IT PPM RFQ QandA Final Responses.xlsx
XLSX spreadsheet 29 KB Posted
- Solicitation number
- BD-27-1107-1107T-TRC01-133640
- Issued by
- Suffolk County, Massachusetts
About this file
Q&A Response Document: IT PPM RFQ
This is a Questions and Answers (Q&A) response document issued by the Massachusetts Trial Court Office of Court Management regarding its RFQ for a Project and Portfolio Management (PPM) SaaS solution under Statewide Contract ITS86. The document addresses 53 detailed questions submitted by vendors regarding functional requirements, technical specifications, implementation scope, and contract terms. The RFQ seeks a PPM solution to replace Microsoft Project Online, which reaches end-of-life on September 30, 2026. The Trial Court anticipates supporting approximately 30 active IT projects with 20 project managers and 5 administrators requiring read/write access, plus up to 210 additional read-only users. The RFQ responses were due October 9, 2026, with questions submitted by September 25, 2026. The initial contract term is 36 months with two optional one-year renewal periods. A Notice of Apparent Successful Bidder was anticipated in October 2026, with go-live expected as early as reasonably possible following contract execution.
Key clarifications from the Q&A include: no Protected Health Information (PHI) will be handled by the solution; Microsoft Entra ID SSO and SCIM provisioning are required at production go-live and included in the firm-fixed price; no data migration from Project Online is in initial scope, with the Trial Court manually recreating approximately 30 active projects; the maximum of 3 portfolios, 3 project types, 1 intake form, 10 custom fields, and 5 user roles will be configured initially; approximately 150 team members should be priced as contributors with a lower pricing tier than project managers; Splunk and CrowdStrike Falcon integration is required with audit log export/API configuration as soon as possible; no AI features, collaboration platform integrations, or Power BI connections are required at go-live; all personnel with administrative access, including support staff, must be based in the United States with no remote access outside the U.S.; the solution must be hosted on FedRAMP-certified public clouds with FedRAMP Moderate or equivalent state-level certification; annual price escalators are acceptable but should reflect competitive pricing; and bidders must provide detailed responses to all numbered paragraphs of the RFx Cybersecurity Requirements document, distinguishing between one-time implementation costs and recurring SaaS subscription charges.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Sample Mandatory Contract Forms~1.pdf | ||
| Attachment C - Pricing Response Form.xlsx | XLSX spreadsheet | |
| ITS86 PPM SaaS RFQ - Bid Summary and Standard Provisions.docx | DOCX document | |
| Mandatory RFQ Documents~1.pdf | ||
| Attachment A - Scope of Services.docx | DOCX document | |
| RFx Cybersecurity Requirements.pdf | ||
| ITS86_18092026.pdf | ||
| Attachment B - Functional and Technical Requirements.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1 # Created Date User Created Question Answer
| 1 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | The Maximum Obligation Amount is listed as "TBD." Can the Trial Court share a budget range or funding ceiling for the initial term? | This information is not available to share with vendors. Vendors are expected to provide the pricing reflective of the value to the Commonwealth and consistent with the market rates for these solutions. |
| 2 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Project Online reaches end-of-life September 30, 2026, before the anticipated October award. Does the Trial Court have a target or required go-live date? Is there an interim arrangement for current project data? | Given that we do not intend to migrate project data due to the small number of projects, we expect this implementation to occur as early as reasonably possible and this criterion will be part of the evaluation. |
| 3 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | 1. PHI: Please clarify the nature and anticipated use of PHI within the PPM solution, including whether the selected SaaS provider will be considered a HIPAA Business Associate and required to execute a Business Associate Agreement. | No PHI will be handled via this solution since it handles project data and not health information. As suchm a HIPAA Business Associate Agreement is not required. |
| 4 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | 2. CrowdStrike: What specific technical integration is expected between a vendor-hosted multi-tenant SaaS solution and CrowdStrike Falcon | This depends on what is available, for instance if this project is in Salesforce, Azure or AWS there are connectors in CrowdStrike SEIM and Splunk SEIM and we would want to configure these connectors to bring in security relevant logs. If there is no prebuilt connectors available for the solution, then we would need to work with CrowdStrike or Splunk to figure out how to bring in security relevant logs. |
| 5 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | 3. Splunk: Is secure export/API delivery of application/security audit events to the Trial Court's Splunk environment sufficient | Yes, if this available we would want to utilize this means of exporting logs. |
| 6 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | 4. SCIM: Is SCIM provisioning mandatory at production go-live, and what objects/actions are expected-users, groups, roles, provisioning, deprovisioning? | Entra ID SSO is required at production go-live. However, SCIM provisioning is not required for every application to be implemented at go-live. |
Where SCIM provisioning is implemented, it should support user account creation, updates, and deprovisioning. The vendor must identify support for group and role assignments, including any limitations or additional configuration required.
Application-specific roles and skills should be maintained within the PPM platform, as applicable.
| 7 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | 5. U.S.-only access: Does the prohibition on remote access outside the U.S. apply to all vendor/subprocessor support personnel, including personnel who may have administrative access but do not routinely access Trial Court content? | The RFx Cybersecurity Requirements 2.E.e is clear. Even if not routinely access Trial Court content, having administrative access allows it and thus is not allowed. |
| 8 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | 6. PHI/security boundary: Will the Trial Court restrict users from entering sensitive case/health content into free-text PPM fields, or should the proposed system be designed and contracted as a PHI-hosting system? | No PHI will be handled. This was a typo in the Data Classification table of the RFx Cybersecurity Requirements. Only PII insofar as users of the platform is concerned will be handled in this project, along with other confidential data of the Trial Court's IT plans. |
| 9 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | 7. Historical Project Online data: Although migration isn't included in initial implementation, does the Court anticipate retaining Project Online history outside the new PPM system or potentially adding migration before go-live? | We will retain Project Online history outside of the new PPM system. |
| 10 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | (Attachment A, Oral Presentations) Demonstrations are listed as "TBD." If available, please provide the anticipated date window and whether they will be virtual or on-site. | There is no decision yet on whether a demonstration will be required. This will be communicated in due time and certainly not before October 15th. |
| 11 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | The ~150 project team members are described as read-only. However, Req. 22 (personal work queues) and Req. 11 (actuals vs. allocation) imply team members will update tasks or report time. Should bidders price team members as read-only viewers or as contributor or time-entry users? | Plesae price team members as contributors for this purpose. However, given their roles, the pricing tier should be a level below that of the role of project managers or administrators. |
| 12 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | (Attachment B Req. 28) Does free, unlimited viewer access within the proposed product satisfy this requirement? | Yes, provided this access can be confined to the organization, and not public access. |
| 13 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | How many of each of the following does the Trial Court expect to be configured at go-live: portfolios and programs, project types or lifecycle templates, intake forms, approval workflows, custom fields, user roles, dashboards, and standard reports? | - portfolios and programs: max 3 portfolios initially (capital, BAU, etc.), programs: 0 |
- project types or lifecycle templates (max 3),
- intake forms:1
- approval workflows: please suggest,
- custom fields: max. 10,
- user roles (max.5), dashboards: please suggest,
- standard reports: please suggest
| 14 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Which capability areas does the Trial Court expect to be configured and in use at go-live, and which can be turned on later? Specifically: agile boards and sprints (Req. 5), resource capacity planning (Req. 8-12), financial budgeting and forecasting (Req. 13-17), and demand/intake with stage-gates (Req. 18-20). | These capabilities are expected to be available from the go-live; however, their setup and configuration will occur over time as we make use of the solution. |
| 15 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Which Project Online features are in daily use today? For example: Project Web App timesheets, resource engagements, Project desktop client, Power BI reports, SharePoint project sites. | Please refrain from comparing your solution to Project Online. We do not expect a 1:1 replacement but a solution that meets what is required in Attachment B. |
| 16 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | If available - can the Trial Court provide a list or samples of the dashboards and reports currently produced from Project Online, including Power BI content, that must be replicated at go-live? | Please refrain from comparing your solution to Project Online. We do not expect a 1:1 replacement but a solution that meets what is required in Attachment B. |
| 17 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Attachment A says data migration is not in initial scope. Given Project Online end-of-life, does the Trial Court expect to (a) manually re-create the ~30 active projects, (b) have the vendor load active project schedules from exported files (MPP/XML) at go-live, or (c) something else? Does historical or closed project data need to be retained anywhere? | We will manually re-create the projects that are in execution moving forward. We do not anticipate all 30 to be re-created. |
| 18 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Does the Trial Court have documented current-state materials it can share, such as a PMO methodology or playbook, lifecycle/phase-gate definitions, intake and governance process, status report templates, and project templates? Should bidders plan to replicate current processes or redesign them during implementation? | These materials will be shared, to the extent available, during the discovery phase of the awareded solution. |
| 19 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Req. 9 requires automatic provisioning from IAM, and the RFx Cybersecurity Requirements (Sec. G) call for Microsoft Entra ID SCIM provisioning and SSO. Attachment A says no integrations are in initial scope. Are Entra ID SSO and SCIM provisioning required at go-live and included in the Firm Fixed Price? | See answer to Question 6. Entra ID SSO and SCIM provisioning are required. The integrations we refer to in Attachment A are for any financial systems, external BI tools, third-party project tracking tools, and such, which pertain to the inherent functionality of a PPM tool. |
| 20 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Req. 9 references provisioning resources "including their roles and skills." Does the Trial Court's Entra ID directory currently store role and skill attributes for IT staff, or should skills be maintained in the PPM tool with group membership driving platform roles? | Skills should be maintained in the PPM tool. User access and platform roles should be managed through the platform's role-based access controls, with Entra ID group membership used for role assignment were supported by the solution. |
| 21 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | The RFx Cybersecurity Requirements (Sec. H.b) require support for integration with Splunk and CrowdStrike Falcon. Does the Trial Court require audit log forwarding to Splunk to be configured at go-live, or is log export/API availability for a future integration sufficient? | We would want to configure the export of logs as soon as access to the environment is obtained. We would want to have logging in place as soon as possible. |
| 22 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | For Req. 5 (agile) and Req. 6 (hybrid), do Trial Court IT teams currently use a separate agile tool such as Azure DevOps or Jira? Should sprint and backlog work happen natively in the PPM platform, or should the PPM platform report on work managed elsewhere? | Please indicate your capabilities in managing agile projects and whether you support them natively in the PPM. |
| 23 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | For Req. 13-17, what financial data will be managed in the platform at go-live? Will budgets and actuals be entered manually or sourced from MMARS? Will labor cost rates be provided? Is time entry against tasks (timesheets) expected? | It will be budgetary information entered manually, but as stated, it may be possible that we request integrations for this aspects in the future. Time entry against tasks is not initially expected but may be required in the future as our capabilities mature. |
| 24 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Req. 23 requires integration with collaboration platforms. Please confirm the Trial Court's collaboration stack (e.g., Microsoft 365 with Outlook and Teams) and whether anything beyond email notifications, such as a Teams connector, is expected at go-live. | Please indicate your capabilities. No initial integration is expected at go-live. |
| 25 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Req. 27 references self-service BI and Req. 29 requires data refresh schedules. Does the Trial Court use Power BI, and is a live connection from the PPM platform to Power BI expected at go-live? | Please indicate your capabilities. No initial integration is expected at go-live. |
| 26 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Attachment A requires disclosure of AI functionality. Does the Trial Court intend to enable AI features (e.g., generated status summaries, risk prediction, natural-language search) during the initial term, or should they be disabled by default? | We are interested in knowing you solution's capabilities and licensing model, as stated. The decision to enable/disable these will take place during the contracting phase with the awareded solution. |
| 27 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | What Trial Court resources will be assigned to the implementation (Department PM, PMO lead, platform administrators, identity/security staff, PM and executive SMEs), and at what approximate availability during discovery, configuration review, testing, and training? | This will be communicated to the winning vendor once a contract is in place. |
| 28 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Will the Trial Court assign a dedicated resource during implementation who will own the system afterward? Are the five administrators in Attachment A technical system admins or PMO administrators? | This will be communicated to the winning vendor once a contract is in place. |
| 29 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Will the Trial Court run user acceptance testing with its own staff? Does the Court expect the vendor to write the test scripts? What UAT duration should bidders assume? | User acceptance testing will take place with the Trial Court's own staff. Vendors must describe this as part of their implementation approach. |
| 30 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | For training included in the Firm Fixed Price, please clarify: approximate participant counts by role (administrators, project managers, team members, executives), whether sessions can be virtual, whether train-the-trainer is acceptable for the ~150 team members and ~60 executives, and whether any training must be on-site. | Refer the the number of actual users. In any case, it should aimed primarily at the project managers and administrators. Virtual and remote training is acceptable. |
| 31 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Does the Trial Court expect any on-site presence during implementation (kickoff, workshops, training, go-live support), or is fully remote delivery acceptable? Note that ITS86 does not allow travel surcharges on invoices. | Please describe your preferred approach. Onsite may be important for an initial phase, but remote delivery can be accepted. |
| 32 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | For Req. 40-41 and the Deliverables list, will the Trial Court accept configuration built on the vendor's platform's standard data model and templates with Court-specific changes on top, or does it expect a custom configuration modeled on its current MS Project Online setup? | Configuration built on top of the vendor's platform's standard data model is expected. Please refrain from comparing your solution to Project Online. We do not expect a 1:1 replacement but a solution that meets what is required in Attachment B. |
| 33 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | The calendar shows Notice of Apparent Successful Bidder in October 2026. When does the Trial Court expect to issue the Purchase Order or Notice to Proceed, and what steps (SOW negotiation, contract execution, CORI checks) happen between notice and NTP? | This will be communicated in due time to the winning bid. |
| 34 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Does the Trial Court have a target go-live date or window (calendar year-end, fiscal year, planning cycle)? Is a phased go-live acceptable, with core project and portfolio management first and financials, intake, or capacity planning later? | Please suggest an implementation schedule that conducts this as early as reasonably possible. |
| 35 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Please confirm the Trial Court's fiscal year (July 1 to June 30) for Req. 15, and identify any budget or planning cycle milestones the platform should support in year one. | Fiscal year dates are confirmed. |
| 36 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Are there blackout periods, court calendar constraints, year-end freezes, or other major IT initiatives in late 2026 and early 2027 that would limit Trial Court staff availability for implementation? | This will be communicated in due time to the winning bid. |
| 37 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | If demonstrations are held, will the standardized demo script or business scenarios be shared with invited bidders in advance, and with how much lead time? | This will be communicated in due time |
| 38 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Req. 30 requires "FedRAMP-certified public clouds" and Sec. E.a of the cyber requirements says FedRAMP Moderate or higher "or equivalent state-level certifications." Does the Trial Court require (a) the SaaS application itself to hold FedRAMP Moderate or StateRAMP authorization, or (b) hosting on FedRAMP-authorized infrastructure (AWS, Azure) with SOC 2 Type II and ISO 27001 for the application? Does StateRAMP satisfy the requirement? | Please indicate your level of certification. |
| 39 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | The cyber requirements data classification table marks Protected Health Information (PHI) as applicable. Does the Trial Court expect PHI to be stored in the PPM platform? If so, will a HIPAA Business Associate Agreement and the EOHHS Data Management and Confidentiality Agreement be required? | Refer to question 3 |
| 40 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Sec. E.e limits remote access to Judiciary data to personnel in the United States. Does this apply to all vendor and publisher personnel who could potentially access customer data (including 24x7 support and platform engineering), or only to personnel who access Trial Court data while providing services? Would US-only support routing with contractual restrictions on non-US access be acceptable? | This requirement applies to any and all personnel who could potentially access customer data, including support. |
| 41 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Sec. F.e asks how encryption keys are managed. Does the Trial Court require customer-managed encryption keys (BYOK), or is publisher-managed encryption with documented key rotation acceptable? | Please document what method your platform uses. |
| 42 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Sec. A says applicable Judiciary policies will be provided before contract execution. Can the Trial Court share or identify those policies now, or confirm that the EOTSS Enterprise Information Security Policies are the baseline for evaluating responses? | RFx Cybersecurity Requirements 2.A.b. answers this. |
| 43 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Will the Trial Court accept the software publisher's standard subscription agreement, data processing addendum, and SLA as attachments to the response, with ITS86 terms controlling in any conflict? Are the RFx Cybersecurity Requirements (including the breach cost provisions in Sec. J.c) negotiable at the SOW stage? | Any proposed terms and conditions beyond those incorporated into the Commonwealth Terms and Conditions, Statewide Contract ITS86, and the published RFQ and supporting documents will be subject to review by the Trial Court's legal team. The Trial Court cannot accept terms and conditions that directly conflict with the governing contractual requirements. |
Any proposed modifications relating to the applicable Terms and Conditions or the RFx Cybersecurity Requirements, including the breach cost provisions in Section J.c, must be explicitly identified in the Bidder's proposal. The Trial Court will review such requests but makes no commitment to accept or negotiate any proposed changes during the Statement of Work (SOW) stage. Unless expressly approved by the Trial Court, all published requirements and applicable contractual terms shall remain in effect.
| 44 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Does the Trial Court have minimum SLA expectations (uptime percentage, severity-based response times, service credits), or will each bidder's standard SLA be evaluated on its own? Is business-hours support acceptable, or is 24x7 required? | Please decribe your own SLA proposal, as well as any support tiers if they are priced separately. |
| 45 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Sec. K.a requires data retention schedules that follow Judiciary records policies. Will the Trial Court provide the retention schedule for project and portfolio records? Should the platform enforce retention and disposition automatically, or support it through export and administrative deletion? | Retention policies and schedules will be communiucated to the winning bidder in due time. The platform should support automatic retention and disposition but this can be discussed during implementation. |
| 46 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Attachment B Req. 35 references "the attached Accessibility Requirements for the Commonwealth of Massachusetts government." This attachment is not among the posted bid documents. Please post it or confirm which document bidders must complete for Req. 35. | Requirement #35 is removed and does not require a response. This is covered in Attachment A Section 5.12 |
| 47 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Attachment A says subscription charges may be invoiced starting at go-live. Does the 12- or 36-month subscription term start at go-live or at contract execution? If the publisher's subscription must start at execution to provision the environment, should bidders show the pre-go-live period as a separate line in Attachment C or absorb it? | Please refer to 8.1 where this is answered. |
| 48 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | For the 36-month pricing and the two renewal years in Attachment C, are annual price escalators acceptable? Does the Trial Court have a cap or expectation, such as fixed pricing for the initial term or a maximum annual increase? | Bidders may propose annual price adjustments for the initial thirty-six (36) month term and the two (2) optional one-year renewal periods, provided that all proposed increases are clearly identified in Attachment C. The Trial Court has not established a specific maximum annual escalation percentage. However, Bidders are encouraged to provide their most competitive pricing wherever possible and any proposed escalations will be reviewed as part of the evaluation of the pricing proposal. |
| 49 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Is there a page limit, required section order, or template for the Technical Proposal narrative? May bidders attach supplemental material to Attachment B (screenshots, extra rows for sub-requirements), or must all explanation stay in the Bidder Comments column? | There is no page limit to the technical proposal narrative, but superfluous marketing material may not be posted, i.e., only written responses are accepted. Bidders should provide a concise response in Attachment B and expand as reasonably necessary in the Technical Proposal narrative. |
| 50 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Can the Trial Court confirm the license quantities to be priced as the baseline (e.g., 25 full read/write users) so all bidders price the same base configuration, with other user types shown as unit pricing? | Please use the data in Attachment A, Section 5.1 |
| 51 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Support and Maintenance - where would you like us to provide pricing for the support services component? We do not see a place in the pricing excel sheet that clearly states where to enter the 12-36 month ongoig support subscription after go live. | As a SaaS solution, ongoing support is implied in the subscription price. However, if bidders wish to break out this cost, it should be listed as another line item in each option. |
| 52 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Do you require a response to the RFx Cybersecurity Requirements document that is part of the RFP package? It is not specifically mentioned as a required document. | Requirement #36 explicitly lists this document as of required compliance. Therefore, a response to said document is expected. This response shall be for each numbered paragraph and not a statement of general compliance. |
| 53 | 9/25/26 | Beth Drake/Carahsoft Technology Corporation | Are resources located outside of the Unites States permitted to perform remote development work on this project? | Yes, as long as they DO NOT have access to the production environment. |
File details come from the government source that posted it. Updated .