationships at this time.

Question #76

What specific operational enhancements or capabilities are FDLE seeking?

Answer #76

FDLE encourages vendors to review Sections 5, 7, 8, and 9 of the RFI regarding the requested solution capabilities, operational support expectations, reporting objectives, workflow modernization goals, and security requirements, and to provide information regarding how their proposed solution may support those needs.

Question #77

Can vendors respond to only the data collaboration and integration components of this solution at the RFI phase?

Answer #77

Vendors may provide information regarding the solution components, capabilities, and service approaches they believe best align with the needs identified within this RFI.

Question #78

Is the Florida Department of Law and Enforcement open to leveraging two contracts for this solution – one for technology and the second contract for implementation?

Answer #78

Vendors may provide information regarding the solution, licensing, implementation, hosting, and service delivery approach they believe best aligns with the needs identified within this RFI.

Question #79

Is FDLE seeking a single integrated platform for both CCH and Data Collections, or would FDLE consider separate but integrated solutions for CCH, CJDT, FIBRS, UAA, and related reporting?

Answer #79

FDLE is requesting information regarding integrated, modular, or hybrid solution approaches aligned with the needs identified within this RFI.

FDLE-RFI-2643 19 Addendum #1

Question #80

May vendors respond to only the CCH scope, only the Data Collections scope, or must vendors address both areas to be considered responsive in a future procurement?

Answer #80

Vendors may provide information regarding the solution components, capabilities, and service approaches they believe best align with the needs identified within this RFI.

Question #81

What is FDLE’s preferred implementation sequence: CCH first, Data Collections first, shared platform services first, or a phased rollout by business capability?

Answer #81

FDLE anticipates modernization may require phased implementation and transition activities and is seeking vendor input regarding sequencing, modernization strategies, and phased rollout approaches.

Question #82

Will FDLE provide current-state architecture diagrams, system inventories, data dictionaries, interface specifications, IEPDs, validation rules, and workflow documentation as part of a future solicitation?

Answer #82

Additional technical documentation or supporting materials, if applicable, may be provided as part of any future procurement process.

Question #83

For CCH and each Data Collections domain, what are the current and projected transaction volumes, peak processing windows, submission volumes, query volumes, file sizes, batch sizes, and reporting workloads?

Answer #83

Vendors should review the information currently provided within the RFI regarding system operations and volumes. Vendors may also identify assumptions or considerations relevant to their proposed approach.

FDLE-RFI-2643 20 Addendum #1

Question #84

What specific uptime, response-time, throughput, RTO, and RPO targets should vendors assume for CCH, Data Collections, public-facing capabilities, APIs, reporting, and administrative functions?

Answer #84

FDLE encourages vendors to provide information regarding service level targets, recovery objectives, uptime considerations, operational resiliency, and performance assumptions aligned with their proposed solution approach.

Question #85

FDLE states a preference for GovCloud or another cloud provider that can comply with FBI CJIS Security Policy. Does FDLE prefer vendor-hosted SaaS in the vendor’s GovCloud environment, deployment in the State’s Azure Government tenant, or either model if CJIS and state cloud requirements are met?

Answer #85

FDLE prefers vendor-hosted cloud solutions capable of complying with applicable CJIS Security Policy and State security requirements identified within the RFI.

Question #86

Does FDLE require a single-tenant/dedicated SaaS environment, dedicated database, dedicated encryption keys, dedicated compute, or logical segregation within a CJIS-compliant cloud environment?

Answer #86

Vendors should review the applicable security requirements identified within the RFI and may provide information regarding how their proposed solution architecture addresses those requirements.

Question #87

Does the U.S.-only restriction apply to all vendor personnel, subcontractors, help desk staff, cloud support, security operations, telemetry, backups, logs, AI services, and disaster recovery operations?

FDLE-RFI-2643 21 Addendum #1

Answer #87

All proposed solutions and supporting operations should comply with the applicable CJIS Security Policy requirements and the security requirements identified within Appendix A of the

RFI.

Question #88

Which vendor personnel will require FDLE background investigations: implementation staff, developers, cloud administrators, support engineers, security operations personnel, subcontractors, and/or product engineering resources?

Answer #88

Vendors should review Appendix A and the applicable security requirements identified within the RFI regarding personnel, access, and background screening requirements.

Question #89

What identity provider(s) and authentication standards should the solution support for internal FDLE users, external agency contributors, public users, and administrative users?

Answer #89

FDLE is seeking vendor input regarding identity management, authentication, authorization, and access control approaches aligned with the needs identified within this RFI.

Question #90

Are role-based access controls expected to include ORI-based access, agency-based access, row-level security, field-level security, record sealing/expungement restrictions, juvenile data restrictions, and audit-based access reviews?

Answer #90

Vendors may provide information regarding access control, authorization, audit, and data restriction capabilities aligned with their proposed solution approach and applicable legal or operational requirements.

Question #91

Should the future solution replace the current CJIS Portal, integrate with it, or run in parallel during transition?

FDLE-RFI-2643 22 Addendum #1

Answer #91

FDLE is seeking vendor input regarding modernization, integration, migration, coexistence, and transition approaches aligned with the needs identified within this RFI.

Question #92

What submission channels must be supported in the future state: NIEM XML upload, APIs, batch file transfer, secure portal upload, web forms, message queues, direct system-to-system exchange, or all the above?

Answer #92

Vendors may provide information regarding submission, integration, and interoperability approaches aligned with their proposed solution capabilities.

Question #93

For Data Collections, what level of backward compatibility is required for current and prior IEPD/schema versions, and how many concurrent schema versions must the future system support?

Answer #93

FDLE is seeking vendor input regarding schema management, versioning, backward compatibility, and modernization considerations related to NIEM and IEPD processes.

Question #94

What capabilities do FDLE expect for simplifying IEPD creation: automated schema generation, documentation generation, version comparison, validation rule management, testing tools, contributor sandboxing, or workflow approval?

Answer #94

Vendors may provide information regarding capabilities, tools, automation, and workflow approaches aligned with NIEM, IEPD, and data exchange management objectives identified within the RFI.

Question #95

What is the expected data validation, correction, and resubmission workflows for internal FDLE users versus external contributing agencies?

FDLE-RFI-2643 23 Addendum #1

Answer #95

Vendors may provide information regarding workflow, validation, correction, resubmission, and data quality management approaches aligned with their proposed solution.

Question #96

What data migration scope should vendors assume for CCH and Data Collections, including number of years of history, record types, attachments, audit history, correspondence, legacy identifiers, and archived records?

Answer #96

FDLE is seeking vendor input regarding migration strategies, assumptions, dependencies, archival considerations, and transition planning aligned with modernization of the systems identified within this RFI.

Question #97

What are FDLE’s expectations for data cleansing prior to migration, including duplicate resolution, person matching, charge/disposition normalization, legacy code mapping, and exception handling?

Answer #97

FDLE is seeking vendor input regarding data cleansing, normalization, reconciliation, matching, migration, and exception handling approaches aligned with modernization of the systems identified within this RFI.

Question #98

How should the future CCH solution handle complex person and event lifecycle scenarios such as record merge/unmerge, aliases, expungements, sealed records, pardons, deceased events, juvenile restrictions, corrections, and unique delete scenarios?

Answer #98

FDLE is seeking information regarding lifecycle management, records management, workflow, auditability, and data governance capabilities aligned with modernization of the systems identified within this RFI.

Question #99

What are the required MBIS integration patterns, including event triggers, APIs or message formats, near-real-time latency expectations, error handling, reconciliation, and fallback processes?

FDLE-RFI-2643 24 Addendum #1

Answer #99

FDLE is seeking vendor input regarding integration, interoperability, event processing, latency, reconciliation, error handling, and operational resiliency approaches aligned with the proposed solution.

Question #100

For customer-facing direct integration, what specific use cases should be supported, such as background check requests, fingerprint submission, payment capture, document upload, status tracking, correspondence, and self-service correction?

Answer #100

FDLE is seeking information regarding customer-facing workflows, intake capabilities, submission management, document handling, payment integration considerations, status tracking, and related operational capabilities aligned with the proposed solution.

Question #101

What AI ad hoc reporting use cases does FDLE want to support, and what controls are required for AI-generated queries, data masking, prompt logging, answer traceability, human review, hallucination mitigation, and prohibition on model training?

Answer #101

Proposed AI-related functionality should include appropriate security, auditing, traceability, data protection, and controls to prevent FDLE data from being used for public or generalized model training.

Question #102

What reporting audiences and outputs must be supported: internal management dashboards, productivity metrics, public CJDT reporting, UCR/FIBRS publications, operational exception dashboards, audit reports, federal submissions, and exportable datasets?

Answer #102

FDLE anticipates the future solution will support operational, management, reporting, analytics, audit, publication, and external reporting capabilities associated with the systems identified within the RFI.

FDLE-RFI-2643 25 Addendum #1

Question #103

For budgetary pricing, what licensing model should vendors assume: internal named users, external agency users, contributor organizations, public users, transaction volume, storage volume, API calls, environments, managed services, or a combination?

Answer #103

Vendors may provide information regarding the pricing, licensing, hosting, subscription, operational, implementation, and service delivery models they believe best align with the needs identified within this RFI.