IDEC_RFIS_Vendor_QA_Public_Final.pdf

Question # RFIS Reference Page / Section Vendor Question IDEC Response

1 Collaboration with State Personnel p.13, Networking Are there architectural constraints or requirements from DoIT that affect network topology, private links, or virtual networks?

DoIT maintains ownership of core network architecture, including ExpressRoute, VNet configuration, secure entry/exit points, and routing. Vendors will configure data platform components within these predefined boundaries. Private Links, managed VNets, and other connectivity patterns must follow DoIT standards. Additional details will be provided during onboarding in Stage 1.

Appendix B: Cloud Hosted Security

Requirements p.30, Item 14 Will IDEC require multi-region redundancy during Phase 1?

Appendix B requires a robust and reliable backup system aligned to RPO/MTD requirements. Multi-region redundancy is not a mandatory requirement for Phase 1, but vendors may propose approaches that enhance resilience if they do not materially impact cost or timelines. Future

In-Scope Activities – Infrastructure &

Storage p.7, Item c

Does IDEC expect the ~500 GB environment to represent a rolling window (e.g., one year of active data), or will active data continue to grow cumulatively over time?

The projected ~500 GB represents anticipated initial active data needs, not a fixed rolling window. IDEC expects storage needs to grow over time as more than 60 data sources are onboarded, with data lifecycle management required to optimize long-term retention.

DoIT and IDEC will determine the applicable data retention policies, consistent with State records requirements and program needs. The selected vendor may collaborate with IDEC and DoIT on best practices for implementing those retention policies within the data platform during Stage 1.

General (Appendix E: Governing

Regulations) Various

Which datasets fall under sensitive classifications such as HIPAA, FERPA, or other regulatory frameworks?

IDEC handles multiple program areas governed by different federal and state regulations. Examples include: HIPAA for Early Intervention and certain DHS programs; FERPA/ISSRA for ISBE Early Childhood Block Grant programs; PIPA and other applicable privacy requirements for child care subsidy and assistance programs (which include PII); and PII protections for licensing and background check data.

5 Staged Approach for Phase 1 p.15, Stage 2 bullet 4 Which two critical applications require bi-directional integration during Phase

1?

IDEC will identify the two priority applications during the Stage 1 planning and discovery process. These systems will be selected based on operational readiness, dependency on Day-1 functionality, and alignment with event-driven architecture needs. System names will be shared with

6 General — Are API specifications for these systems documented, or will discovery be required during Stage 1?

Some API documentation exists from transferring agencies and their vendors, but not all systems currently expose fully defined interfaces. Vendors should assume a combination of existing documentation and discovery activities during Stage 1, including technical walkthroughs, architecture reviews, and validation of integration constraints.

There may be a need for API development or enhancement to support required data flows into and out of the IDEC Data & Analytics Hub. Proposals are expected to include time and approach for business analysis and solution design during Stage 1 to refine high-level requirements into prioritized activities and detailed designs that ensure what is implemented aligns with IDEC’s environment, data characteristics, and agreed-upon solutions.

For Phase 1, this analysis and design effort is expected to be accelerated to quickly refine understanding of go-live requirements and support Day-1 readiness. For subsequent phases, a more extended analysis and design approach may be used to support the development of more advanced functionality and services.

In-Scope Activities – Analytics &

Visualization p.9, Item i

What thematic areas are expected for the initial 10 dashboards (e.g., operational, compliance, provider performance)?

IDEC will define dashboard themes based on Day-1 operational and governance needs. Initial dashboards are expected to focus on areas such as provider capacity, caseload and service workflow monitoring, licensing operations, subsidy program metrics, and cross-program performance indicators. Detailed definitions will be developed collaboratively in Stage 1.

8 Section 15(i), Section 7 p.9, p.11 Power BI dashboards are noted as in scope then subsequently noted as a separate contract. Are Power BI dashboards intended to be included as scope in Phase 1?

For Phase 1, IDEC expects the vendor to stand up Power BI Premium and deliver up to 10 initial dashboards as described in Section 15(i). The reference in Section 7 to a separate contract relates to future expansion and broader enterprise configuration, not to the initial Phase-1 dashboards.

Power BI is currently the expected analytics platform for Phase 1 and aligns with IDEC’s existing investments and solutions under development. If, during Stage 1 refinement, material constraints related to DoIT’s environment or enterprise standards are identified, IDEC may evaluate alternative business intelligence tools, such as Tableau. Any such consideration would be based on documented findings and tradeoff analysis and would be addressed collaboratively with DoIT and IDEC.

9 Architecture & Connectivity General Does the state have an existing data gateway or similar pattern set up to allow connectivity to on premises data sources?

DoIT currently manages secure connectivity between on-premises systems, vendor environments, and the State’s Azure Commercial environment.

This Azure Commercial environment is new to the State and not yet mature in its overall setup.

IDEC anticipates benefiting from vendor expertise and guidance to help inform and enhance the Azure Commercial connectivity architecture as part of the IDEC Data & Analytics Hub implementation.

Where a gateway or similar connectivity service is required, it will be provisioned and governed by DoIT. Vendors should not assume they will independently deploy statewide gateway services, but are expected to both inform the design of those services and plan solutions that leverage

DoIT-approved connectivity patterns.

10 Identity and Access Management Appendix B Item 12 Do all users have identities in Azure Entra ID for assigning security?

Internal State users are provisioned through the State’s central Identity & Access Management platform (ILogin), which integrates with Azure Entra

ID as the underlying directory. Not every eventual user for IDEC has been onboarded yet, but vendors should assume Entra backed identities for internal users, with additional onboarding for new roles as needed.

11 External Users / IAM Appendix B Item 12 The RFIS mentions external users; can we assume they have been set up with B2B access to the State’s environment? If not, how will external users access the environment?

Vendors should not assume all external users are already configured as Entra B2B guests. External access will be managed via the State’s identity standards (e.g., ILogin plus B2B or equivalent federation) consistent with Appendix B. The selected vendor will work with IDEC and DoIT during Stage

1 to determine which external roles require access and to configure appropriate B2B or federated identities following State security policies.

12 Staged Approach – Stage 2 p.15 The RFIS states there must be bi directional data exchange between the data hub and two critical applications. Which two critical applications are referenced?

IDEC will finalize which two applications are treated as “critical” for bi directional integration during Stage 1 planning, based on Day 1 operational need and program readiness. These may include, for example, systems supporting Early Intervention, child care subsidy, or licensing; specific system names and technical details will be shared with the vendor selected for further discussions.

13 Business Enterprise Program – U Plan Appendix F The U Plan linked in the RFIS does not have any NGIP codes specified. Is use of any NGIP code acceptable?

For the RFIS stage, vendors are not required to select or commit to specific NGIP codes. Final NGIP coding, if applicable, will be confirmed during contract negotiation, consistent with the nature of the awarded scope. Vendors may describe typical NGIP areas they anticipate using based on their proposed roles (for example, IT consulting and data services).

14 Business Enterprise Program – U Plan Appendix F The U Plan linked in the RFIS does not have a target BEP goal set. What BEP participation target does IDEC have for this procurement?

A formal BEP participation goal will be set prior to contract execution in consultation with the Commission on Equity and Inclusion and consistent with statewide policy. For the RFIS, vendors should focus on describing how they will meaningfully include BEP certified firms; a numeric target is not required at the RFIS response stage.

15 Section 15(b) – Stage 2 p.15

Section 15(b) requires bi directional data exchange with two critical applications. Which applications are these, and what are their integration requirements (API specifications, authentication methods, data formats, and latency requirements)?

The specific applications will be confirmed during Stage 1. At a high level, integrations are expected to use modern secure patterns such as REST APIs, secure file exchange, or database connections aligned with State standards for authentication, encryption, and audit logging. Detailed specifications for endpoints, formats, and latency expectations will be developed collaboratively with IDEC, DoIT, and application vendors as part of Stage 1 design.

16 Appendix A – FISMA / NIST Appendix A Appendix A references FISMA and NIST RMF compliance. The State has both

Commercial and Government cloud. Is the requirement to build and deploy the platform in GovCloud or the State’s Azure Commercial environment?

The RFIS describes the existing DoIT hosted Azure Commercial Cloud environment for IDEC’s data hub. Phase 1 is therefore expected to be deployed in the State’s Azure Commercial environment while complying with applicable FISMA and NIST aligned controls as specified in the appendices.

17 Appendix E – Regulatory Frameworks Appendix E

Appendix E lists multiple overlapping regulatory frameworks (such as FERPA, HIPAA, and COPPA). Has IDEC established a unified data classification scheme mapping data elements to regulatory requirements, or will this be developed as part of governance initiation in Stage 1?

IDEC and DoIT use existing State security and privacy policies that distinguish categories such as PHI, PII, and education records. A more unified, IDEC specific data classification and mapping will be further developed and operationalized as part of Data Governance Initiation in Stage 1, with vendor support, leveraging the statutory landscape summarized in Appendix E.

18 DoIT Provisioning SLAs General

What specific SLAs will DoIT commit to for provisioning Azure resources required for Phase 1 (for example, storage, networking, private endpoints, Key Vault, and SQL Hyperscale), and what are the escalation paths if SLA windows are exceeded?

Formal SLAs and escalation paths for resource provisioning will be defined during contract negotiations and onboarding with DoIT’s Enterprise Cloud Operations teams. For RFIS purposes, vendors may assume standard State change management and provisioning processes, with escalation through the IDEC Data Project Manager and established DoIT governance structures.

19 Terraform / IaC Access – Section 8(b) p.13 What level of access will the vendor have to DoIT’s Terraform or other

Infrastructure as

Code environment (contribute, limited write, or read only)?

DoIT will retain control of Terraform and Infrastructure as Code for the statewide Azure environment. The selected vendor should expect collaborative development of IaC artifacts, such as contributing modules or scripts, with execution rights governed by DoIT policy—typically via controlled pipelines rather than unrestricted direct access. The exact model will be finalized during onboarding.

20 Infrastructure Change Management General How will DoIT communicate infrastructure changes that impact the project

(such as Terraform updates, firewall or networking modifications, and environment changes)?

Infrastructure changes that affect the IDEC Data & Analytics Hub will be communicated via State change management processes, regular status meetings, and documented release or change notices coordinated by the IDEC Data Project Manager and DoIT enterprise teams. Vendors should plan to participate in this governance and incorporate change impacts into their documentation and runbooks.

21 Source Schema Governance General Will agencies provide proactive schema change and schema drift notifications as part of regular data delivery?

IDEC’s goal is to establish governance processes so that material schema changes are communicated in advance through agreed channels such as change notices or release notes. Some legacy systems may not yet have mature practices, so vendors should design resilient ingestion and monitoring and support IDEC in formalizing schema change processes in Stage 1.

22 Historical Data Updates General How frequently do agencies update or overwrite historical data, and is the vendor expected to reconcile or reprocess these changes in Phase 1?

Patterns vary by source system. Vendors should assume that some historical corrections and overwrites will occur, especially during early data quality work. Reconciliation and selected re processing for critical datasets are in scope for Phase 1 to support Day 1 reporting; larger scale historical reconciliation may be addressed in later phases based on priorities defined with IDEC.

23 Ingestion Patterns – Phase 1 Section 6 Will agencies provide data in a manner that enables incremental loading in Phase 1, or should the vendor plan for full file ingestion until incremental patterns are formally defined in Phase 2?

Some sources may support incremental delivery, while others may still rely on secured full file transfers. For planning, vendors should assume a mix of full file and incremental loads in Phase 1, with a goal of moving toward more incremental patterns over time as source systems and governance agreements mature.

24 Metadata / Data Dictionaries General Will the vendor receive complete data dictionaries, field definitions, and version histories from all contributing agencies?

Where they exist, IDEC and the transferring agencies will provide data dictionaries and related artifacts. However, not all systems have complete or up-to-date documentation.

Vendors should anticipate filling documentation gaps through discovery, data profiling, and collaboration with agency subject-matter experts as

25 Analytics & Dashboards – Section 15(i) p.9 Will IDEC provide business rules, KPI definitions, and metric logic for the 10 required prototype dashboards, or should these be developed through discovery?

IDEC will provide high level business objectives and key questions for the initial dashboards and will identify priority KPIs. The selected vendor is expected to help refine metric definitions, business rules, and visuals through discovery workshops, consistent with the RFIS expectation that vendors propose an approach for fit for purpose dashboards.

26 Documentation – Section 8(e) p.13 What documentation artifacts are required in Phase 1 (for example, architecture diagrams, lineage documentation, data quality standards, runbooks, API specifications, and security documents)?

Section 8(e) lists the types of documentation expected, including environment configuration, metadata, orchestration, API usage, security, access control, and Power BI design and modification procedures, along with operational runbooks and monitoring documentation. The final set and depth will be confirmed in the Stage 1 project plan with the IDEC Data Project Manager.

27 Security & Access – Section 15(e) p.8–9 What row level and column level security requirements must the vendor implement in Phase 1, and will IDEC provide the role matrix for all agencies and programs?

For Phase 1, the vendor is expected to design and implement role-based access controls for IDEC stakeholders and authorized partner users, consistent with State security standards and applicable statutory requirements (e.g., PHI, PII, education records).

Where required based on data sensitivity, data-level protections—such as targeted row-level or column-level restrictions—may be implemented to support appropriate segregation of sensitive information across programs and agencies. The extent of these controls in Phase 1 will be guided by

IDEC’s disclosure risk considerations and prioritized use cases.

IDEC will provide an initial role and access matrix for agencies and programs during Stage 1, which the vendor will use as the baseline for configuration. This matrix and the associated security controls will be refined collaboratively as additional data sources, sensitivity layers, and use cases are onboarded.

Microsoft Purview is expected to support data classification and sensitivity awareness and to inform the evolution of more granular, data-level access controls over time.

Vendor staff access is governed separately through State onboarding and least-privilege policies and is not the subject of this requirement.

28 Data Protection / Masking Appendix B, Section 15(i) Are column level masking requirements (such as PII masking and role based attribute suppression) expected in Phase 1, or deferred to Phase 2?

Basic protections for sensitive attributes—for example PHI and PII masking or suppression for public facing or broad access content—are expected in Phase 1. More advanced dynamic masking and complex policy automation may be further expanded in later phases as requirements are refined.

29 Microsoft Purview – Section 15(f), 8(f) p.8, p.12–13 When will access to the statewide Microsoft Purview instance be granted relative to the project kickoff?

IDEC and DoIT are engaging in a preliminary phase of the project leading up to vendor onboarding that includes the initial setup of key applications supporting the implementation of the IDEC Data & Analytics Hub.

IDEC anticipates that Microsoft Purview will be installed and configured so that access can be shared with the selected vendor during Stage 1 onboarding, subject to standard State access controls and approvals.

30 Source Systems – Section 4 p.7 Can you characterize the 60–70 data sources in scope (for example, how many are structured, semi structured, or unstructured; relative complexity; owning agencies; and which are near real time versus batch)?

IDEC’s current inventory includes a mix of structured relational systems, semi structured exports, and document based sources—such as PDFs where only metadata is used—across ISBE, DHS, and DCFS. A detailed breakdown by format, complexity, and transport (batch versus near real time) will be shared with the selected vendor and further refined during discovery.

31 Volume & Growth – Section 4, 15(c) p.7 What is the average daily data ingestion volume, and can you characterize the anticipated rate of growth?

IDEC anticipates millions of records across more than 60 data sources, with significant growth over time driven by statewide enrollment, program expansion, and the adoption of an event-based architecture. Exact daily ingestion volumes vary by source and will be provided to the selected vendor during Stage 1 discovery.

The solution design should account for this growth and incorporate data lifecycle management practices to manage long-term storage and performance.

DoIT is responsible for developing cloud cost-monitoring capabilities to support visibility into the costs incurred by the IDEC Data & Analytics Hub.

However, the selected vendor will be expected to consult and collaborate on the implementation of cost-monitoring so that it is designed in a manner best aligned with the overall solution architecture and data ingestion patterns.

32 Seasonality / Peaks General Are there peak ingestion periods or seasonal spikes for data volume?

Yes. Early childhood programs experience seasonal and fiscal year driven spikes, such as school year start, major grant cycles, and renewal periods.

These patterns will be reviewed with the selected vendor so that capacity planning and scheduling can accommodate higher volume periods.

Monitoring & Compliance – Section 15(f), 8(f) p.8, p.12–13

What tools are currently used for monitoring and compliance, and how are Microsoft Purview or other tools being used today?

IDEC and DoIT currently rely on Azure native tools—such as Azure Monitor and Log Analytics—and are in the process of expanding statewide use of Microsoft Purview for lineage, cataloging, and data classification. The selected vendor will help configure and extend these capabilities for the IDEC environment.

Lifecycle Management – Section 6, Appendix E p.10–11, Appendix E

Are there existing and documented policies defined for data lifecycle management (retention and disposition)?

Statewide retention schedules are governed by the State Records Act and agency specific schedules. Some program level retention policies exist today; part of the IDEC Data Hub work in Stage 1 is to operationalize lifecycle management within the data platform, aligning to those schedules and

State legal guidance.

35 Latency & Throughput – Section 4, 15(d) p.7–8 What are the latency and throughput requirements for data processing?

Latency expectations vary by use case. For Phase 1, IDEC anticipates daily or intra-day refresh for most operational dashboards, with near-real-time patterns piloted for the two critical applications.

Detailed latency and throughput requirements will be agreed during Stage 1 for each major data source and integration. As part of Stage 1, the vendor is expected to include a structured plan for business analysis and solution design to translate high-level requirements into the detailed functional, technical, and integration designs necessary to achieve IDEC’s Day 1 business objectives.

36 Governance Automation – Section 8, 15(f) p.12–13 What governance policies are priorities for automation, such as data classification, lineage, and retention?

Priority areas for automation include data classification, lineage tracking, access policy enforcement, and key retention controls for high risk datasets. The selected vendor will work with IDEC’s governance bodies to define a roadmap for which policies are automated in Phase 1 versus later phases.

37 Preferred Technologies – Sections 7, 12.2 p.11, p.16–17 Are there preferred or mandated technologies for the data lakehouse, semantic layer, and analytics (for example Azure Synapse, Databricks, and Power BI Premium)?

The RFIS identifies Azure Data Factory, Azure SQL (including Hyperscale), Azure Storage, Microsoft Purview, and Power BI as key technologies supporting the IDEC Data & Analytics Hub. Vendors should assume an Azure-native data platform, with Power BI currently identified as the primary analytics and reporting tool for Phase 1.

IDEC recognizes that alternative business intelligence tools (such as Tableau) may be appropriate in future phases depending on use cases, licensing considerations, and enterprise standards. Vendors may note potential alternatives and tradeoffs for future phases, provided that Phase 1 deliverables align with the technologies identified in the RFIS and with DoIT standards and budget constraints.

38 Responsibilities – Sections 8(b), 15(b) p.12–15 What are the boundaries between vendor responsibilities and State/DoIT provisioning (for example Terraform, networking, and IAM)?

The RFIS states that DoIT provisions and secures the core Azure environment, networking, and base services, while the vendor configures and manages data platform components, pipelines, and Purview cataloging for IDEC’s needs. A detailed RACI, including Terraform, firewall rules, and

IAM objects, will be finalized in the project plan during Stage 1.

39 Security Frameworks – Appendices A–E Appendices A–E What security standards, compliance frameworks, and audit requirements must be met (for example FIPS, NIST, HIPAA, and FERPA)?

Vendors must comply with the NIST Risk Management Framework and FISMA aligned controls described in Appendix A, the security requirements in Appendix B—including FIPS compliant encryption—and the federal and state statutes listed in Appendix E, such as HIPAA, FERPA, FOIA, PIPA, and

BIPA.

40 AI Policy – Appendix D Appendix D Are there any restrictions or requirements regarding the use of AI, machine learning, or automation within the solution?

Appendix D (the DoIT AI Policy) governs the use of artificial intelligence. Vendors must disclose any AI systems used, may not use State data to train or refine models without express written permission, and must avoid prohibited uses such as autonomous decision-making without documented human oversight or discriminatory practices.

The State currently has limited AI services approved and available, and as a result, AI use during Phase 1 may be very restricted. Vendors may, however, propose recommendations for AI capabilities or services for future phases so that IDEC and DoIT can evaluate those recommendations and initiate the appropriate governance, approval, and procurement processes for later implementation.

41 Subcontracting – Section 12.4 p.18 Regarding subcontracting, can a subcontractor’s past performance and experience fulfill key requirements, or must the prime contractor possess all the key qualifications and past performance to be considered for award?

Subcontractors are allowed under Section 12.4. The prime vendor remains responsible for overall performance and must meet the mandatory organizational and key-staff requirements, but may rely on subcontractors to demonstrate additional relevant experience, capacity, or specialized qualifications, including specific expertise in early childhood programs and services.

42 Current Ingestion – Section 4 p.7 How many of the 60–70 data sources have already been ingested to the platform, and is the State currently using a framework to drive the ingestion process?

IDEC and DoIT have already begun ingesting and staging data from multiple sources in the Azure environment as part of ongoing initiatives. A standard ingestion and landing zone pattern exists today; the selected vendor will extend and harden that framework rather than replace it entirely. Detailed counts and status by source will be shared with the selected vendor.

Prevailing Wage – Appendix C Section

2.1.4 Appendix C

Regarding Appendix C, could the State clarify the purpose of Section 2.1.4 on Prevailing Wage, specifically the clause that the contractor must provide lien waivers to the State upon request?

Prevailing Wage language is standard State contract language. The reference to lien waivers pertains to situations where work might give rise to liens, such as construction related activities. For this project, which is primarily professional IT services, IDEC does not anticipate lien waivers being a routine requirement, but this clause remains in the standard terms.

44 CMS MARS E / ARS Applicability Appendix A Are CMS MARS E documents and CMS ARS minimum security requirements applicable to the required services?

Appendix A references FISMA and NIST aligned controls; specific CMS MARS E or ARS requirements apply only where federal program participation or agreements require them. If any portion of IDEC’s workload is later determined to fall under MARS E scope, the State will clarify those expectations with the selected vendor at that time.

45 Work Model / Location General

Will IDEC require any portion of the work to be performed on site, or can the full project be executed remotely? Are there specific locations, working hours, in person workshop expectations, geographic restrictions on staff, or requirements regarding State managed devices versus vendor managed equipment?

IDEC anticipates that most work can be performed remotely within the United States, subject to State security and access controls. Some in-person meetings or workshops in Illinois may be requested for key milestones.

Vendors will generally use their own equipment meeting State security standards; any exceptions, such as State-managed devices, would be addressed during onboarding.

Vendors may maintain flexibility in how they schedule their work, provided that key project staff are available for meetings, collaboration, and timely response to communications during Central Time business hours. Planned after-hours work may be required for deployments, maintenance, or cutover activities and will be coordinated in advance with IDEC and DoIT.

46 Source System List – Section 4 p.7 Do you have the list of the 60–70 source systems that are to be integrated as part of the data warehouse initiative, and do those sources already have usable integration points such as REST APIs or database connections?

IDEC maintains an internal inventory of source systems across ISBE, DHS, and DCFS. This list will be shared with the selected vendor. Some systems provide mature integration interfaces such as APIs or database access, while others rely on secured file exchange; additional integration work may be needed for specific systems and will be prioritized in Stage 1.

Two Way Integration Semantics – Section

15(b) p.15

When two way integration is mentioned, should the system also be able to push data into source systems, and if so can you provide an example? Should these integrations be event driven or scheduled batches, and are there any strict real time requirements?

Two way integration means the hub will both receive data from and send data back to selected applications, using patterns that may include event driven messaging or scheduled outbound feeds as appropriate. For example, provider records curated in the hub may be pushed back to an operational system. The default expectation is near real time or intra day update for those critical applications, with fully real time use cases considered where clearly justified and feasible.

Data Size & Existing Services – Section

15(c) p.7

Do you have an estimated total size of the data for the whole system, and are any services already being provided by DoIT (such as Purview, SQL, or pipelines)?

The RFIS currently projects expanding the environment from approximately 21 GB to approximately 500 GB in the near term, with additional growth expected over time.

DoIT operates Azure resources such as storage, SQL, and pipelines and is in the process of completing the basic setup of the suite of applications and services required for implementation of the IDEC Data & Analytics Hub leading up to onboarding of the selected vendor. The selected vendor will then be expected to extend and configure these services to meet IDEC’s data, analytics, and governance needs.

Purview Operating Model & Metadata –

Sections 8, 15(f) p.12–13

Could you confirm which identities will be federated for SSO and RBAC, whether Managed VNets and Key Vault are required, what the expectations are for Purview’s governance operating model, and whether there are mandatory metadata requirements for Bronze, Silver, and Gold layers and Day compliance reporting?

SSO and RBAC are expected to integrate with ILogin and Azure Entra ID for State users and appropriate external identities. Use of Managed VNets, Private Links, and Key Vault is required in line with Appendix B and related sections. The vendor will help define Purview’s operating model—roles, workflows, and required metadata for Bronze, Silver, and Gold layers—and enable baseline compliance and lineage reporting in Phase 1, with additional automation in later phases.

50 FOIA / Confidentiality General Will IDEC allow participants to request confidential treatment of information in their proposals under the Illinois Freedom of Information Act, and may vendors submit a separate redacted copy for potential public inspection?

Yes. Vendors may identify and request confidential treatment of proprietary or trade secret information and may submit a separately redacted copy for potential public release. However, IDEC must comply with the Illinois Freedom of Information Act, and the final determination as to what is exempt from disclosure rests with the State, not the vendor.

51 Day

1 Readiness – Sections 4, 9(b) p.7, p.15 What are the expected outcomes from this initiative that will satisfy IDEC’s

Day

1 Readiness conditions?

“Day-1 Readiness” (July 1, 2026) means IDEC can reliably ingest, govern, and use data from transferring agencies to support core operational and oversight needs.

In Phase 1 this includes scalable Azure infrastructure; secure and auditable ingestion from priority sources; initial governance and Microsoft Purview configuration; two-way integration with two critical applications; and a first set of operational dashboards and reports aligned to IDEC’s mission.

The Phase 1 scope may also include discovery and requirements definition activities for future phases, provided that these activities are clearly defined and presented as a separate set of deliverables in the vendor’s proposal so they can be evaluated and prioritized independently of the Day-

1 operational readiness deliverables.

52 Current Services – Section 4, 9(a) p.7, p.14–15 Who is currently providing the services for data acquisition, initial data staging and ingestion, and data integration preparation?

As stated in the RFIS, data acquisition, initial staging and ingestion, and preparedness for integration are already underway within the existing DoIT-hosted Azure environment, with work involving DoIT and IDEC’s implementation partners.

The selected vendor will be expected to accelerate and scale these efforts as part of the IDEC Data & Analytics Hub.

53 Section 13.2.2; Addendum No.1 p.20; Addendum p.1 Should the initial response contain only qualitative pricing structures with no Yes. Initial responses must include only qualitative pricing descriptions with no dollar amounts. Finalists submit pricing Feb 2, 2026.

54 In Scope Activities numbering p.7 Should 'In Scope Activities' be treated as a standalone Section 15? Yes. Treat '15 In Scope Activities' as its own standalone section.

55 Section 6 Assumptions p.10 Is metadata for 2.3M PDFs already extracted or is vendor responsible for OCR? Metadata will be provided; vendors are not responsible for OCR in Phase 1.

56 Section 8.b Terraform p.13 Will vendor execute Terraform or will DoIT execute all IaC? Vendors may author Terraform modules; DoIT executes deployments through controlled pipelines.

57 In Scope Activities p.7 Can the State share the number of tables/entities across 70+ sources? Varies by system; detailed counts will be provided in Stage 1 discovery.

58 Section 1; Security & Access p.2; p.8 Is Phase 1 strictly internal with no public-facing portal? Correct. Phase 1 supports internal and authorized partner users only.

59 Section 4.i Dashboards p.9 How is dashboard complexity defined? Complexity refers to data sources, interactivity, security rules, and audience.

60 Appendix B Accessibility p.31 Is a VPAT or formal accessibility audit required for Phase 1 dashboards? Formal VPAT is not required; dashboards must follow IITAA/WCAG principles.

61 Stage 2 UAT p.15 Will designated external users be available for UAT? Yes. IDEC will coordinate external-user availability during Stage 2.

62 Section 5; Section 8.3.a p.9; p.12 What is expected for the data literacy effort? Lightweight enablement: guides, demos, train the trainer materials. Not full training programs.

63 Considering the holidays, would it be possible to extend the submission IDEC will adhere to the submission schedule published in the RFIS and any posted addenda. Vendors should plan to meet the stated due dates; any

64 Is there a maximum or a suggested page length to the RFIS response?

IDEC has not established a maximum page limit for RFIS responses. Vendors should provide clear, concise, and well organized responses that directly address the requested information and support IDEC’s evaluation.

As we understand, IDEC is having single DoIT-hosted Azure commercial cloud environment that was initially designed to operate at a smaller scale. Please share the current state Azure platform architecture along with tools / services used for data ingestion,processng, data governance and reporting etc.

Yes. The IDEC Data & Analytics Hub will be implemented within a DoIT hosted Azure Commercial environment. This environment is new and is being stood up through DoIT’s standard provisioning and security controls; the selected vendor will extend and configure the platform for IDEC’s needs.

At present, for three transferring agencies sharing data across 60+ distinct data sources. How many data sources are already integrated with current state Azure platform? Please share the list of data sources which are in scope for data ingestion.

DoIT is responsible for provisioning the Azure Commercial foundation and completing the initial setup of required services leading up to vendor onboarding. The selected vendor will then extend, configure, and operationalize those services to meet IDEC’s Phase 1 objectives.

Please clarify if data governance has been implemented in the current state?

Please share the detailed scope on data governance with respect to DQ, Data

IDEC is establishing and maturing its data governance capabilities as part of the staged Phase 1 approach. Stage 1 includes governance initiation activities, including defining roles, access expectations, metadata standards, and onboarding processes, informed by Microsoft Purview

68 Is Master Data Management part of the scope? If Yes, please share the detailed Enterprise Master Data Management is not included in the Phase 1 scope as described in the RFIS. Vendors may identify MDM considerations and

Please elaborate on the key business objective on this initiative and share the key business use cases that need to be implemented as part of this initiative.

“Day 1 Readiness” (July 1, 2026) means IDEC can reliably ingest, govern, and use data from transferring agencies to support core operational and oversight needs. In Phase 1 this includes scalable Azure infrastructure; secure and auditable ingestion from priority sources; initial governance and Purview configuration; bi directional integration with two critical applications; and an initial set of operational dashboards and reports aligned to IDEC’s mission. Discovery and requirements definition for future phases may be proposed as separate, clearly defined deliverables for prioritization.

What are the business functions and sub-functions are in scope for this initiative? Please provide high-level priority for this business functions from implementation perspective so that vendors can create the plan accordingly.

Phase 1 is focused on enabling IDEC operational and oversight needs for Day 1 readiness, including reporting and analytics to support program operations, compliance/oversight, provider and service monitoring, and executive visibility across transferring agencies. Detailed function level use cases and priorities will be refined during Stage 1 discovery and stakeholder walkthroughs.

Please clarify if Azure platform (environment) provisioning, setup/configuration are part of the scope. Please share detailed scope from infrastructure side to consider as part of the scope.

IDEC will refine this topic during Stage 1 discovery and planning with the selected vendor and DoIT. Vendors should propose an approach that supports Day 1 readiness in Phase 1 and can scale for future phases consistent with State standards, security controls, and governance requirements.

Can IDEC provide a RACI matrix to map responsibilities for Azure services provisioning and configuration, networking, security groups, Azure AD?

User identity and access will be managed through State approved identity services. Stage 1 onboarding will confirm internal and external user identity patterns (including account provisioning and any federation/B2B requirements) and establish the role based access model for Phase 1 deliverables.

Which data storage is being used presently to store 20 GB of data that need to be scaled up to 500 GB? Please provide the current state data volume and % volume growth year on year.

IDEC’s platform is Azure native and leverages DoIT managed services such as Azure Storage and Azure SQL for data storage and processing. Specific storage configurations (e.g., zones/layers, partitioning, retention, and performance tiers) will be finalized during Stage 1 based on priority sources and use cases.

74 Is storage strategy (Data structure / Entities / attributes) already defined?

The Phase 1 storage strategy will be defined during Stage 1 discovery and design, including how data is organized (e.g., raw/staged/curated layers), how entities are modeled for analytics, and how retention and access controls are enforced. Vendors should propose an approach that supports

Please provide details if there are any challenges with the current landing zone in place.

The Azure Commercial environment supporting this work is under active development and is not yet mature. DoIT is establishing foundational components leading up to onboarding, and IDEC anticipates benefiting from vendor expertise to inform enhancements consistent with DoIT

76 Please provide the details on the current data ingestion process.

IDEC anticipates a staged onboarding approach for priority sources in Phase 1. Stage 1 includes discovery, profiling, and design to confirm ingestion patterns (batch vs. event driven), data quality controls, and operational runbooks. Vendors should propose repeatable ingestion patterns and governance aligned processes that can scale as additional sources are onboarded.

77 What is the status of the current Azure landing zone already in place?

The Azure Commercial environment supporting this work is under active development and is not yet mature. DoIT is establishing foundational components leading up to onboarding, and IDEC anticipates benefiting from vendor expertise to inform enhancements consistent with DoIT

Is their any existing process for processing the data? If yes, will it remain unchanged with the current scope?

IDEC anticipates a staged onboarding approach for priority sources in Phase 1. Stage 1 includes discovery, profiling, and design to confirm ingestion patterns (batch vs. event driven), data quality controls, and operational runbooks. Vendors should propose repeatable ingestion patterns and governance aligned processes that can scale as additional sources are onboarded.

Please provide the data ingestion types (batch/real-time) for all these 60+ data sources in scope. Also, please share the count of data tables/files that need to be ingested from each of these sources.

Latency expectations vary by use case. For Phase 1, IDEC anticipates daily or intra day refresh for most operational dashboards, with near real time patterns piloted for the two critical applications. Detailed latency and throughput requirements will be agreed during Stage 1 for each major source and integration.

For outbound integration, please provide how many integration to be developed for each of the following category -

Outbound integrations will be defined based on operational use cases and the two critical application integrations required for Phase 1. Stage 1 will confirm target systems, interface constraints, and approved integration mechanisms (API, file based, or database where permitted) and establish the minimum set needed for Day

1 readiness.

81 1. SFTP (e.g., scheduled file drops with encryption), Integration and data movement patterns will vary by source system. Vendors should assume a combination of file based transfers (e.g., encrypted SFTP), direct database connections where permitted, and API based integrations where available. Stage 1 discovery will confirm approved connectivity patterns per source, authentication methods, and any interface gaps. Any new API development needed to support required Phase 1 flows should be included in the vendor’s Stage 1 analysis and design plan.

82 2. Direct data connections (e.g., JDBC/ODBC to external databases), Integration and data movement patterns will vary by source system. Vendors should assume a combination of file based transfers (e.g., encrypted SFTP), direct database connections where permitted, and API based integrations where available. Stage 1 discovery will confirm approved connectivity patterns per source, authentication methods, and any interface gaps. Any new API development needed to support required Phase 1 flows should be included in the vendor’s Stage 1 analysis and design plan.

83 3. APIs (e.g., RESTful endpoints or webhooks).

Integration and data movement patterns will vary by source system. Vendors should assume a combination of file based transfers (e.g., encrypted SFTP), direct database connections where permitted, and API based integrations where available. Stage 1 discovery will confirm approved connectivity patterns per source, authentication methods, and any interface gaps. Any new API development needed to support required Phase 1 flows should be included in the vendor’s Stage 1 analysis and design plan.

Who are the consumer of data and in what form (Applications / Reports / Data

Feed) ?

IDEC will refine this topic during Stage 1 discovery and planning with the selected vendor and DoIT. Vendors should propose an approach that supports Day 1 readiness in Phase 1 and can scale for future phases consistent with State standards, security controls, and governance requirements.

85 Is there any target architecture to load the data ?

IDEC will refine this topic during Stage 1 discovery and planning with the selected vendor and DoIT. Vendors should propose an approach that supports Day 1 readiness in Phase 1 and can scale for future phases consistent with State standards, security controls, and governance requirements.

Please share the use case specific governance and role based access control requirements for all use cases in scope.

IDEC will refine this topic during Stage 1 discovery and planning with the selected vendor and DoIT. Vendors should propose an approach that supports Day 1 readiness in Phase 1 and can scale for future phases consistent with State standards, security controls, and governance requirements.

Please suggest what roles and permissions need to be defined for different user groups (e.g. external and internal)

IDEC will refine this topic during Stage 1 discovery and planning with the selected vendor and DoIT. Vendors should propose an approach that supports Day 1 readiness in Phase 1 and can scale for future phases consistent with State standards, security controls, and governance requirements.

Please provide details around the information security requirements to secure the data outflows.

IDEC will refine this topic during Stage 1 discovery and planning with the selected vendor and DoIT. Vendors should propose an approach that supports Day 1 readiness in Phase 1 and can scale for future phases consistent with State standards, security controls, and governance requirements.

Provide details on the tools being used for the monitoring, auditing and alerts which needs to be configured for the current scope.

IDEC will refine this topic during Stage 1 discovery and planning with the selected vendor and DoIT. Vendors should propose an approach that supports Day 1 readiness in Phase 1 and can scale for future phases consistent with State standards, security controls, and governance requirements.

Please provide the detailed requirements for the audit logging and data retention policies.

IDEC will refine this topic during Stage 1 discovery and planning with the selected vendor and DoIT. Vendors should propose an approach that supports Day 1 readiness in Phase 1 and can scale for future phases consistent with State standards, security controls, and governance requirements.

As mentioned, "Configure API Management Service and build up to 5-10 API and database connections." Could you please provide more details about the specific external systems and databases for which these APIs and connections need to be built?

Integration and data movement patterns will vary by source system. Vendors should assume a combination of file based transfers (e.g., encrypted SFTP), direct database connections where permitted, and API based integrations where available. Stage 1 discovery will confirm approved connectivity patterns per source, authentication methods, and any interface gaps. Any new API development needed to support required Phase 1 flows should be included in the vendor’s Stage 1 analysis and design plan.

92 Could you please confirm if there is an existing data quality framework that IDEC will adhere to the submission schedule published in the RFIS and any posted addenda. Vendors should plan to meet the stated due dates; any

Can IDEC identify which of the 10 dashboards are of high priority for Phase 1?

Are the business requirements already documented or will they be defined in

Phase 1? Can you share examples of existing dashboards that should be replicated or improved on the new platform?

IDEC anticipates up to 10 initial dashboards in Phase 1, and the specific set and thematic areas will be prioritized during Stage 1 discovery based on Day

1 operational needs. IDEC will provide high level objectives and available stakeholder input; vendors should propose an approach to rapidly refine requirements and deliver dashboards iteratively within the Stage 2 timeline.

What are the two critical applications requiring bi-directional integration? Is

API documentation available? What are the authentication mechanisms?

Integration and data movement patterns will vary by source system.